Getting Started with Path Visualization

The ThousandEyes path visualization shows all network paths between the selected agents and the target URL or IP.

When you are diagnosing a network issue with the ThousandEyes platform, you will likely use the Path Visualization view. This tool offers a visual representation of the path trace data collected for a test round.

How Path Trace Works

A single path trace works similarly to how a single traceroute works. Your source - in our case, a ThousandEyes agent - sends data packets to the target. The path trace starts by sending a packet directed at the test target with a time-to-live (TTL) value set to 1. Think of the TTL value as the expiration date on a packet.

Each routing device that receives this packet decreases the value by 1 before routing it to the next hop. When the TTL value equals 0, a standard routing device drops the incoming packet and replies with an ICMP TTLx packet, indicating that the packet will be dropped at this point. The next packet in the path trace sequence will have a TTL value set to 2, followed by a packet with a TTL of 3, and so on. This process continues until the agent receives a response from the intended target, or the path is deemed unresponsive. For more information about how traceroute works, see https://en.wikipedia.org/wiki/Traceroute or the more recent version, https://paris-traceroute.net/about/.

One of the key features of path trace is the ability to detect multiple routes to the same target. By default, an agent completes 3 path traces per round, in an attempt to uncover alternate routes. For tests specifying a TCP target, the agent selects a unique and random source port for each path trace. A unique source port suggests to intermediary routing devices that each stream of data is unrelated and can be routed on different network paths.

Obtaining Node Metadata

We use the source address listed in the IP header of TTLx packets received from the path trace to identify each node. For nodes within the source agent’s local network, we run a reverse DNS lookup to discover the hostname; otherwise only the IP address is listed. All other nodes are checked against WHOIS databases and Geo-IP.

As an example, the image above shows an IP address local to the US. This IP will be searched in ARIN (American Registry), where Salesforce.com will be shown as the owner. This can be checked at the following link: http://whois.arin.net/ui/

GeoIP services provide the location of the physical device hosting the IP address is. One such service is Maxmind. To see how this works, you can check out a demo here.

Path Trace to Path Visualization

The ThousandEyes path visualization displays path trace data and node metadata collected for the displayed testing round and presents it in easy-to-understand format.

To view path visualization data in a more traditional manner, you can hover over an agent's name and select Show traceroute style output from the pop-up menu.

For a complete guide on using ThousandEyes path visualization, see Using the Path Visualization View.