Device Data Enrichment

Overview

Device Discovery in ThousandEyes

The Device Layer feature in ThousandEyes provides a centralized inventory and monitoring capability for your network infrastructure.

Device discovery is an essential part of the Device Layer. Device discovery uses SNMP (Simple Network Management Protocol) to collect essential information about your network equipment including device type, interfaces, capabilities, routing information, and neighbor relationships. This data forms the foundation for advanced network observability across the ThousandEyes platform, particularly in network path visualization.

Device Enrichment in Traffic Insights

Traffic Insights leverages two complementary data sources to provide enhanced network flow analysis and monitoring capabilities. When devices are properly identified, Traffic Insights can:

• Display interfaces in a hierarchical structure organized by parent device (device identification).

• Map traffic flows across network devices in your infrastructure.

• Correlate traffic patterns with device topology and routing down to the interface level (path correlation).

While Traffic Insights can be configured without device identification or path correlation, the practical use of Traffic Insights without these two features is significantly diminished. We therefore recommend using both data sources in the following ways:

1. NetFlow v9/IPFIX

   • For device identification: Identifies devices and their interfaces for traffic monitoring, filtering, and alerting.

     • Default data source for device-interface mapping which includes a special interface options template that sends record metadata to the flow collector.

     • Ideal for Cisco devices, while other devices that use IPFIX can also benefit from the automatic device identification capabilities afforded by NetFlow v9.

2. SNMP

   • For path correlation: Enables network topology mapping and traffic path correlation.

     • Required data source for path visualization, regardless of interface identification source.

   • For alternative device identification: For non-Cisco devices, mixed vendor environments, or when NetFlow v9 or IPFIX data is otherwise unavailable.

Key Takeaways:

• If you use Cisco devices, or devices with properly configured IPFIX fields, you automatically get device and interface identification out-of-the-box.

  • You must still run SNMP device discovery to access the path correlation feature even if you use NetFlow v9/IPFIX for device identification as only SNMP data can be used for path correlation.

• If you use non-Cisco devices or devices that do not generate supported NetFlow v9 or IPFIX data (for example, they don't include the interface options template), you must run SNMP device discovery to access both device identification and path correlation features.

Configuring Device Discovery for Traffic Insights

We recommend you configure SNMP device discovery to enable data correlation in path visualization views, regardless of your interface data source preference.

Find instructions for device discovery at Device Layer. Note, the Enterprise Agent you use to discover the network devices does not have to be one you designated as a forwarder.

Once flows are being sent to the forwarders on your discovered devices (typically after traffic monitor configuration), you can view them in Traffic Insights > Settings > Forwarders.

(Optional) Enable ACLs on the Traffic Monitor

In addition to standard device discovery, you may need to enable Access Control Lists (ACLs) for the network device that is serving as the traffic monitor for Traffic Insights. You need to allow the ThousandEyes Enterprise Agent to discover this network device and to receive flow data.

Configuring Interface Data Source

By default, Traffic Insights uses NetFlow v9 (with the interface options template) or IPFIX as the interface data source for Cisco networks and other supported devices. You should only change this setting if you need interface information from non-Cisco devices or if interface metadata is not being sent via NetFlow v9/IPFIX.

Changing Interface Data Source

1. Navigate to Settings > General Settings.

2. In the Interface Name Source section, select the radio button of the source you want.

3. Review the warning message explaining impacts on existing configurations.

4. Click Save to apply the change.

Changing the interface data source may alter interface names displayed throughout the platform, potentially affecting existing alerts, dashboards, and filters. Review the impact carefully before making this change.

When You Change Data Sources

• Interface Names: May change to reflect the new naming conventions.

• Hierarchy Display: Shows device-interface relationships based on the new data source.

• Existing Alerts: Typically continue to function, but we recommend you verify alert configurations after the change.

• Dashboards: Interface names update to reflect the new data source.

• Path Visualization: Remains unchanged (always uses SNMP).

• Data retention: The platform continues to show device and interface names from the previous data source for a retention period of 30 days. These names time out after the retention period, when you will no longer see them in filters or views.

Troubleshooting Device Discovery

Devices Not Appearing in Discovery

Problem: Network devices don't appear in the device list after configuration.

Solution:

1. Verify SNMP is enabled on the devices.

2. Check SNMP community strings or v3 credentials are correct.

3. Confirm network connectivity between ThousandEyes and your devices.

4. Review firewall rules to ensure SNMP traffic (UDP port 161) is allowed.

5. Check device IP ranges or subnets in discovery configuration.

See also Troubleshooting Device Discovery.

Interfaces Not Showing in Hierarchy

Problem: Devices appear but interfaces are not visible in hierarchical selectors.

Solution:

1. Check your current interface data source in Settings > General Settings.

2. If using NetFlow v9/IPFIX (default):

   • Verify Flexible NetFlow (FNF) is configured and exporting.

   • Confirm FNF option templates are being sent.

   • Check that flow data is being received in Traffic Insights views.

3. If using SNMP:

   • Verify SNMP discovery has completed successfully.

   • Check that SNMP walks return interface information.

   • Confirm interface Management Information Bases (MIBs) are accessible via SNMP.

Interface Names Don't Match Expectations

Problem: Interface names appear different than expected or don't match network documentation.

Solution:

1. Verify which data source is active: check Settings > General Settings > Interface Name Source.

2. If needed, switch interface data source to align with your naming preferences.

3. Consider standardizing interface descriptions on devices for clarity.

Path Correlation Not Working

Problem: Path visualization for network devices is unavailable or incomplete.

Solution:

1. Verify SNMP device discovery is configured (required for path visualization).

2. Check that all devices in the path have been discovered via SNMP.

3. Confirm SNMP is returning topology information (neighbor discovery, routing tables).

4. Review SNMP access permissions on devices to ensure full MIB access.

5. Ensure that the IP address for your traffic monitor is unique across your network.

Alerts No Longer Working

Problem: Alerts stopped working after a data source change.

Solution:

1. Navigate to Alerts > Alert Rules.

2. Review alert configurations that filter by interface.

3. Verify the interface names still match the intended devices.

4. Update alert configurations if interface names have changed.