METADATA COLLECTION

IOTA captures high fidelity PCAP traces. Once stored on the internal SSD, metadata is extracted allowing for a quick and responsive search in the dashboards. Up to 100 KPIs are extracted from packets, TCP/UDP flow, and flow behavior. Flow metadata can reduce the volume of data by 90% compared to the original PCAP trace. Throughout this process raw packet data is preserved, offering maximum flexibility between packet level visibility and metadata extraction.

QUICK SEARCH DATABASE

Explore long-term datasets accumulated over days, weeks or months.

CUSTOMIZABLE DASHBOARDS

Dashboards can be created, modified and shared across multi-users in a web-based environment.

DRILL DOWN TO HIGH FIDELITY PCAP TRACE

The capture engine embeds line-rate hardware features like packet slicing, filtering, and timestamping.

CONFIGURABLE IN DUAL SPAN OR IN-LINE MODE

All IOTA models can be configured in either dual out-of-band or in-line mode. The IOTA 1G embeds a high-performance fail-safe TAP, with PoE passthrough.

1TB/2TB ENCRYPTED STORAGE

PCAP collection, metadata database, and system are stored on an encrypted SSD (AES 256-bit).

PHYSICAL ISOLATION

The monitored network is physically isolated (diode) from the management interface, to avoid any risk of injection or MITM attack through the device.

FLEXIBLE POWERING OPTIONS

IOTA can be powered from a 30 W PoE+ switch (over the management port) and 12 VDC or 24 VDC power input.

Where the Overview dashboard shows who is talking to whom, the Application Overview dashboard shows what they are talking about. The data in this dashboard is categorized by application type, and by application. The graph can be changed to display latency, flow count, and payload size. This dashboard is a great starting point when analyzing application issues. It gives a clear overview of which components may be slowing your applications down. It can also help finding unexpected services, and services consuming too much bandwidth.

Provides an overview of recorded VoIP sessions, with the possibility to dig down on SIP and RTP metrics and details. The VoIP Sessions table provides a complete view of detected sessions with cross-correlation between control and data traffic. From this table, selecting a specific VoIP session is possible, allowing inspection of session-specific details in the various dashboard sections. The call flow is visualized in VoIP and SIP flow diagrams, to help get a better overview of the call details. The dashboard also provides MOS scores for a quick indication of call quality.

This dashboard provides an overview of HTTP traffic, to help monitor HTTP application traffic, distinguish between different return codes, see each different flow, and filter on them.

The Local Assets dashboard lists speaking interfaces present in the local network, based on the canonical private IP address ranges (RFC 1918 & RFC 4193). It helps to keep track of devices in the local network, and also unveil potentially unwanted devices. The bandwidth usage for the selected time range and filters is displayed on a chart. The DHCP host names of devices are displayed whenever possible. Clicking an IP address in the list navigates to the Host Details dashboard for that address.

The microburst dashboard provides an overview of traffic microbursts measured on the IOTA interfaces. The dashboard automatically selects the two interfaces as inbound and outbound and displays the microburst data for each of them separately in a chart. This dashboard can be used to get a general overview of microburst events and intensity, and then drill down on the time range where a microburst higher than usual was detected. The benefit of this dashboard is the ability to detect and filter on intense, short living microburst spikes that may not be visible on dashboards displaying average traffic volume, which helps identify buffer overflow issues. When the user has discovered the impacted time range, they can move to a different dashboard to perform further troubleshooting.

The Modbus Overview dashboard displays Modbus protocol message distribution over time, allowing you to troubleshoot industrial networks which contain Modbus traffic. The servers and clients that are part of the Modbus network are listed in a table.

This dashboard provides an overview of TLS-encrypted connections and whether they are considered safe, weak, or unsafe, based on the TLS version and cipher used. Connection information can be sorted and filtered to visualize and identify potentially problematic connections.

This dashboard gives an overview of TCP-related statistics, such as client IP, server IP, host names, iRTT, and more, such as an analysis of TCP connection completeness. Various graphs are available, providing different perspectives on the TCP traffic and offering full diagnostics of the TCP protocol. You can easily filter on common TCP-related attributes via the filter menu. Color coding of TCP analysis states helps give an at-a-glance view of the data transmission process.

The Bandwidth dashboard provides an overview of the traffic bandwidth measured on the IOTA interfaces. The dashboard automatically selects the two interfaces as inbound and outbound and displays the bandwidth data for each of them separately in a chart. This dashboard can be used to get a general overview of bandwidth usage over time, and then drill down on the time ranges where peaks of bandwidth usage have occurred. When the user has discovered an impacted time range, they can move to a different dashboard to perform further troubleshooting.

The DNS overview dashboard gives you an overview of DNS queries over time, top servers, and top queries by type. This dashboard helps troubleshooting starting from a specific domain and then following the associated flows. This gives a general idea of how your queries are spread out over time.

The Host Details dashboard is available every time an IP address is clicked. This dashboard provides a deep-dive into network activity specific to the filtered IP, and all the metrics you can use to analyze network issues based on geolocation, TCP data, protocol and application information, and flows.

The Flow Details dashboard is accessible by clicking the Inspect (?) button on any of the flow tables located in various dashboards. This visualization is useful for inspecting the details of one specific traffic flow. The top-right diagram will display the different protocol headers used in the communication and their main fields. On the left side, there are more in-depth details on packets exchanged inside the communication flow. The dashboard also provides traffic metrics like total payload, bandwidth usage, and the number of packets.

When a capture & analysis session is started, it will appear in this dashboard. This makes it easy to review or go back to an earlier session instantly. It’s also possible to find different analysis sessions by time. A “session” represents a self-standing correlation domain. A timeout determines whether captured and analyzed data is still part of the current session, or if it belongs in a new session.