Path Visualization

The Path Visualization renders the path trace data collected for each test round, showing every node and link between agents and the target URL or IP. Use it to localize loss along the path — distinguishing forwarding loss (network hops) from terminal loss (app, firewall, or target) — and to capture evidence for handoff.

For the underlying probe mechanism, see How Path Trace Works. For MPLS tunnel inference, see MPLS Tunnel Inference Using Deep Path Analysis.

New to Path Visualization, or walking a fresh issue? Jump to Investigate a Path Issue for a step-by-step walkthrough.

Path Visualization Controls

This section covers controls in the bar pictured below. For controls in the upper half of the view (test selector, timeline, metric overlay), see ThousandEyes View Layouts.

The controls bar is collapsible. Collapse it to maximize the topology canvas; expand it again from the chevron above the topology.

Control	Function	Use it to
Show	Filter which agents are visualized; when multiple tests are selected at the top of the view, an extra Tests filter appears here. Toggle IP address labels with the same row.	Reduce visual noise when several agents (or several tests) trip the same condition.
Group	Aggregate Agents, Interfaces, or Destinations along the axes listed in the Group Axes table below.	Collapse busy paths into network or location aggregates.
Highlight	Match nodes by Network, Country, IP address, Prefix, or Title. Set thresholds for Forwarding Loss (per node) and Link Delay (per link); the Link Delay slider moves in 5 ms increments.	Localize loss or latency to specific hops or links.
Select	Pin nodes or links to the Select dropdown. Selected items show a moving dashed outline. Use the Info dropdown to display nodes that meet listed criteria.	Capture evidence for a ticket, post-mortem, or screenshot.
Agent and endpoint complexity	Slider that collapses routes between nodes; the further apart the handles, the simpler the visualization.	Render dense topologies (large MPLS, ECMP) without losing the picture.

Display Preferences

Open the Path Visualization display preferences popover from the ellipsis (...) icon above the topology to control how aggregated values render on nodes and links.

• Delay and Response Time stats: choose Min, Average, or Max. The setting applies to both node response time (when shown) and link delay (when shown). Match the aggregate to the symptom: Max for spike chasing, Min for best-case, Average for trend.

Group Axes

Object	Group-by options
Agents	Agent, Network, Network & Location, Location
Interfaces	IP Address, Device, Network, Network & Location, Location
Destinations	IP Address, Network, Network & Location, Location

Example: agents grouped by Location, interfaces by Network, destinations by Network & Location.

Interaction Model

Tooltips

Hover over any agent, node, or link to reveal:

• Agents: name, IP address, prefix, network, location, destination IP address, and metric statistics.

• Nodes: IP address, prefix, network, location, and average response time.

• Links: source and destination IP addresses, number of routes traversing the link, MPLS information, and average link delay.

Selection

• Click a node or link to add it to the selection. Selected items show a moving dashed outline.

• Double-click a node or link to toggle selection on every path that traverses it.

• The Select field in the controls bar lists the current selection as X nodes or Y links. Expand it to see the full list.

• Selected nodes and paths, along with active highlights, are persisted in the URL and in saved snapshots, so a shared link or saved snapshot reproduces the exact selection state.

Investigate a Path Issue

Use this walkthrough to map a reported problem onto the Path Visualization view. The steps assume you have already opened the relevant test from Network & App Synthetics > Views.

1. Pick the time window. Use the timeline at the top of the view to navigate to the round when the user reported the problem. Each round is a single test execution; the path shown below the timeline reflects the round you have selected.

2. Choose which agents to look at. In the Show dropdown, narrow the list to the agents that reported the issue, or keep All to compare healthy and unhealthy paths side by side.

3. Reduce visual noise with Group. When several agents traverse the same upstream hops, aggregating Agents and Destinations by Network or Network & Location collapses parallel paths into a cleaner picture. Switch back to per-Agent grouping when you need to compare individual paths.

4. Use Highlight to localize the problem. Set thresholds in the Highlight control so the view marks the trouble spot for you. The numeric values below are illustrative — pick thresholds based on the symptom you are chasing and your normal baseline (see "Picking a real threshold" after the bullets).

   • To find packet loss at a hop, set Forwarding Loss above your threshold (for example, > 10%). Nodes above the threshold get a red ring.

   • To find slow links, set Link Delay (Avg) above your threshold (for example, > 100 ms). Links above the threshold turn red.

   • To spotlight a specific provider or hop, in the search field, type a value to match against Network, Country, IP address, Prefix, or Title.

   Picking a real threshold. Start above your normal baseline for the same path or test. For loss, set the threshold high enough to exclude routine background noise but low enough to catch the symptom you are investigating. For link delay, compare against the historical average for the same hop or against sibling agents on healthy paths during the same time window. When in doubt, start permissive (low threshold) and tighten until only the suspect node or link is highlighted.

5. Decide whether the problem is forwarding loss or terminal loss. This is the single most important call you make in the Path Visualization view, because it tells you who owns the fix:

   What you see	What it means	Likely owner
   A red node ring mid-path (inside the network, between the agent and the target)	Forwarding loss — packets are being dropped in transit.	Somewhere along the network path between the agent and the target — the agent's local network, an upstream ISP, a peering exchange, or transit.
   A red node ring on the destination node (the rightmost node, with the IP address shown)	Terminal loss — packets reach the target's network but the target itself is dropping them.	At or near the target — application, firewall, load balancer, or target host.

6. Pin the evidence with Select. Click the suspect node or link to add it to the Select dropdown — it will get a moving dashed outline. Double-click instead if you want to select every path that traverses the suspect hop. Hover over the pinned items to see their tooltip details (IP address, prefix, network, response time, link delay, MPLS information).

7. Capture and hand off. Share the page URL or save a snapshot — both reproduce the exact selection state, highlights, and time window on the receiving end, so the next responder lands on the same picture you do. Add a screenshot to the ticket if your audience does not have ThousandEyes access.

Legend

Object Image	Description	Comments
	Agent location	The agent changes color based on the metric selected. The color scale goes from dark green (no loss, latency, jitter, etc.) to red (severe loss, latency, jitter, etc.)
	Enterprise Agent	The color of a Enterprise Agent is double-ringed, and changes color according to the same scale as a ThousandEyes Cloud Agent.
	Identifiable node	A blue node indicates that IP information is available.
	Unidentifiable node	A white node indicates that IP information is not available.
	Node in local network	A dark blue node indicates that a node was identified inside the agent's source network.
	Node in destination network	A node shaded in green indicates a node that was identified as inside the destination network, as specified by the Autonomous System of the customer.
	Highlighted node	A node can be highlighted using the Network, Country, IP address, Prefix or Title selector, while the other nodes are greyed out. This helps to quickly identify nodes based on their information.
	Node with loss	A node circled in red indicates that loss is occurring at that point in the path, meeting the percentage threshold specified by the loss slider.
	Endpoint node	A node circled in black, and showing an IP address beside it, is an endpoint (or target) of the test.
	Selected node	A node circled in a moving blue dashed line indicates that the node is selected.
	Selected link	A link represented as a moving blue dashed line indicates that the link is selected.
	Collapsed path	A path showing a dotted line indicates a path that was simplified for visualization purposes. Expand using the complexity slider, or by clicking the label indicating the number of hops that were collapsed.
	Split path	A path showing a split is an indication that there are multiple routes to the destination. All path visualization is based on a minimum of three tests running from each agent. When a path splits, the thickness of the line representing the link between the nodes shows how many of the tests traversed each link.
	Link with high delay	A red link indicates a delay that meets the threshold specified by the latency slider.
	Loop in the traffic flow	A node with a circle indicates an identified routing loop. To avoid this traffic loop, routing table changes must be applied.
	Unknown number of hops between nodes	A dotted link with a question mark indicates insufficient data to determine the number of hops separating these nodes. Typically indicative of differing numbers of unresponsive nodes (* characters) between responsive nodes, or an indication of path trace being unable to reach the destination when the end-to-end measurement was performed successfully.
	Unable to reach target node	A dotted link with an X symbol indicates a trace that was unable to be completed to the target due to 100% forwarding and 100% end-to-end loss.
	Routing Loop	A red loop encircling a node indicates a shared NAT interface, such as a firewall, router, or load balancing device may contain nodes that are unreachable due to NAT restrictions. This can also indicate a route redundancy. Due to the complexity of monitoring these kinds of interfaces, this can sometimes show up as a false positive.

Path Visualization for Cloud Networks

Cloud network enrichments for the path visualization are not available in the ThousandEyes for Government instance.

For more information on ThousandEyes for Government prerequisites and configuration options, see ThousandEyes for Government - FedRAMP® Moderate.

ThousandEyes offers IP-address enrichment for cloud-based targets in collaboration with major cloud providers. IP addresses can be more accurately identified across the global AWS edge network, increasing overall path visibility. ThousandEyes also offers the following additional data sources to path visibility: AWS IP ranges, AWS Geolocation data, and the Amazon Global Accelerator diagnostic API.

This enriched path visualization offers the following features:

• Identify the cloud service being used (eg, AWS S3)

• Identify the AWS region being traversed

• Compare observed TCP latency with expected TCP latency to any AWS Global Accelerator network targets

Nodes displaying a cloud provider icon, such as AWS, indicate when an IP address is enriched. A verified info icon indicates nodes that are enriched with data verified by a cloud partner.

Overview of Enriched Path Visualization

See the sections below for more information about the different cloud provider nodes.

For cloud native monitoring, including detailed topology views, see the Network & App Synthetics section of Cloud Insights: Views.

Supported Cloud Providers

Logo	Cloud Provider
	Azure
	Amazon Web Services (AWS)
	Google Cloud Platform (GCP)

Topology

A cloud icon in path visualization indicates that an additional topology view for a cloud provider is available. The cloud icon is overlaid with the cloud provider's logo. For more information about cloud insights, see Cloud Insights.

Object Image	Description
	A view of the topology within the cloud provider's network is available.

Service Nodes

AWS

Object Image	Description	Comments
	AWS Cloudfront Node	A node that belongs to the AWS Cloudfront service.
	AWS Route 53 Node	A node that belongs to the AWS Route 53 service.
	AWS Elastic Compute Node	A load balancer, an EIP, or an EC2 instance that belongs to the AWS Elastic Compute service.
	AWS Global Accelerator Node	A node that has been enriched with additional Amazon Global Accelerator information.
	AWS Global Accelerator Node with Latency	A yellow ring surrounding the icon indicates a higher than expected response time, when there is a discrepency between the expected and the observed latency. See below for more information on diagnosing this.

To bring up more information about a reported discrepancy, select a node that is displaying the yellow ring.

Amazon Global Accelerator Node with Latency Info

Clicking on View Details opens a side panel that is titled Agents with higher than expected response time. This panel shows a list of all agents pointing to the Global Accelerator node that is experiencing a higher response time, compared to what is advertised by the AWS Global Accelerator diagnostics API.

Amazon Global Accelerator Node with Latency Details

Standalone Nodes

Standalone nodes are targets that are owned by the cloud provider, such as AWS. In the case of AWS, these targets can be an Amazon Node or an Amazon Border Node. An Amazon Node is fully owned and operated by Amazon and is in the Amazon IP block.

These nodes are overlaid with the specific cloud provider's logo. For example, an Identified Node in an Azure network will have the Azure logo overlaying a blue circle.

Example of Logo Overlay

Object Image	Description	Comments
	Unidentified Node	A standalone node that is owned by a cloud provider with unavailable IP information.
	Identified Node	A standalone node that is owned by the cloud provider with available IP information.
	Identified Local Network Node	A cloud provider-owned standalone node identified inside the agent's source network.
	Identified Local Network Node with Loss	A cloud provider-owned standalone node identified inside the agent's source network that shows traffic loss. This example shows an AWS node.
	Identified Destination Node	A cloud provider-owned standalone node identified inside the destination network, as specified by the configured Autonomous System.
	Identified Destination Node with Loss	cloud provider-owned standalone node identified inside the destination network that shows traffic loss. This example shows an AWS node.
	Verified Node	This blue checkmark alongside any node icon indicates node information is enhanced from cloud provider data, such as the AWS diagnostic API or border dump data.

Grouped Nodes

The icons below indicate when all nodes in a group are identified in the cloud provider network, such as AWS. The number on the bottom half of the icon reports the number of nodes identified within each group.

These are overlaid with the specific cloud provider's logo. For example, Grouped Interface Nodes in an Azure network will have the Azure logo overlaying a light blue circle.

Example of Grouped Node Logo Overlay

Object Image	Description	Comments
	Grouped Interface Nodes	The grouped interface nodes show when nodes are grouped by network or by network and location.
	Grouped Destination Nodes	Grouped nodes that were identified inside the destination network, as specified by the configured Autonomous System, show the cloud provider logo when nodes are grouped by network, by network and location, or by IP.
	Grouped Local Nodes	Cloud provider nodes identified inside the agent's source network show the cloud provider logo when nodes are grouped by network, by network and location, by IP.
	Grouped Nodes with Loss	A bold red border around the grouped nodes icon indicates that node group is experiencing loss. This example shows an AWS node.
	Grouped Nodes, Selected	A dotted blue border around the grouped nodes icon indicates that node group is currently selected. This example shows an AWS node.
	Grouped Nodes with Loss, Selected	A dotted red border around the node group icon indicates that node group is both currently selected and is experiencing loss. This example shows an AWS node.

Meraki Data Enrichment

The Meraki Data Enrichment integration enriches the ThousandEyes path visualization, helping pinpoint failures in your enterprise environment and streamlining efforts to identify issues when troubleshooting.

To set up the integration, see the Meraki Data Enrichment integration guide.

Once the integration is configured, navigate to the Network & App Synthetics> Views tab of the ThousandEyes web application. In the Path Visualization, hover over a Meraki Agent to see the hosting Network name, MX name, number of connected clients, and the WAN application score:

Meraki enrichment of path visualization

To drill down further into potential issues, you can navigate to the Meraki platform by clicking the "Go to Meraki Assurance Overview" link. The link will take you directly to a view of the same network, where you can see details about multiple network health measurements ranging from connected clients, Meraki devices, and applications. Our WAN appliance score is calculated using the following formula, to indicate the WAN appliance, MX's health parameter.

if MX utilization >= 90%, then MX device health score = 10%;
else if 80% <= MX utilization < 90%, then MX device health score = 20%
else, MX device health score = 100%.

For more information on how this integration works on the Meraki side, see the Meraki Assurance Overview Page