Realtime monitoring: traffic details

[gsanchietti]

Extension Card: Detailed Traffic per Host

This card extends the detailed traffic monitoring functionality by focusing on local and remote hosts, as well as app-specific traffic.

1. App Selection: Traffic per Local Host Using an App

• Task: Select an app to view a ranking of local hosts using the app and their traffic.

2. Local Host Selection: App & Remote Host Breakdown

• Task: Select a local host to view:
  • Apps used by the host (like ntopng data).
  • Remote hosts contacted by the host (like ntopng data).
  • Display app and remote host info together to show which host is contacted and via what type of traffic.

3. Remote Host Selection: Traffic Breakdown

• Task: Select a remote host to view:
  • Local hosts that contacted it (ranking).
  • Apps or protocols used to connect to that remote host.

[Tbaile]

Going to split this down in multiple issues, just to be aware of the tasks that are needed to be done (and to make life easier for reviewers of both UI and backend).

[Tbaile]

Image: 23.05.5-ns.1.3.0-89-g31e296d1

There's not really a QA about this feature but the following are to be browsed to check if the feature is working as intended:

Go to Monitoring > Real time monitor and navigate into the Instant traffic tab, check that data is visible correctly.

Then you can go back to the Traffic tab and try the new filtering options. You can click table records to filter the data by that "client", "application", "remote host" or "protocol.

Suggesting to test the feature with data from a high traffic firewall.

[gsanchietti]

Verified.

[gsanchietti]

Released on 23.05.5-ns.1.4.0