On Top of Cisco IWAN dictionary, eye.lo can recognize traffic based on IP, port, HTTP hostname, SSL (HTTPS) server name. The workflow is the following:
- Does the flow match an embedded eye.lo customer specific application ?
- If no match, does it belong to the Nbar2 dictionary?
- If no match, does it match with a IANA service based on well-known ports?
If no match then the flow is classified as unknown
As a multi-tenant platform, eye.lo does not support network discovery. eye.lo needs information that can not be discovered such as the client name for a specific IP address, and particular IWAN fields to process IWAN information. A seed file is required to enable eye.lo.
Standard SNMP polling mode help admin to quickly add metrics based on OID (For example: CPU, traffic, drop, ….).
Expert mode leverages a scripting interface to connect the monitored device and its counterparts (Provider Edge, IPSLA probe) and collect advanced metrics (CoS, IPSLA, Metrics, ..). Admins can mix CLI, attributes coming from the topology and routers template to build advanced metrics such as traffic per CoS, IPSLA jitter, …
An expert mode is available on eye.lo. It records raw flows (data + template) coming from the specified CPE and make the the data available for analysis. It helps admin troubleshoot issues on router template configuration.
The Flow Record represents the atomic building block exported by the device. NFv9 and IPFIX define 4 types of flow records: template, data, options template, options data. While template and data records describe the actual live traffic, the two latter stand for static mapping information, such as devices, interfaces, applications…
IWAN monitoring level may be configured through eye.lo provisioning for each CPE. If the CPE exports PFR data flows but provisioned only for AVC, the PFR flows will be ignored by eye.lo.
Is it possible to define his own Key Performance Indicators based on raw counters provided by the collection ?
Beside default KPI included in the KPI library, admins can define custom KPIs they need to assess the Network and end-user experience. They use a graphical interface to build formulas mixing raw counters and operand. New KPIs are immediately available for building new graph or tables.