Reference
Live
The Live page shows the last five minutes of your traffic, second by second, with who's talking, active attacks and exporter health.
Live is the home page. It opens with the last five minutes already drawn and updates every second over a WebSocket.
What’s on it
Section titled “What’s on it”- Figures: inbound and outbound traffic, packets and flow records, with sparklines and the change against the same five minutes yesterday.
- The main chart, with a switcher: traffic in and out (inbound above the axis, outbound below), by protocol, packets, flow records, and SYN and fragment rates. Beside it, the protocol mix, the IPv6 share and the average packet size.
- Who is talking now: your busiest hosts inbound and outbound, the busiest remote ASes and the top applications. Each list’s title opens the full list in Explore, over the last 5 minutes with the same filter.
- Uplinks against their capacity, and inbound countries.
- Events: attacks, mitigations, BGP sessions, exporters and configuration changes as they happen.
- Exporters: records per second, sampling rate, sequence loss and export lag for each router.
Active attacks also show in a red strip above every page, and an emergency stop of all mitigation in its own strip.
Filters
Section titled “Filters”Filters narrows the whole page to one exporter, hostgroup or interface. A filtered view keeps counting for 15 minutes after you leave it, so coming back shows its last five minutes.
Late flows and the shaded seconds
Section titled “Late flows and the shaded seconds”Routers that export from a flow cache (MikroTik, J-Flow, most NetFlow v9) report a flow only after it ends or after their active timeout, so traffic arrives seconds late. Heimnull spreads each flow over the seconds it lasted, and redraws past seconds as late flows fill them in. The page:
- shades the newest seconds, which are still filling in;
- averages its figures over seconds that have settled, and says which second they describe;
- averages over a wider window when an exporter sends few records (at heavy sampling, a router may send under one record a second), and says so.
Packet samples (Juniper MX inline monitoring, sFlow) arrive within a second or two, and those pages stay at 1-second detail.
Looking closer
Section titled “Looking closer”Drag across a chart to open the range inspector for exactly that range: the top remote ASes, your hosts, remote hosts, applications, service ports and countries in it, with averages and peaks, and its largest flow records. A selection can be as short as 2 seconds, so a single spike can be inspected. “Open in Explore” continues there with the same range.
Click any address, AS, application, port, country or interface for its value menu.