Sunburst

The recently released open source Sunburst application provides a real-time visualization of the protocols running a network. The Sunburst application runs on the sFlow-RT real-time analytics platform, which receives standard streaming sFlow telemetry from switches and routers throughout the network to provide comprehensive visibility.

docker run -p 8008:8008 -p 6343:6343/udp sflow/prometheus

The pre-built sflow/prometheus Docker image packages sFlow-RT with the applications for exploring real-time sFlow analytics. Run the command above, configure network devices to send sFlow to the application on UDP port 6343 (the default sFlow port) and connect with a web browser to port 8008 to access the user interface.

 
The chart at the top of this article demonstrates the visibility that sFlow can provide into nested protocol stacks that result from network virtualization. For example, the most deeply nested set of protocols shown in the chart is:

1. eth: Ethernet
2. q: IEEE 802.1Q VLAN
3. trill: Transparent Interconnection of Lots of Links (TRILL)
4. eth: Ethernet
5. q: IEEE 802.1Q VLAN
6. ip: Internet Protocol (IP) version 4
7. udp: User Datagram Protocol (UDP)
8. vxlan: Virtual eXtensible Local Area Network (VXLAN)
9. eth: Ethernet
10. ip Internet Protocol (IP) version 4
11. esp IPsec Encapsulating Security Payload (ESP)

Click on a segment in the sunburst chart to further explore the selected protocol using the Flow Browser application.

The Flow Browser allows the full set of flow attributes to be explored, see Defining Flows for details. In this example, the filter was added by clicking on a segment in the Sunburst application and additional keys were entered to show inner and outer IP addresses in the tunnel.