Skip to main content
Skip table of contents

Network view

Connection issues can occur across different devices, users, binaries and destinations. Network view accelerates troubleshooting and helps you identify the appropriate team or vendor to fix network-related issues by providing an interactive visualization of connection.events data.

Accessing Network view

Network view is available in various modules and features to simplify troubleshooting network-related issues.

Use the following entry points to access a specific Network view:

  • Applications module

    • From a chosen application page, open the Desktop tab > Network tab.

  • Investigations module

    • From the Visual editor on the Investigation page, select Connection Events in the Display dropdown.

    • From the NQL editor on the Investigation page, run a query with connection.events table.

  • Device View

    • From a specific device view, open the Network tab.

  • Search in the main menu:

    • Type in a specific destination or port whether configured or not in Nexthink, click on Connections to the destination in the pop-up search window and open the Network tab on the loaded page.

    • Type in a specific binary, select Retrieve all > Events from the binary action menu in the pop-up search window and open the Network tab on the loaded page. See the image below.

The system may pre-filter Network view visualizations based on the entry point you use. For instance, display Network view with pre-filtered connection events for a particular binary.

NetworkView-1709903355.png

Data privacy in Network view

To prevent users from seeing sensitive data in Network view or in an investigation, set the Data privacy restriction of the user profile to any of the options below.

  • anonymous users, devices, destinations and domains

  • anonymous users and devices

  • anonymous users

Data privacy restrictions apply to the connection.events data used by Network view.

Refer to the Profiles documentation for more information.

NetworkView-1710344146.png

Enabling Network view in Investigations

To enable the Network view, choose one of the following options from the Investigations page:

Setting up metrics using the Visual editor

From the Investigations page:

  • Select Visual editor.

  • Choose Connection Events in the Display dropdown.

After selecting Connection events from the Display dropdown, the system enables the Network tab with all connection metrics visualizations.

However, the Results tab only shows the Total number of connections metric by default.

The Fields panel on the right side of the Nexthink web interface allows you to modify the metrics shown in the Results tab, if necessary.

To add or modify metrics in the Results tab, from the Investigations page:

  1. Click Add field to add a new metric.

  2. Select Overall under the metrics section.

  3. Select your desired metric.

Hovering over metrics displays a short description.

NetworkView-1709911002.png
  1. Verify that the added field appears in the Fields panel on the right side of the Nexthink web interface.

  2. Go to the Network tab and choose the desired metric from the Network view Display dropdown.

NetworkView-1710346929.png

Writing a query using the NQL editor

Directly write a query from the selected Investigations page to display Network view:

  1. Click NQL editor at the top of the selected Investigations page to add a query.

    • Ensure the query starts with connection.events.

    • Ensure the query has at least one metric.

  2. Run the query to show the result.

Network view query example

CODE
connection.events during past 7d
| summarize total_number_of_connections__ = event.number_of_connections.sum()
| list total_number_of_connections__

To troubleshoot specific network-related issues using queries, refer to the Application Connectivity troubleshooting framework documentation.

Using Network view

Network view breaks down the selected metrics for connection.events into multiple properties and shows how properties relate. Nodes and lines represent these relationships.

Network view displays four columns by default, allowing you to click on nodes or lines to drill down lower levels of breakdowns.

To switch from the displayed metrics and begin troubleshooting issues:

  1. Click the Display dropdown above the Network view visualization.

  2. Select one of the available metrics for the particular connection data set.

NetworkView-1710347107.png

Transport protocols in Network view

Sort the connection.events data displayed in Network view according to the transport protocol.

Find the following options above the Network view visualization:

  • Click TCP only for Transmission Control Protocol (TCP) connections established by a device.

  • Click UDP only for User Datagram Packages (UDP).

  • Click Any for both TCP and UDP.

Line thickness for visual comparison

The thickness of a line, which connects two nodes, is proportional to the metric value between those respective nodes when compared to the same metric values between different nodes in the same two columns.

The screenshot below shows the metric value between the columns Application → name and Destination type, which in this case represents connections values.

The thin line between the Outlook application node and the internet destination, considering the metric value for this case, represents fewer connections when compared to the MECM application node.

When viewing issue-related metrics, thick lines help you identify the most problematic areas.

Line coloring for issue detection

To identify issues quickly, lines are shown in red for the following issue-related metrics:

  • Failed connections : number_of_failed_connections

  • Failed connections - no host : failed_connections___no_host__

  • Failed connections - no service : failed_connections___no_service__

  • Failed connections - no service : failed_connections___rejected__

These issue-related metrics require setting the transport protocol to TCP Only as they exclusively apply to TCP connections.

NetworkView-1710407616.png

Node sorting

The system sorts nodes in descending order within each column. This makes it likelier that thicker lines appear towards the top, but this is not always true.

Network view shows the top eight nodes in each column. If a column has more than eight nodes, the values are aggregated into the Others node at the bottom of the column:

  • Click on More to open another eight nodes in a column.

  • Click Less to hide additional nodes.

To facilitate data interpretation, each node is associated with all paths going through it.

Hovering over a node or line

Hover over a node or a line to highlight the connection metric value that goes through that node or line.

The example below highlights all failed_connections___no_host__ between users from Solution Consulting and the Firefox application.

NetworkView-1710407775.png

Drilling down to specific fields

Network view displays four columns by default. Each column is associated with a hierarchy of fields to reduce the number of nodes shown on the screen.

The table below lists the hierarchy of fields for each column, which goes from general to specific.

Column 1
Device

Column 2
User

Column 3
Binary

Column 4
Destination

Public IP → Country

AD Department

Application → Name

Destination → Type

Public IP → State

Username

Binary → Product name

Destination → Owner

Public IP → City

Binary → Name

Destination → Country

Device → Name

Binary → Version

Destination → Data center region

Destination → Domain

To drill down on a Network view field, you have the following options:

  • Click on a node in the Network view visualization.

  • Click on a line between two nodes.

After clicking on a node or line, you can navigate back up the hierarchy using the expandable dropdowns in each column heading in Network view.

Clicking on a node

Click on a node to:

  • Apply a filter for the selected node.

  • Drill down one level in the column hierarchy.

In the example below, Network view applies a filter for the Zoom application.

Therefore, the third column levels down from Application → Name to Binary → Product name. The visualization and breakdowns are now as follows:

NetworkView-1710415038.png

Column 1
Device

Column 2
User

Column 3
Binary

Column 4
Destination

Public IP → Country

AD Department

Application → Name

Destination → Type

Public IP → State

Username

Binary → Product name

Destination name

Public IP → City

Binary → Name

Destination location

Device → Name

Binary → Version

Destination domain name

Clicking on a line

Click on a line to:

  • Apply a filter for the selected line, which is equivalent to clicking on the two nodes it connects.

  • Drill down one level in the hierarchy of the connected columns.

Therefore, using the example from above, clicking the line between the nodes zoom.us and internet results in:

  • The third column levels down from Application → Name to Binary → Product name

  • The fourth column levels down from Destination → Type to Destination → Owner.

The visualization and breakdowns are now as follows:

NetworkView-1710407993.png

Column 1
Device

Column 2
User

Column 3
Binary

Column 4
Destination

Public IP → Country

AD Department

Application → Name

Destination type

Public IP → State

Username

Binary → Product name

Destination → Owner

Public IP → City

Binary → Name

Destination location

Device → Name

Binary → Version

Destination domain name

Navigating back up the hierarchy

To navigate back up the hierarchy of the Network view fields after clicking on nodes or lines:

  1. Click on the dropdown in the Network view column heading.

  2. Click on any field names above the current level in the hierarchy.

When you access Network view specific to a binary or destination domain, the system applies filters to the column in Network view and sets the hierarchy to match the requested field.

The example below shows pre-filtered Alive connections data for the excel.exe binary. Click Clear filters to remove any field hierarchy filters.

CODE
| where binary.binary.name in ["excel.exe"]
NetworkView-1710408335.png

Network view capacities

Network view is restricted to:

  • A selected set of queries.

  • A maximum of 10,000 unique connection paths.

A connection path is a distinct permutation of values in each of the four columns of Network view. The table below is an example of connection paths.

See Using Network view on this page for more information about Network view columns and field hierarchy.

Path

Column 1
Device

Column 2
User

Column 3
Binary

Column 4
Destination

Public IP → Country

AD Department

Application → Name

Destination type

1

United States

Null

Null

internet

2

United States

Null

Null

intranet

3

United States

Null

Null

data center

4

United States

Null

Null

unknown

5

United States

Null

Chrome

internet

10,000

Singapore

Engineering operations

Photoshop

unknown

Query time-out

Network view queries take time to load significant amounts of connection data. To expedite the loading time, reduce the amount of connection data by:

  • Decreasing the timeframe.

  • Applying filters.


RELATED TOPICS

RELATED TRAINING

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.