Network Topology
The Topology page provides an interactive, auto-discovered map of your network infrastructure. Using LLDP (Link Layer Discovery Protocol) neighbor data collected via SNMP polling, WhiteOwl automatically builds a visual representation of how your devices are interconnected — including routers, switches, firewalls, servers, and probes. Click on any link to instantly see real-time flow data traversing that connection.
Topology Views
The Topology page offers three views, selectable via the tab bar at the top:
- Network — Displays physical and logical network device connections discovered via LLDP. This is the primary view for infrastructure visualization.
- Cloud — Displays cloud infrastructure topology for environments with cloud integrations configured.
- IoT — Displays IoT device topology for environments with IoT device monitoring enabled.
Network Topology Controls
The toolbar provides the following actions:
| Control | Description |
|---|---|
| Refresh | Re-fetches the latest topology data from LLDP discovery results and redraws the map. |
| Save Layout | Persists the current device positions so they are retained on future visits. Useful after manually arranging devices for clarity. |
| Reset | Reverts the topology layout to the default auto-arranged positions, discarding any saved layout. |
The device and link count summary (e.g., 19 devices • 5 links) is displayed to the right of the controls.
Topology Map
The interactive map displays each discovered device as a node with its hostname, IP address, and device type. Devices can be dragged to rearrange the layout for better visibility.
Device Nodes
Each device node shows:
- Hostname — The SNMP sysName or configured hostname (e.g.,
cisco-edge-2.eve-ng). - IP Address — The management IP address used for SNMP polling.
- Device Type — Indicated by the node icon and color, categorized as Router, Switch, Firewall, Probe, Server, or Unknown.
- Health Status — The border color of each node reflects its current health state.
Links
Links between devices represent discovered LLDP neighbor connections. Each link label shows:
- Interface Names — The local and remote interface names forming the connection (e.g.,
Gi2 ↔ Gi4). - Utilization — Current link utilization as a percentage (e.g.,
0.0%), calculated from SNMP interface counters.
Legend
The bottom-left corner of the topology map displays a legend with three sections:
Device Types
| Icon | Type | Description |
|---|---|---|
| ⊕ | Router | Layer 3 routing devices |
| ◎ | Switch | Layer 2 switching devices |
| ▦ | Firewall | Security appliances |
| ↕ | Probe | WhiteOwl monitoring probes |
| ▭ | Server | Server endpoints |
| ⓘ | Unknown | Devices whose type could not be determined |
Health
| Color | Status | Description |
|---|---|---|
| 🟢 Green | Healthy | Device is reachable and all polled metrics are within normal thresholds. |
| 🟡 Yellow | Degraded | Device is reachable but one or more metrics have triggered a warning threshold. |
| 🔴 Red | Down | Device is unreachable or has failed critical health checks. |
| ⚪ Gray | Unknown | Health status has not yet been determined (e.g., newly added device). |
Link Status
| Color | Status | Description |
|---|---|---|
| Green (solid) | Up / Normal | Link is operationally up with utilization below 60%. |
| Orange | Admin Down / Util ≥60% | Link is administratively down, or utilization has reached 60% or above. |
| Red | Oper Down / Util ≥75% | Link is operationally down, or utilization has reached 75% or above. |
Link Flow Details
Clicking on any link between two devices opens the Link Flow Details panel on the right side of the screen. This panel provides real-time traffic analysis for the selected connection.
Connection Info
The top of the panel displays the two endpoints of the selected link:
- Device hostnames — The devices on each end of the link.
- Interface names — The specific interfaces forming the connection (e.g.,
Ethernet1↔Gi3). - IP addresses — The management IP of each device.
Traffic Summary
Four summary tiles show aggregate statistics for the selected link:
| Metric | Description |
|---|---|
| Total | Total bytes transferred across the link (e.g., 640 B). |
| Avg Rate | Average throughput rate (e.g., 1 bps). |
| Packets | Total packet count observed on the link. |
| Flows | Total number of unique flow records for this link. |
Traffic Direction
A breakdown of traffic by source → destination pair, sorted by volume. Each row shows:
- Source IP → Destination IP — The specific IP pair.
- Bytes — Total bytes transferred for that direction.
This helps quickly identify which conversations are dominating a particular link.
Top Flows (by bytes)
A detailed table of the individual flow records traversing the selected link, sorted by byte volume. Columns include:
| Column | Description |
|---|---|
| Src IP | Source IP address of the flow. |
| Dst IP | Destination IP address of the flow. |
| Port | Destination port number (e.g., 80 for HTTP, 123 for NTP). |
| Proto | Protocol (e.g., Proto TCP, Proto UDP). |
| Bytes | Total bytes for this flow. |
| Pkts | Total packets for this flow. |
The Link Flow Details panel is useful for quickly diagnosing congestion or unexpected traffic on a specific link. If a link shows high utilization in the topology map, click it to immediately see which flows are consuming bandwidth.
Interacting with the Map
- Pan — Click and drag on the background to pan the view.
- Zoom — Use the scroll wheel to zoom in and out.
- Move Devices — Click and drag any device node to reposition it. Use Save Layout to persist your arrangement.
- Click a Link — Opens the Link Flow Details panel on the right.
- Click a Device — Navigates to the device detail page for that node.
The topology map relies on LLDP neighbor data collected via SNMP. Devices that do not support or have LLDP disabled will appear as disconnected nodes without links. Ensure LLDP is enabled on all devices you want to see connected in the topology.