BQN Docs

Subscriber Dashboad

The subscriber dashboard includes a very comprehensive set of useful information about the subscriber current and past performance. It is the ideal place where to analyze and diagnose issues reported in the subscriber data access.

It can be reached by clicking on the subscriber ID or subscriber IP address in any of the following windows:

• Status->Subscribers
• Status->Flows->Per Subscriber
• Status->RADIUS/REST/Billing->Subscribers

The subscriber dashboard contains a lot of information, so use the scroll bar on the right-hand side to browse through it.

‍

The dashboard contains the following information:

• Subscriber main session parameters (including the rate and monitor policies applied, IP and subscriber ID, etc.). Click on Additional details to see more information. Click ViewSubscriber Groups to go the list of groups that this subscriber is amember. Metrics of the subscriber can be compared to those of the groups, to assess if the QoE is within normal values.
• Dial icons with a summary of the latest metrics.
• Charts with the evolution overtime of the subscriber main metrics:  average and maximum speeds, latencies, packet retransmissions (losses), traffic at high speeds, suffering congestion and limited by ACM, reductions in latency and losses thanks to ACM and number of flows (created per minute and active).

• Chart with the subscriber service usage over time.
• Internet latencies experienced by this subscriber for the most used services. Clicking on the bar on the chart, will go to the histogram with the latency distribution and from there, to the histogram evolution over time.
• Table with the active flows of the subscriber. The flow policy is provided (click on the policy name to go to the policy definition). If available, it also shows the DPI domain (DOMAIN column) and the DPI category of the flow (DPI column).

The previous charts show the evolution over time of average and maximum speed, number of flows and access latency. For the access latency, the network average is also included as a reference, to determine if the subscriber is below or above the network average quality.

The next charts depict the packet retransmission on the access side, also including the network average as a reference. The last three charts contain information about the Automatic Congestion Management feature for that subscriber.

Three scatter-plots show the possible correlation between speed and measurements of latency, losses and congestion. For example,in the speed vs latency, a dot is a speed-latency pair measured at the same time. A red line shows the possible correlation between the two (the line that better adjust to the points):

‍

To monitor the subscriber more closely, set the Live mode switch to On.  Charts will appear with the current evolution of the main metrics. A flow table will appear, including DPI composition. A maximum time span can be shown (latest number of minutes). This is configurable to 2, 5 or 10 minutes, using the selector next to the Live mode switch. When the time span is reached, e.g. after 5 minutes, the charts will continue being updated, showing the latest five minutes window.

‍

A flow table will also be included and will be continuously refreshed will be continuously refreshed. Flows are ordered in the table with active flows first, and among them, the faster flows. DPI categories and domains are shown. Not null speeds are highlighted in blue to facilitate the identification of active flows. You can display the life charts with more vertical space clicking on the Layout ↕ icon.

‍

The live mode will end when the Live mode switch isset to Off or after fifteen minutes.

‍

Subscriber Identifier (ID)

To facilitate the identification of a subscriber session, a subscriber ID field is supported. The subscriber ID can be used when requesting metrics, to obtain historical information even when the subscriber has changed IP address over time.

There are several possible sources for the subscriber ID:

• MAC access address (this is the default). In some networks, the MAC address might be the same for all subscribers (for example if all traffic is coming from the same router port) but in other networks, it may identify the subscriber access points.
• Subscriber access IP address. To configure the IP address to fill the subscriber ID, go to Administration->General Settings->Default subscriber-ID source.
• An external system: the external system can use the BQN REST API, RADIUS or one of our Billing.Go to those sections for details.

‍

Subscriber QoE Metrics

Status->Subscribers gives access to the list of active subscribers along with their metrics (if the subscriber of interest is not listed, type the IP address on the filter field).

‍

To facilitate the identification of subscribers with quality of experience issues, we use we use heatmaps and warning thresholds.

‍

A heatmap is provided for the subscriber subset whose metrics are plotted in the chart. The heatmap represents a scale of color intensity that maps the metric range. This is shown with a color scale to the left of the metric chart. The higher the number, the higher the color intensity. Each subscriber has a row with the evolution of the metric over time. Clicking on the row unplot that subscriber and clicking again plots the  subscriber back. A doble click leaves only that subscriber visible. A right-click goes to the subscriber dashboard.

A MEAN column on the left of the heatmap shows the average value of the metric, for each subscriber, during the selected period of time. The subscribers can be sorted by that average value in ascending or descending order.

The color scale is adjustable. Dragging the minimum and maximum values will focus the color range to that metric interval, leaving values below and above painted in the lighter and darker colors respectively.  This helps to focus the analysis, zooming into that metric interval. The MEAN value will be adjusted to the selected interval, with values outside the range rounded to the interval limits.

Regarding warning thresholds, the WARN column in the metrics table shows a score with the number of metrics above their warning threshold. Sort the table so the highest WARN values are shown first.

To avoid highlighting subscribers that are simply inactive, a threshold is applied to the mean speed (MEAN-Mbps warning threshold, on the window upper right). If a customer does not reach at least this mean speed, he won’t get a warning score and won’t be highlighted. The threshold can be changed, but in general this is not needed.

Status->Subscribers->QoE Metrics contains the information that were in Status->Subscribers in previous versions.

‍

Box plots

To facilitate the monitoring of subscriber’s access quality, five box plot charts summarize the distribution of these key metrics:

• MAX-Mbps: maximum speed in Mbps.
• RTT-ms: access latency in milliseconds.
• RTX: packet loss rate in percentage
• MAX-SPEED: percentage of the traffic going at or near maximum speed.
• CONGESTION: percentage of the traffic suffering congestion.

A box plot is a summary of the distribution of a set of values. It shows the maximum and minimum values, the median (value separating the lower half and higher half) and the 1^st and 3^rd quartiles (values separating the lower 25% and the higher 25%, respectively):

‍

The exact values of the percentiles are shown on the right-handside of a boxplot.

‍

Warning Thresholds

A configurable threshold helps to identify which subscribers are experiencing problems. For example, if the RTT threshold is set at 20ms, the box plot will shade in red all values between 20ms and the maximum. In the table, the RTT values above the threshold will be also shaded in red, making very easy to spot the affected customers. The table can sort the metric column to show the biggest values first (click on the column label to do that).

‍

The value of the warning threshold is shown on top of the box plot. To adjust it, click in the pencil icon at the upper right of the box plot.

‍

Highlight Percentiles

It is also possible to see the quartile of a value by setting the colorize switch in the upper right of the page toon. The quartile codes are:

• 1^st quartile: blue
• 2^nd quartile (up to median): green
• 3^rd quartile: orange
• 4^th quartile (from 3^rd up to maximum): red

‍

Active Subscriber Table

The information provided in the table is as follows:

• IP-ADDR: subscriber’s IP address.
• SUBS-ID: subscriber identifier. MAC address by default, though it can be filled using external system information (see RADIUS and Billing sections).
• RATE-POLICY: name of the rate policy being applied to this subscriber.
• TOTAL-MBYTES:  total traffic volume of this subscriber session, in megabytes.
• ACTIVE-FLOWS: total number of traffic flows (mainly TCP connections and UDP flows) of this subscriber that are active (exchanging traffic).
• CURR-Mbps: current speed in Mbps.
• MAX-Mbps: maximum speed in Mbps over one day period.
• RTT-ms: minimum access latency in milliseconds over one day period.
• RTX: average percentage of packet losses over one day period.
• MAX-SPEED: percentage of traffic with a speed close to maximum speed, over one day period.
• CONGESTION: percentage of traffic suffering congestion, over one day period.
• LIFETIME: duration so far of this subscriber session.

A click on the subscriber IP address or ID leads to the subscriber dashboard, with historical data up to three months.

‍

Metrics over time

The QoE metrics page shows the temporal evolution of metrics of some selected subscribers:

‍

The chart will show by default the first 10 subscribers of the metrics table, and a PLOT column in the table indicates the subscribers included in the chart. Up to 50 subscribers can be shown at the same time selecting their plot tick box and refreshing the chart (reload icon in the upper right of the chart). Unselecting the plot tick will remove that subscriber from the chart.

The chart will show metrics of the IPs or subscriber IDs filtered in the metrics table, so you can use rate policy or subscriber group selectors to see their particular metrics evolution.

Right-clicking on an IP or ID of the chart legend will lead to that subscriber’s dashboard.

‍

Top Subscribers by Usage

The menu entry Statistics->Subscribers Analysis->Hourly Volume displays the subscribers with the largest traffic consumption over time. Usage can be shown per IP address or by Subscriber Id using the appropriate selection. The next example shows usage per IP-Addr:

You can go to a subscriber dashboard page by right-clicking on the IP address or subscriber ID in the chart legend.

The Statistics->Subscribers Analysis->Total Volume shows the total in the period being considered. The next example shows usage per Subscriber ID:

You can go to a subscriber dashboard page by clicking on the IP address or subscriber ID in the pie chart.

It is also possible to export to a CVS file with the usage of up to 500 top subscribers.

‍

Traffic and Subscribers per Policy

Statistics->Subscribers->Per Policy shows the split of the subscribers into the different rate policies.

Statistics->Subscribers->Per Policy shows the split of the traffic volume into the different rate policies:

Statistics->Subscribers->Per Policy can also show the split of the traffic volume into the different flow policies:

‍

Traffic per Service

In Statistics->Service Analysis there is information about traffic composition.

The BQN shows the overall traffic composition per service in Statistics->Service Analysis->Total Volume per Service.

The hourly evolution can be obtained in Statistics->Service Analysis->Hourly Volume per Service.

By default, all DPI samples are considered by the reporting (All UDRs), both the samples generated automatically by the BQN and those generated by monitoring policies. If the monitoring policies generate so many samples that they can cause a bias in the reporting, those samples can be excluded by selecting Only auto UDRs . This could be the case if several subscribers have a monitoring policy that generates UDRs for all their traffic and make them over-represented in the traffic sample mix.

‍

Latency per Service

To see the latency per service, go to Statistics->Service Analysis->Latency per Service.

To see the latency distribution of a particular service, click on the bar chart icon in the DETAILS column:

The distribution shows the percentage of measurements falling into the different intervals of the range of latency values.

To see the evolution over time of those Internet latencies, click on the Distribution by time link on the upper right of the chart:  

For each time interval,the chart shows the relative percentages of each latency range

This latency per service analysis, whether globally or over time, can be further refined by filtering with a subscriber address IP address (or range), or by an Internet-side IP address (or range), which will let you study the latency of different services coming from different providers, and specifically for certain subscribers:

‍

Main Subscribers per Service

It is possible to identify the main subscribersof a given service, both subscriber IDs or addresses (access-side IPs) and addresses of content servers over the Internet.

In Statistics->DPI Service Analysis->Total Volume Per Service, click on the pie sector of the service whose main IPs you want to display. A histogram of the main IP addresses will be shown, with server IP addresses at the top and subscriber addresses at the bottom. The histogram shows the percentage of the total service volume of that IP address.

It is also possible to show top subscriber IDs using the selector at the bottom of the page.

Addresses are clickable: server IPs will lead to latency distribution for that server IP and subscriber IPs or IDs will go to the subscriber dashboard.

To obtain a CVS file with the server or subscriber volume percentages, click on the Export icon.

‍

Overall Traffic Metrics

Statistics->Throughput->Overview shows the temporal evolution of total traffic throughput, adding both directions and all wires.

‍Statistics->Throughput->Protocols shows the temporal evolution of traffic throughput, broken down by:

• Direction: downlink (DN) and uplink (UP).
• IP version: IPV4, IPV6 or No IP.
• L4 Protocol type: TCP, UDP or Other IP protocol.
• Bypass traffic.

‍

The evolution over time per network interface is available in Statistics->Throughput->Interfaces.

It is possible to check how much traffic is being processed according to each of the configured policies. For Subscriber Flows policies, it can be checked in Statistics->Throughput->Subscriber Flows Policies and similarly for Subscriber Rate Policies and Subscriber Monitoring Policies.

The chart in Statistics->System->Latencies shows the access RTT (RTT-Access). It is the average across all flows of the minimum value per flow.

‍

Also, Statistics->System->Retransmissions shows the average retransmission percentage in the access network:

To see the number of flows per policy and per protocol, click on Statistics->Flow->Per Policy and Statistics->Flow->Per Protocol respectively.

You can also see the instantaneous number of Flows per protocol in Status->Flows->Per Protocol and per subscriber in Status->Flows->Per Subscriber.

Life Throughput of Main Subscribers

‍

Go to Status->Subscribers->Throughput to see in real time the throughput of the biggest subscribers by volume usage:

‍

‍

DoS

The BQN detects Denial of Service attacks. To do this, DoS thresholds must be configured in Configuration->DoS:

• Downlink failed handshake rate. SYNs per second without an answer in the direction towards the subscribers (initialized from the Internet). A typical value is 50.
• Uplink failed handshake rate. SYNs per second without an answer initialized by a subscriber. A typical value is 50.
• Minimum rate. Minimum speed rate that can be considered a volumetric attack. The exact value depends on the network speed, but a typical value is 50 Mbps.
• Multiplier of subscriber rate policy. If the subscriber has a known rate policy, a threshold is defined as multiplier *downlink limit. A typical multiplier is 3. For example, a subscriber with a 20Mbps plan will have a DoS threshold of 3*20=60Mbps.

‍

The DoS events are shown in Statistics->DoS Attacks. In DoS Attacks Over Time, the DoS attack events are displayed showing its type, its duration and parameters such as the affected subscriber IP and the main IP contributing to the attack.

In Details of DoS Attacks all DoS events are listed, with information about the time, event type, IP address affected, the direction of the attack (ingress or egress) and its duration. In SYN Attacks can be found attacks of SYN type, with the number of failed SYN and its rate per second. In Volume Attacks there is a list of volumetric attacks, with information of the traffic volume and its average rate.

‍

Subscriber Group Metrics

Subscriber Group QoE Metrics

To see metrics per subscriber group, go to Status->Subscribers->Subscriber Groups (also accessible from Statistics->Subscribers->Subscriber Groups).

At the top of the page, there is a selector with the traffic direction, the time period to consider and the metric to display. By default,the downlink average speed over the last day is shown.

A chart shows the time evolution of the selected metric for the first 10 subscriber groups by traffic usage. If no subscriber groups are defined, only the default all-subscriber groups will appear, with metrics of all the combined traffic going through the BQN server.

Below the chart, a heatmap displays the metric with one row per subscriber group. The heatmap represents a scale of color intensity that maps the metric range. This is shown with a color scale to the left of the chart. The higher the number, the higher the color intensity.

Clicking on a heatmap row removes the group from the chart, and clicking again plots the group back. A doble click leaves only that group visible. A right-click goes to the subscriber group dashboard.

The color scale is adjustable. Dragging the minimum and maximum values will focus the color range to that metric interval, leaving values below and above painted in the lighter and darker colors respectively.  This helps to focus the analysis, zooming into that metric interval. The MEAN value will be adjusted to the selected interval,with values outside the range rounded to the interval limits.

Placing the mouse over a heatmap cell shows its exact timeand value.

At the bottom of the page there is a table listing the subscriber groups. The information of the table is as follows:

• SUBSCRIBER-GROUP: the subscriber group name. Clicking on the name leads to the group dashboard.
• SUBS-ACTIVE: counts the number of subscribers members of that group that have an active session in the BQN server. Clicking on it leads to the Subscriber QoE page filtered by this subscriber group, so the metrics of each individual group member metrics can be checked there.
• FL-ACTIVE: number of active flows part of this group traffic.
• LIM-Mbps: speed rate limit set in that direction, in Mbps (n/a if no limit set).
• RATE-POLICY: name of the rate policy being applied to this group (n/a if no policy set). The policy definition is the one setting the limit shown in LIM-Mbps.
• FL-CREATED: flows created so far belonging to this subscriber group.
• MBYTES: total traffic volume of this subscriber group so far, in megabytes.
• CURR-Mbps: current speed in Mbps. 
• MEAN-Mbps: moving average speed in Mbps (calculated every 10 minutes).
• RTT-ms: moving average of latency in milliseconds. If the downlink direction is selected, the latency shown is on the access side (towards the subscribers). If uplink direction is selected, the latency on the Internet side is shown.
• RTX: the moving average of percentage of TCP retransmissions(directly related to packet losses). If the downlink direction is selected, the retransmission shown is on the access side (towards the subscribers). If uplink direction is selected, the retransmission is on the Internet side is shown.
• MAX-SPEED: moving average of the percentage of traffic with a speed close to maximum speed.
• CONGESTION: moving average of the percentage of traffic suffering congestion.
• LIFETIME: duration so far of this subscriber group.

A PLOT column in the table indicates the groups included in the chart and heatmap. Up to 50 subscriber groups can be shown at the same time selecting their plot tick box. The chart will be refreshed automatically after a few seconds. Unselecting the plot tick will remove that group from the chart and the heatmap.

It is possible to use a filter, to select only the groups that have as member an IP address or a subscriber ID:

If we have reached the group QoE metrics page from a subscriber dashboard (clicking on View subscriber groups in the subscriber dashboard), the subscriber metrics will be shown along with the metrics of the groups of which it is a member:

‍

Subscriber Group Dashboard

‍

Clicking a subscriber group name in the subscriber group QoE page will show a subscriber group dashboard, with the metrics in separate charts:

The dashboad shows the time evolution over the selected period of the following subscriber group metrics:

• Downlink and uplink average speeds.
• Created flows and active flows.
• Access and Internet latencies.
• Access and Internet packet retransmissions.
• Percentage of traffic suffering congestion.
• Percentage of traffic at a speed close to the maximum.

It also contains scatter-plots with the relationship between the average speed and measurements of latency, retransmission and congestion. A red line shows the possible correlation between the two. These charts help to identify speeds where other QoE metrics may deteriorate (and perhaps mitigate it by limiting the overall speed of that group).

If you place the mouse on top of a chart point, a tooltip will display its exact value. Tootips in the other charts at the same point in time will show the other metrics values.

The dashboard also containsa chart with the time evolution of DPI services of the group.

‍

To see the detailed metrics of each group member, click on See main subscriber in group to go to the Subscriber QoE metrics page filtered by this subscriber group.

To see the subscriber group definition and/or make changes to it, click on Edit subscriber group.

‍

Exporting DPI Records

‍

The Bequant BQN product generates DPI information for the traffic passing through it, allowing identification of the composition of that traffic in terms of services and applications. The information is viewable in the graphical interface of the BQN product. To facilitate exporting this information for processing by external reporting systems, this document describes the BQN shell command that enables it. The command described here is available starting from version R4.21.3.

Command Syntax

show statistics dpi records all hours {HOURS} direction {all|downlink|uplink} 
       separator {” ”|”;”|”,”} [start {YYYY-mm-DDTHH:mm}]

‍

Example:

DPI records of the 14^th  of Abril, 2024:

show statistics dpi records all hours 24 direction all separator ";" start 2024-04-14T00:00

Output format

The command returns one line per record, with the fields ofeach record separated by the chosen character. For example:

TIME;VER;SUBSCRIBER-ID;CLIENT-IP;CLIENT-PORT;SERVER-IP;SERVER-PORT;DIRECTION;BYTES;DURATION;
ACCESS-RTT;INET-RTT;PROTOCOL;DOMAIN;DPI
2024-04-16T06:58:44.809751-0500;1;"c4:69:f0:90:d9:7d";100.68.150.39;2939;17.253.7.143;443;
DOWNLINK;35667;0.194;4120;84309;tcp;"app-site-association.cdn-apple.com";"apple"
2024-04-16T06:58:46.007509-0500;1;"c4:69:f0:90:d9:7d";100.68.150.110;51807;181.39.187.161;443;
DOWNLINK;72441;0.018;6331;722;tcp;"media.fgye1-1.fna.whatsapp.net";"whatsapp”
. . . 

The first line is the header. The fields are as follows:

When ; or , are used as separators, SUBSCRIBER-ID, DOMAIN and DPI fields are enclosed between double quotes. Double quotes inside any of those fields are escaped with double quotes (" is ""), following RFC4180 recommendation.

Invocation

The command is invoked from the BQN shell (not from the Linux shell of the BQN server). A user of operator profile is enough. For example:

bqnop@bqn1> show statistics dpi records all hours 24 direction all separator “;”

The command can be invoked remotely using ssh:

C:\Users\me> ssh bqnop@arzua 'show statistics dpi records all hours 24 direction all separator ";"

And also redirect the output to a local file:

C:\Users\me> ssh bqnop@arzua 'show statistics dpi records all hours 24 direction all separator ";"' > my-dpi.csv

It is recommended to query once a day, at times of low traffic:

C:\Users\me> ssh bqnop@arzua 'show statistics dpi records all hours 24 direction all separator ";" start 2024-04-15T00:00' > dpi-20240415.csv

‍

Importing

The files generated by the output of the described commandare directly importable by tools that accept the CSV standard (for example, MSExcel).

All records are marked with their date and time of generation and adhere to the requested period, but it is not guaranteed that they will be returned in date order (the reason being that the information is obtained from various sources, which can alter the order). Therefore, if you want to perform a temporal analysis within the requested period, the records should be sorted by date once imported into the reporting tool.

‍