Visualization mapping of network traffic telemetry
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for visualizing network data. In some implementations, a server receives a query for network traffic playback data of network devices. The server extracts data from the query. The server obtains historical network traffic data. The server generates the network playback data by: (i) obtaining a plurality of historical network traffic elements from the historical network traffic data associated with a network device, (ii) obtaining state transitional data for each historical network traffic element of the plurality of historical network traffic elements, (iii) determining whether the state transitional data for each historical network traffic element comprises the prior state, and (iv) in response to determining the state transitional data comprises the prior state, the server appends the state transitional data to the network playback data. The server filters and provides the network playback data.
1. A computer-implemented method comprising:
receiving, by a server and from a client device, a query for network traffic playback data of multiple network devices;
extracting, by the server, data from the query that characterizes prior network traffic for the multiple network devices;
obtaining, by the server, network traffic data associated with the multiple network devices;
generating, by the server, the network traffic playback data using (i) state value pairs of the network traffic data having values that differ by at least a particular amount and (ii) the extracted data from the query by:
for each given network device among one or more of the multiple network devices:
obtaining, by the server, a first data element from the network traffic data associated with the given network device, wherein the first data element specifies, for the given network device, a first timestamp and at least a first next state value indicative of a state of the given network device at a first time represented by the first timestamp;
determining, by the server, that the first data element includes (i) the first next state value and (ii) a first prior state value that differs from the first next state value by at least a particular amount, wherein the first prior state value is indicative of a first prior state of the given network device prior to the first time represented by the first timestamp; and
in response to determining that the first data element includes (i) the first next state value and (ii) the first prior state value that differs from the first next state value by at least a particular amount, appending, by the server, the first data element to the network traffic playback data;
filtering, by the server, the network traffic playback data using the extracted data from the query; and
providing, by the server, the filtered network traffic playback data to the client device, wherein inclusion, in the first data element, of the first prior state value indicative of the first prior state of the given network device prior to the first time represented by the first timestamp enables reverse visual playback of the playback data.
2. The computer-implemented method of claim 1 , wherein the data from the query comprises one or more of locational data, an identifier for each of the multiple network devices, or a time range.
3. The computer-implemented method of claim 2 , wherein the time range comprises a prior period that includes a predetermined length of time prior to a current time of the query.
4. The computer-implemented method of claim 1 , further comprising:
obtaining, by the server, a set of data elements including the first data element and multiple other data elements from the network traffic data associated with the given network device, wherein each of the multiple other data elements includes a timestamp representing a time when a next state value included in the data element was obtained;
sorting, by the server, the set of data elements by a first characteristic.
5. The computer-implemented method of claim 1 , further comprising:
determining that a second data element, having a second timestamp, includes a second next state value indicative of the state of the given network device at a second time represented by the second timestamp, but does not include a second prior state value indicative of a second prior state of the given network device prior to the second time represented by the second timestamp; and
in response to determining that the second data element does not include the second prior state value:
searching, by the server, other data elements for the second prior state value indicative of the second prior state of the given network device prior to the second time represented by the second timestamp, wherein each of the other data elements specify corresponding next states of the given network device at different times represented by different timestamps;
in response to determining that the other data elements do not include the second prior state value:
copying, by the server, the second next state value of the second data element to the second prior state value of the second data element; and
appending, by the server, the second data element, including the second next state value copied to the prior second state value of the second data element, to the network traffic playback data.
6. The computer-implemented method of claim 1 , further comprising:
determining that a second data element, having a second timestamp, includes a second next state value indicative of the state of the given network device at a second time represented by the second timestamp, but does not include a second prior state value indicative of a second prior state of the given network device prior to the second time represented by the second timestamp; and
in response to determining that the second data element does not include a second prior state value:
searching, by the server, other data elements for the second prior state value indicative of the second prior state of the given network device prior to the second time represented by the second timestamp, wherein each of the other data elements specify corresponding next states of the given network device at different times represented by different timestamps;
in response to determining that one of the other data elements does include the second prior state value:
copying, by the server, the prior state value from the one of the other data elements to the second data element; and
appending, by the server, the second data element, including the prior state value copied to the prior second state value of the second data element, to the network traffic playback data.
7. The computer-implemented method of claim 1 , further comprising:
displaying, by the server, the filtered network traffic playback data to the client device;
receiving, by the client device, user input that specifies a direction to move the displayed network traffic playback data, wherein the direction specified by the user input comprises a decrement in time of the filtered network traffic playback data;
adjusting, by the client device, the displayed network traffic playback data based on the received user input, including presenting the network traffic data in reverse based on the user input specifying a decrement in time;
determining, by the client device, whether interpolation is required for a given state transition based on an amount of transition between a given prior state value and a given next state value of one or more data elements in the displayed network traffic playback data; and
in response to determining that interpolation is not required for the first state transition, displaying, by the client device, a current state value of the displayed network traffic playback data.
8. The computer-implemented method of claim 7 , wherein determining whether interpolation for the first state transition is required based on the amount of transition between the given prior state value and the given next state value of the one or more data elements in the displayed network traffic playback data comprises:
comparing, by the client device, the amount of transition between the given prior state value and the given next state value of the element to a threshold value; and
in response to determining that the amount of transition does not satisfy the threshold value, determining, by the client device, that interpolation is not required.
9. The computer-implemented method of claim 8 , further comprising:
determining that interpolation is required for a second state transition;
in response to determining that interpolation is required for the second state transition, determining, by the client device and for the second state transition, a set number of states between a second prior state and a second next state of the network traffic element; and
displaying, by the client device, the set number of states between the second prior state and the second next state for the network traffic element.
10. The computer-implemented method of claim 1 , wherein the filtered network traffic playback data is configured to be played in a forward manner, a backward manner, a forward speed, and a backward speed.
11. The computer-implemented method of claim 1 , wherein the filtered network traffic playback data include one or more of traceroute activity, network latency, network speeds, and network bandwidth.
12. The computer-implemented method of claim 1 , wherein the filtered network traffic playback data include one or more of wind speed data, temperature data, fire data, earthquake data, lightning strike data, power outage data, satellite orbit data, or other geological data.
13. A system comprising:
one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
receiving a query for network traffic playback data of multiple network devices;
extracting data from the query that characterizes prior network traffic for the multiple network devices;
obtaining network traffic data associated with the multiple network devices;
generating the network traffic playback data using (i) state value pairs of the network traffic data having values that differ by at least a particular amount and (ii) the extracted data from the query by:
for each given network device among one or more of the multiple network devices:
obtaining a first data element from the network traffic data associated with the given network device, wherein the first data element specifies, for the given network device, a first timestamp and at least a first next state value indicative of a state of the given network device at a first time represented by the first timestamp;
determining that the first data element includes (i) the first next state value and (ii) a first prior state value that differs from the first next state value by at least a particular amount, wherein the first prior state value is indicative of a first prior state of the given network device prior to the first time represented by the first timestamp; and
in response to determining that the first data element includes (i) the first next state value and (ii) the first prior state value that differs from the first next state value by at least a particular amount, appending the first data element to the network traffic playback data;
filtering the network traffic playback data using the extracted data from the query; and
providing the filtered network traffic playback data to a client device, wherein inclusion, in the first data element, of the first prior state value indicative of the first prior state of the given network device prior to the first time represented by the first timestamp enables reverse visual playback of the playback data.
14. The system of claim 13 , wherein the data from the query comprises one or more of locational data, an identifier for each of the multiple network devices, or a time range.
15. The system of claim 14 , wherein the time range comprises a prior period that includes a predetermined length of time prior to a current time of the query.
16. The system of claim 13 , wherein the instructions cause the one or more computers to perform operations further comprising:
obtaining a set of data elements including the first data element and multiple other data elements from the network traffic data associated with the given network device, wherein each of the multiple other data elements includes a timestamp representing a time when a next state value included in the data element was obtained;
sorting the set of data elements by a first characteristic.
17. The system of claim 13 , wherein the instructions cause the one or more computers to perform operations further comprising:
determining that a second data element, having a second timestamp, includes a second next state value indicative of the state of the given network device at a second time represented by the second timestamp, but does not include a second prior state value indicative of a second prior state of the given network device prior to the second time represented by the second timestamp; and
in response to determining that the second data element does not include the second prior state value:
searching other data elements for the second prior state value indicative of the second prior state of the given network device prior to the second time represented by the second timestamp, wherein each of the other data elements specify corresponding next states of the given network device at different times represented by different timestamps;
in response to determining that the other data elements do not include the second prior state value:
copying the second next state value of the second data element to the second prior state value of the second data element; and
appending the second data element, including the second next state value copied to the prior second state value of the second data element, to the network traffic playback data.
18. The system of claim 13 , wherein the instructions cause the one or more computers to perform operations further comprising:
determining that a second data element, having a second timestamp, includes a second next state value indicative of the state of the given network device at a second time represented by the second timestamp, but does not include a second prior state value indicative of a second prior state of the given network device prior to the second time represented by the second timestamp; and
in response to determining that the second data element does not include a second prior state value:
searching other data elements for the second prior state value indicative of the second prior state of the given network device prior to the second time represented by the second timestamp, wherein each of the other data elements specify corresponding next states of the given network device at different times represented by different timestamps;
in response to determining that one of the other data elements does include the second prior state value:
copying the prior state value from the one of the other data elements to the second data element; and
appending the second data element, including the prior state value copied to the prior second state value of the second data element, to the network traffic playback data.
19. The system of claim 13 , wherein the instructions cause the one or more computers to perform operations further comprising:
displaying the filtered network traffic playback data to the client device;
receiving user input that specifies a direction to move the displayed network traffic playback data, wherein the direction specified by the user input comprises a decrement in time of the filtered network traffic playback data;
adjusting the displayed network traffic playback data based on the received user input, including presenting the network traffic data in reverse based on the user input specifying a decrement in time;
determining whether interpolation is required for a given state transition based on an amount of transition between a given prior state value and a given next state value of one or more data elements in the displayed network traffic playback data; and
in response to determining that interpolation is not required for the first state transition, displaying a current state value of the displayed network traffic playback data.
20. The system of claim 13 , wherein the filtered network traffic playback data include one or more of wind speed data, temperature data, fire data, earthquake data, lightning strike data, power outage data, satellite orbit data, or other geological data.
21. A non-transitory computer-readable medium storing software comprising instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:
receiving a query for network traffic playback data of multiple network devices;
extracting data from the query that characterizes prior network traffic for the multiple network devices;
obtaining network traffic data associated with the multiple network devices;
generating the network traffic playback data using (i) state value pairs of the network traffic data having values that differ by at least a particular amount and (ii) the extracted data from the query by:
for each given network device among one or more of the multiple network devices:
obtaining a first data element from the network traffic data associated with the given network device, wherein the first data element specifies, for the given network device, a first timestamp and at least a first next state value indicative of a state of the given network device at a first time represented by the first timestamp;
determining that the first data element includes (i) the first next state value and (ii) a first prior state value that differs from the first next state value by at least a particular amount, wherein the first prior state value is indicative of a first prior state of the given network device prior to the first time represented by the first timestamp; and
in response to determining that the first data element includes (i) the first next state value and (ii) the first prior state value that differs from the first next state value by at least a particular amount, appending the first data element to the network traffic playback data;
filtering the network traffic playback data using the extracted data from the query; and
providing the filtered network traffic playback data to a client device, wherein inclusion, in the first data element, of the first prior state value indicative of the first prior state of the given network device prior to the first time represented by the first timestamp enables reverse visual playback of the playback data.