# Path Visualization The Path Visualization renders the path trace data collected for each test round, showing every node and link between agents and the target URL or IP. Use it to localize loss along the path — distinguishing **forwarding loss** (network hops) from **terminal loss** (app, firewall, or target) — and to capture evidence for handoff. For the underlying probe mechanism, see [How Path Trace Works](https://docs.thousandeyes.com/product-documentation/internet-and-wan-monitoring/path-visualization/path-trace). For MPLS tunnel inference, see [MPLS Tunnel Inference Using Deep Path Analysis](https://docs.thousandeyes.com/product-documentation/internet-and-wan-monitoring/path-visualization/mpls-tunnel-inference-using-deep-path-analysis). {% hint style="info" %} **New to Path Visualization, or walking a fresh issue**? Jump to [Investigate a Path Issue](#investigate-a-path-issue) for a step-by-step walkthrough. {% endhint %} ![](/files/k4FHcSngcMwB2OeqUfta) ## Path Visualization Controls This section covers controls in the bar pictured below. For controls in the upper half of the view (test selector, timeline, metric overlay), see [ThousandEyes View Layouts](https://docs.thousandeyes.com/product-documentation/internet-and-wan-monitoring/viewing-data). {% hint style="info" %} The controls bar is collapsible. Collapse it to maximize the topology canvas; expand it again from the chevron above the topology. {% endhint %} ![](/files/vbvx0QLZxwd2Jju4cFtw) | Control | Function | Use it to | | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | | **Show** | Filter which agents are visualized; when multiple tests are selected at the top of the view, an extra **Tests** filter appears here. Toggle IP address labels with the same row. | Reduce visual noise when several agents (or several tests) trip the same condition. | | **Group** | Aggregate **Agents**, **Interfaces**, or **Destinations** along the axes listed in the **Group Axes** table below. | Collapse busy paths into network or location aggregates. | | **Highlight** | Match nodes by Network, Country, IP address, Prefix, or Title. Set thresholds for **Forwarding Loss** (per node) and **Link Delay** (per link); the **Link Delay** slider moves in 5 ms increments. | Localize loss or latency to specific hops or links. | | **Select** | Pin nodes or links to the **Select** dropdown. Selected items show a moving dashed outline. Use the **Info** dropdown to display nodes that meet listed criteria. | Capture evidence for a ticket, post-mortem, or screenshot. | | **Agent and endpoint complexity** | Slider that collapses routes between nodes; the further apart the handles, the simpler the visualization. | Render dense topologies (large MPLS, ECMP) without losing the picture. | ### Display Preferences Open the **Path Visualization display preferences** popover from the ellipsis (**...**) icon above the topology to control how aggregated values render on nodes and links. * **Delay and Response Time stats**: choose **Min**, **Average**, or **Max**. The setting applies to both node response time (when shown) and link delay (when shown). Match the aggregate to the symptom: **Max** for spike chasing, **Min** for best-case, **Average** for trend. ### Group Axes | Object | Group-by options | | ------------ | --------------------------------------------------------- | | Agents | Agent, Network, Network & Location, Location | | Interfaces | IP Address, Device, Network, Network & Location, Location | | Destinations | IP Address, Network, Network & Location, Location | Example: agents grouped by **Location**, interfaces by **Network**, destinations by **Network & Location**. ![](/files/-M5xtHfaktYGUZ5A99tl) ## Interaction Model ### Tooltips Hover over any agent, node, or link to reveal: * **Agents**: name, IP address, prefix, network, location, destination IP address, and metric statistics. * **Nodes**: IP address, prefix, network, location, and average response time. * **Links**: source and destination IP addresses, number of routes traversing the link, MPLS information, and average link delay. ### Selection * Click a node or link to add it to the selection. Selected items show a moving dashed outline. * Double-click a node or link to toggle selection on every path that traverses it. * The **Select** field in the controls bar lists the current selection as *X* nodes or *Y* links. Expand it to see the full list. * Selected nodes and paths, along with active highlights, are persisted in the URL and in saved snapshots, so a shared link or saved snapshot reproduces the exact selection state. ## Investigate a Path Issue Use this walkthrough to map a reported problem onto the Path Visualization view. The steps assume you have already opened the relevant test from **Network & App Synthetics > Views**. 1. **Pick the time window**. Use the timeline at the top of the view to navigate to the round when the user reported the problem. Each round is a single test execution; the path shown below the timeline reflects the round you have selected. 2. **Choose which agents to look at**. In the **Show** dropdown, narrow the list to the agents that reported the issue, or keep **All** to compare healthy and unhealthy paths side by side. 3. **Reduce visual noise with Group**. When several agents traverse the same upstream hops, aggregating **Agents** and **Destinations** by **Network** or **Network & Location** collapses parallel paths into a cleaner picture. Switch back to per-Agent grouping when you need to compare individual paths. 4. **Use Highlight to localize the problem**. Set thresholds in the **Highlight** control so the view marks the trouble spot for you. The numeric values below are illustrative — pick thresholds based on the symptom you are chasing and your normal baseline (see "Picking a real threshold" after the bullets). * To find packet loss at a hop, set **Forwarding Loss** above your threshold (for example, `> 10%`). Nodes above the threshold get a red ring. * To find slow links, set **Link Delay (Avg)** above your threshold (for example, `> 100 ms`). Links above the threshold turn red. * To spotlight a specific provider or hop, in the search field, type a value to match against Network, Country, IP address, Prefix, or Title. **Picking a real threshold**. Start above your normal baseline for the same path or test. For loss, set the threshold high enough to exclude routine background noise but low enough to catch the symptom you are investigating. For link delay, compare against the historical average for the same hop or against sibling agents on healthy paths during the same time window. When in doubt, start permissive (low threshold) and tighten until only the suspect node or link is highlighted. 5. **Decide whether the problem is forwarding loss or terminal loss**. This is the single most important call you make in the Path Visualization view, because it tells you who owns the fix: | What you see | What it means | Likely owner | | ------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | A red node ring **mid-path** (inside the network, between the agent and the target) | **Forwarding loss** — packets are being dropped in transit. | Somewhere along the network path between the agent and the target — the agent's local network, an upstream ISP, a peering exchange, or transit. | | A red node ring **on the destination node** (the rightmost node, with the IP address shown) | **Terminal loss** — packets reach the target's network but the target itself is dropping them. | At or near the target — application, firewall, load balancer, or target host. | 6. **Pin the evidence with Select**. Click the suspect node or link to add it to the **Select** dropdown — it will get a moving dashed outline. Double-click instead if you want to select every path that traverses the suspect hop. Hover over the pinned items to see their tooltip details (IP address, prefix, network, response time, link delay, MPLS information). 7. **Capture and hand off**. Share the page URL or save a snapshot — both reproduce the exact selection state, highlights, and time window on the receiving end, so the next responder lands on the same picture you do. Add a screenshot to the ticket if your audience does not have ThousandEyes access. ## Legend | **Object Image** | **Description** | **Comments** | | ------------------------------------------------------------------------------------------------ | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ![](/files/-M5xtHff3nGOX_B9tBcu)![](/files/-M5xtHfguNYFyfrgTZi8)![](/files/-M5xtHfhkNDo0ppjEP3A) | Agent location | The agent changes color based on the metric selected. The color scale goes from dark green (no loss, latency, jitter, etc.) to red (severe loss, latency, jitter, etc.) | | ![](/files/-M5xtHfiQpLhv9S-Z8sJ) | Enterprise Agent | The color of a Enterprise Agent is double-ringed, and changes color according to the same scale as a ThousandEyes Cloud Agent. | | ![](/files/-M5xtHfjFJLxnOoazh26) | Identifiable node | A blue node indicates that IP information is available. | | ![](/files/-M5xtHfktaJsKZ7_WEKl) | Unidentifiable node | A white node indicates that IP information is not available. | | ![](/files/-M5xtHfmLfCBFTUjnSWa) | Node in local network | A dark blue node indicates that a node was identified inside the agent's source network. | | ![](/files/-M5xtHfnonQzBYIoByPc) | Node in destination network | A node shaded in green indicates a node that was identified as inside the destination network, as specified by the Autonomous System of the customer. | | ![](/files/-M5xtHfozXeejT8Jdw4T) | Highlighted node | A node can be highlighted using the Network, Country, IP address, Prefix or Title selector, while the other nodes are greyed out. This helps to quickly identify nodes based on their information. | | ![](/files/-M5xtHfpbofmUPqN7UTA) | Node with loss | A node circled in red indicates that loss is occurring at that point in the path, meeting the percentage threshold specified by the loss slider. | | ![](/files/-M5xtHfq2PQQmrNzp0DX) | Endpoint node | A node circled in black, and showing an IP address beside it, is an endpoint (or target) of the test. | | ![](/files/-M5xtHfrvpX4-O3ez1ve) | Selected node | A node circled in a moving blue dashed line indicates that the node is selected. | | ![](/files/-M5xtHfsv9h8a6uuMP-W) | Selected link | A link represented as a moving blue dashed line indicates that the link is selected. | | ![](/files/-M5xtHftxVki5kEv4sGV) | Collapsed path | A path showing a dotted line indicates a path that was simplified for visualization purposes. Expand using the complexity slider, or by clicking the label indicating the number of hops that were collapsed. | | ![](/files/-M5xtHfuxlfdcfKIahEo) | Split path | A path showing a split is an indication that there are multiple routes to the destination. All path visualization is based on a minimum of three tests running from each agent. When a path splits, the thickness of the line representing the link between the nodes shows how many of the tests traversed each link. | | ![](/files/-M5xtHfv9m4y32-9SVTr) | Link with high delay | A red link indicates a delay that meets the threshold specified by the latency slider. | | ![](/files/NkQIMTaGS2Oe8WDTCCIp) | Loop in the traffic flow | A node with a circle indicates an identified routing loop. To avoid this traffic loop, routing table changes must be applied. | | ![](/files/-M5xtHfw-zz-hshXqPaS) | Unknown number of hops between nodes | A dotted link with a question mark indicates insufficient data to determine the number of hops separating these nodes. Typically indicative of differing numbers of unresponsive nodes (\* characters) between responsive nodes, or an indication of path trace being unable to reach the destination when the end-to-end measurement was performed successfully. | | ![](/files/-M5xtHfxUt3LZ0rFkw_1) | Unable to reach target node | A dotted link with an `X` symbol indicates a trace that was unable to be completed to the target due to 100% forwarding and 100% end-to-end loss. | | ![](/files/dnhCN9NbR4mKih0iao5r) | Routing Loop | A red loop encircling a node indicates a shared NAT interface, such as a firewall, router, or load balancing device may contain nodes that are unreachable due to NAT restrictions. This can also indicate a route redundancy. Due to the complexity of monitoring these kinds of interfaces, this can sometimes show up as a false positive. | ## Path Visualization for Cloud Networks {% hint style="warning" %} Cloud network enrichments for the path visualization are not available in the ThousandEyes for Government instance. For more information on ThousandEyes for Government prerequisites and configuration options, see [ThousandEyes for Government - FedRAMP® Moderate](https://docs.thousandeyes.com/product-documentation/thousandeyes-for-government). {% endhint %} ThousandEyes offers IP-address enrichment for cloud-based targets in collaboration with major cloud providers. IP addresses can be more accurately identified across the global AWS edge network, increasing overall path visibility. ThousandEyes also offers the following additional data sources to path visibility: [AWS IP ranges](https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-ranges.html), [AWS Geolocation data](https://aws.amazon.com/location/), and the [Amazon Global Accelerator](https://aws.amazon.com/global-accelerator/) diagnostic API. This enriched path visualization offers the following features: * Identify the cloud service being used (eg, AWS S3) * Identify the AWS region being traversed * Compare observed TCP latency with expected TCP latency to any AWS Global Accelerator network targets Nodes displaying a cloud provider icon, such as AWS, indicate when an IP address is enriched. A verified info icon indicates nodes that are enriched with data verified by a cloud partner. ![Overview of Enriched Path Visualization](/files/SyKgQVw0i4jCX6TSG6y4) See the sections below for more information about the different cloud provider nodes. For cloud native monitoring, including detailed topology views, see the **Network & App Synthetics** section of [Cloud Insights: Views](https://docs.thousandeyes.com/product-documentation/cloud-insights/views). ### Supported Cloud Providers | **Logo** | **Cloud Provider** | | ---------------------------------------------------------- | --------------------------- | | ![Azure Icon](/files/VEr99ipWH9ChbdoGjoib) | Azure | | ![Amazon Web Services Icon](/files/57AM4homdUyVLU6op01V) | Amazon Web Services (AWS) | | ![Google Cloud Platform Icon](/files/0916J2G3fXfBJmWNVoOS) | Google Cloud Platform (GCP) | ### Topology A cloud icon in path visualization indicates that an additional topology view for a cloud provider is available. The cloud icon is overlaid with the cloud provider's logo. For more information about cloud insights, see [Cloud Insights](https://docs.thousandeyes.com/product-documentation/cloud-insights). | **Object Image** | **Description** | | ---------------------------------------------- | ------------------------------------------------------------------------ | | ![Cloud Topology](/files/YkyFxOCqAEia9MhP8FRv) | A view of the topology within the cloud provider's network is available. | ### Service Nodes #### AWS | **Object Image** | **Description** | **Comments** | | --------------------------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ![Amazon Cloudfront Node](/files/u6iWoLdEoaOqkb9gUhMf) | AWS Cloudfront Node | A node that belongs to the [AWS Cloudfront service](https://aws.amazon.com/cloudfront/). | | ![Amazon Route 53 Node](/files/I7N1RdCIDyqnbIpbzr0X) | AWS Route 53 Node | A node that belongs to the [AWS Route 53 service](https://aws.amazon.com/route53/). | | ![Amazon Elastic Compute Node](/files/KGUBfX1C5JjwTwzTW1fX) | AWS Elastic Compute Node | A load balancer, an EIP, or an EC2 instance that belongs to the [AWS Elastic Compute service](https://aws.amazon.com/ec2/). | | ![Amazon Global Accelerator Node](/files/pRP9IjkTDAMyuttzsYlo) | AWS Global Accelerator Node | A node that has been enriched with additional [Amazon Global Accelerator](https://aws.amazon.com/global-accelerator/) information. | | ![Amazon Global Accelerator Node with Latency](/files/BsCrZDwW7Vq4BNJIpDq9) | AWS Global Accelerator Node with Latency | A yellow ring surrounding the icon indicates a higher than expected response time, when there is a discrepency between the expected and the observed latency. See below for more information on diagnosing this. | To bring up more information about a reported discrepancy, select a node that is displaying the yellow ring. ![Amazon Global Accelerator Node with Latency Info](/files/igdFmd9Y09apQgBQ1gZL) Clicking on **View Details** opens a side panel that is titled **Agents with higher than expected response time**. This panel shows a list of all agents pointing to the Global Accelerator node that is experiencing a higher response time, compared to what is advertised by the AWS Global Accelerator diagnostics API. ![Amazon Global Accelerator Node with Latency Details](/files/BU8XwkIO8mqOYDUVvx3q) ### Standalone Nodes Standalone nodes are targets that are owned by the cloud provider, such as AWS. In the case of AWS, these targets can be an Amazon Node or an Amazon Border Node. An Amazon Node is fully owned and operated by Amazon and is in the Amazon IP block. These nodes are overlaid with the specific cloud provider's logo. For example, an *Identified Node* in an Azure network will have the Azure logo overlaying a blue circle. ![Example of Logo Overlay](/files/ayQdae9Tnvy1Ys8PEnVv) | **Object Image** | **Description** | **Comments** | | ----------------------------------------------------------------------- | --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ![Unidentified Node](/files/uWyTqjjiJe7SH0UdmBt7) | Unidentified Node | A standalone node that is owned by a cloud provider with unavailable IP information. | | ![Identified Node](/files/GiCpoYP8RiIjXl1aa6rr) | Identified Node | A standalone node that is owned by the cloud provider with available IP information. | | ![Identified Local Network Node](/files/PTtHkoeT8xgFXJaUtrx7) | Identified Local Network Node | A cloud provider-owned standalone node identified inside the agent's source network. | | ![Identified Local Network Node with Loss](/files/BYiNKL1E6r2V7fRb0aMA) | Identified Local Network Node with Loss | A cloud provider-owned standalone node identified inside the agent's source network that shows traffic loss. This example shows an AWS node. | | ![Identified Destination Node](/files/7Spf5JCOeP5qgsEhcEuo) | Identified Destination Node | A cloud provider-owned standalone node identified inside the destination network, as specified by the configured Autonomous System. | | ![Identified Destination Node with Loss](/files/AztHHO6TDqiq7yNmjPUj) | Identified Destination Node with Loss | cloud provider-owned standalone node identified inside the destination network that shows traffic loss. This example shows an AWS node. | | ![Verified Checkmark](/files/Ms4nXd4M8PGXCcBXKrdZ) | Verified Node | This blue checkmark alongside any node icon indicates node information is enhanced from cloud provider data, such as the AWS diagnostic API or border dump data. | ### Grouped Nodes The icons below indicate when all nodes in a group are identified in the cloud provider network, such as AWS. The number on the bottom half of the icon reports the number of nodes identified within each group. These are overlaid with the specific cloud provider's logo. For example, *Grouped Interface Nodes* in an Azure network will have the Azure logo overlaying a light blue circle. ![Example of Grouped Node Logo Overlay](/files/IqX1PmqkjlhTF6hdmb6z) | **Object Image** | **Description** | **Comments** | | ----------------------------------------------------------------- | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ![Grouped Identified Nodes](/files/FJjgaREwCcDoRzi7GH9W) | Grouped Interface Nodes | The grouped interface nodes show when nodes are grouped by network or by network and location. | | ![Grouped Destination Nodes](/files/T8cCtldVPv7rANtlurid) | Grouped Destination Nodes | Grouped nodes that were identified inside the destination network, as specified by the configured Autonomous System, show the cloud provider logo when nodes are grouped by network, by network and location, or by IP. | | ![Grouped Local Nodes](/files/XyqQraFp1WT92hjuably) | Grouped Local Nodes | Cloud provider nodes identified inside the agent's source network show the cloud provider logo when nodes are grouped by network, by network and location, by IP. | | ![Grouped Nodes with Loss](/files/0OluXPYIGP3Zt6aLxxRC) | Grouped Nodes with Loss | A bold red border around the grouped nodes icon indicates that node group is experiencing loss. This example shows an AWS node. | | ![Grouped Nodes, Selected](/files/xtDFr5NGt2A29EOoRmyu) | Grouped Nodes, Selected | A dotted blue border around the grouped nodes icon indicates that node group is currently selected. This example shows an AWS node. | | ![Grouped Nodes with Loss, Selected](/files/Efr99idKuEodDSmGH6o9) | Grouped Nodes with Loss, Selected | A dotted red border around the node group icon indicates that node group is both currently selected and is experiencing loss. This example shows an AWS node. | ## Meraki Data Enrichment The Meraki Data Enrichment integration enriches the ThousandEyes path visualization, helping pinpoint failures in your enterprise environment and streamlining efforts to identify issues when troubleshooting. To set up the integration, see the [Meraki Data Enrichment](https://docs.thousandeyes.com/product-documentation/integration-guides/custom-built-integrations/meraki-data-enrichment) integration guide. Once the integration is configured, navigate to the **Network & App Synthetics> Views** tab of the ThousandEyes web application. In the **Path Visualization**, hover over a Meraki Agent to see the hosting Network name, MX name, number of connected clients, and the WAN application score: ![Meraki enrichment of path visualization](/files/k7oDMC8TBmzdhfqVHAkK) To drill down further into potential issues, you can navigate to the Meraki platform by clicking the "Go to Meraki Assurance Overview" link. The link will take you directly to a view of the same network, where you can see details about multiple network health measurements ranging from connected clients, Meraki devices, and applications. Our WAN appliance score is calculated using the following formula, to indicate the WAN appliance, MX's health parameter. ``` if MX utilization >= 90%, then MX device health score = 10%; else if 80% <= MX utilization < 90%, then MX device health score = 20% else, MX device health score = 100%. ``` For more information on how this integration works on the Meraki side, see the [Meraki Assurance Overview Page](https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Meraki_Assurance_Overview_Page) --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.thousandeyes.com/product-documentation/internet-and-wan-monitoring/path-visualization.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.