Reliability Overview
Network reliability analysis based on TCP and UDP performance features. Each asset is profiled per 15-minute window. The reliability engine compares each window against a learned per-asset baseline (drift detection) and configurable SLA thresholds. Degraded windows are recorded in perf_events.
Throughput Trend
| Hour | TCP bps | UDP bps | Active Assets |
|---|---|---|---|
| 2026-04-28T20:00:00 | 2,520,000 | 186,000 | 42 |
| 2026-04-28T21:00:00 | 2,520,000 | 186,000 | 42 |
| 2026-04-28T22:00:00 | 2,520,000 | 186,000 | 42 |
| 2026-04-28T23:00:00 | 2,520,000 | 186,000 | 42 |
| 2026-04-29T00:00:00 | 2,520,000 | 186,000 | 42 |
| 2026-04-29T01:00:00 | 2,520,000 | 186,000 | 42 |
| 2026-04-29T02:00:00 | 7,140,000 | 527,000 | 120 |
| 2026-04-29T03:00:00 | 7,140,000 | 527,000 | 120 |
| 2026-04-29T04:00:00 | 7,140,000 | 527,000 | 120 |
| 2026-04-29T05:00:00 | 7,140,000 | 527,000 | 120 |
| 2026-04-29T06:00:00 | 7,140,000 | 527,000 | 120 |
| 2026-04-29T07:00:00 | 7,140,000 | 527,000 | 120 |
| 2026-04-29T08:00:00 | 7,980,000 | 589,000 | 134 |
| 2026-04-29T09:00:00 | 7,980,000 | 589,000 | 134 |
| 2026-04-29T10:00:00 | 7,980,000 | 589,000 | 134 |
| 2026-04-29T11:00:00 | 7,980,000 | 589,000 | 134 |
| 2026-04-29T12:00:00 | 7,980,000 | 589,000 | 134 |
| 2026-04-29T13:00:00 | 7,980,000 | 589,000 | 134 |
| 2026-04-29T14:00:00 | 4,620,000 | 341,000 | 78 |
| 2026-04-29T15:00:00 | 4,620,000 | 341,000 | 78 |
| 2026-04-29T16:00:00 | 4,620,000 | 341,000 | 78 |
| 2026-04-29T17:00:00 | 4,620,000 | 341,000 | 78 |
| 2026-04-29T18:00:00 | 4,620,000 | 341,000 | 78 |
| 2026-04-29T19:00:00 | 4,620,000 | 341,000 | 78 |
Top Degraded Assets
Assets ranked by number of degraded windows in the time period. A degraded window is one where the asset's performance drifted from baseline OR breached an SLA threshold.
| IP Address | Degraded | Critical | SLA | Drift | Peak TCP RST % | Peak UDP NoResp % | Peak DNS Fail % |
|---|---|---|---|---|---|---|---|
| 10.0.12.45 | 8 | 2 | 3 | 3 | 0.42 | 0.18 | 0.65 |
| 10.0.12.201 | 6 | 1 | 2 | 3 | 0.31 | 0.22 | 0.41 |
| 10.0.3.118 | 5 | 0 | 2 | 3 | 0.24 | 0.55 | 0.12 |
| 10.0.7.42 | 4 | 0 | 1 | 3 | 0.18 | 0.08 | 0.34 |
| 172.16.0.89 | 3 | 0 | 1 | 2 | 0.15 | 0.04 | 0.07 |
TCP Health
Per-asset TCP performance averages. High reset ratio indicates connection instability. High zero-byte ratio indicates failed handshakes (scanning or blocked services). High short-lived ratio indicates probing patterns.
| IP Address | Flows | Avg bps | Avg Duration (s) | RST % | Zero-byte % | Short-lived % |
|---|---|---|---|---|---|---|
| 10.0.12.45 | 847.2 | 2,840,000 | 12.40 | 0.42 | 0.18 | 0.32 |
| 10.0.3.118 | 312.8 | 920,000 | 4.70 | 0.24 | 0.42 | 0.61 |
| 10.0.12.201 | 184.5 | 7,320,000 | 28.90 | 0.31 | 0.04 | 0.08 |
| 10.0.7.42 | 92.3 | 410,000 | 8.20 | 0.08 | 0.11 | 0.18 |
| 172.16.0.89 | 47.8 | 180,000 | 6.10 | 0.15 | 0.21 | 0.27 |
UDP Health
Per-asset UDP performance averages. High no-response ratio indicates unresponsive services or one-way traffic patterns.
| IP Address | Flows | Avg bps | No-Response % | Avg Pkt Size | Multicast % |
|---|---|---|---|---|---|
| 10.0.3.118 | 421.0 | 140,000 | 0.55 | 384 | 0.02 |
| 10.0.12.45 | 287.4 | 68,000 | 0.18 | 280 | 0.01 |
| 10.0.7.42 | 118.6 | 31,000 | 0.04 | 142 | 0.00 |
| 224.0.0.251 | 84.2 | 8,400 | 0.00 | 312 | 1.00 |
DNS Health
Per-asset DNS query rate, RTT, and failure ratio. High RTT indicates resolver latency or upstream problems. Low response ratio signals timeouts (queries with no matching answer). High failure ratio (NXDOMAIN/SERVFAIL) indicates misconfiguration or DGA-style probing.
| IP Address | Queries/s | Avg RTT (ms) | Max RTT (ms) | Response % | Failure % |
|---|---|---|---|---|---|
| 10.0.12.45 | 8.42 | 420.50 | 2,184.00 | 0.34 | 0.65 |
| 10.0.7.42 | 2.15 | 84.20 | 410.00 | 0.71 | 0.34 |
| 10.0.3.118 | 1.84 | 28.40 | 120.00 | 0.96 | 0.12 |
| 10.0.12.201 | 0.92 | 18.10 | 84.00 | 0.98 | 0.08 |
Recent Reliability Events
Most recent windows where assets exhibited reliability issues — drift from baseline, SLA breaches, or both.
| Window | IP | State | Drift | SLA | TCP RST | UDP NoResp | DNS Fail |
|---|---|---|---|---|---|---|---|
| 2026-04-29T19:37:07 | 10.0.12.45 | critical | tcp_reset_ratio:3.21,dns_failure_ratio:2.84 | dns_failure_ratio:0.65 | 0.42 | 0.05 | 0.65 |
| 2026-04-29T18:37:07 | 10.0.12.201 | sla_breach | tcp_reset_ratio:0.31 | 0.31 | 0.22 | 0.08 | |
| 2026-04-29T17:37:07 | 10.0.3.118 | drift | udp_no_response_ratio:2.78 | 0.05 | 0.55 | 0.02 | |
| 2026-04-29T16:37:07 | 10.0.7.42 | drift | tcp_handshake_rtt_ms_avg:2.61 | 0.08 | 0.04 | 0.07 | |
| 2026-04-29T14:37:07 | 172.16.0.89 | sla_breach | dns_failure_ratio:0.34 | 0.04 | 0.02 | 0.34 |
Slowest TCP Handshakes
Per-flow three-way handshake RTT (SYN → SYN/ACK). High values point to upstream-network or far-host latency. Sourced from raw tcp_perf events.
| Source | Destination | Port | Handshake RTT (ms) | Duration (ms) | Close |
|---|---|---|---|---|---|
| 10.0.12.45 | 198.51.100.47 | 443 | 842.30 | 8,420.0 | rst |
| 10.0.3.118 | 203.0.113.214 | 443 | 412.70 | 184,200.0 | fin |
| 10.0.7.42 | 8.8.8.8 | 53 | 284.50 | 280.0 | timeout |
| 10.0.12.201 | 52.96.166.130 | 443 | 218.40 | 2,840,000.0 | fin |
| 172.16.0.89 | 10.0.0.1 | 22 | 184.20 | 18,400.0 | fin |
Top Retransmits / Out-of-Order Flows
Flows showing the most retransmissions, out-of-order packets, or zero-window stalls. Indicates packet loss or resource contention.
| Source | Destination | Port | Retx → | Retx ← | OOO → | OOO ← | 0-Win → | 0-Win ← | Close |
|---|---|---|---|---|---|---|---|---|---|
| 10.0.12.45 | 198.51.100.47 | 443 | 28 | 42 | 8 | 12 | 2 | 0 | rst |
| 10.0.3.118 | 203.0.113.214 | 443 | 14 | 31 | 3 | 7 | 0 | 0 | fin |
| 10.0.12.201 | 52.96.166.130 | 443 | 11 | 9 | 2 | 4 | 1 | 0 | fin |
| 10.0.7.42 | 203.0.113.18 | 80 | 5 | 18 | 1 | 6 | 0 | 2 | fin |
| 172.16.0.89 | 203.0.113.99 | 443 | 4 | 8 | 0 | 3 | 0 | 0 | fin |
RST-Closed Flows
Flows terminated by RST instead of FIN — forced shutdowns. Often associated with port scans, blocked services, or policy enforcement.
| Source | Destination | Port | Duration (ms) | Handshake (ms) | RSTs | FINs |
|---|---|---|---|---|---|---|
| 10.0.12.45 | 198.51.100.47 | 443 | 8,420.0 | 842.30 | 3 | 0 |
| 172.16.0.89 | 10.0.0.1 | 3,389 | 124.0 | 48.70 | 2 | 0 |
| 172.16.0.89 | 10.0.0.5 | 22 | 89.2 | 52.10 | 2 | 0 |
| 172.16.0.89 | 10.0.0.10 | 445 | 142.4 | 58.40 | 2 | 0 |
| 10.0.7.42 | 203.0.113.42 | 80 | 78.0 | 28.20 | 1 | 0 |
Slowest Time-to-First-Byte
Per-flow latency from flow start to the first payload-bearing packet in each direction. High to-client TTFB = slow server response.
| Source | Destination | Port | Handshake (ms) | TTFB → (ms) | TTFB ← (ms) | Duration (ms) |
|---|---|---|---|---|---|---|
| 10.0.12.45 | 198.51.100.47 | 443 | 842.30 | 848.00 | 2,840.50 | 8,420.0 |
| 10.0.3.118 | 203.0.113.214 | 443 | 412.70 | 420.20 | 1,240.80 | 184,200.0 |
| 10.0.7.42 | 203.0.113.18 | 80 | 284.50 | 290.00 | 920.40 | 8,420.0 |
| 10.0.12.201 | 52.96.166.130 | 443 | 218.40 | 224.00 | 482.10 | 2,840,000.0 |
| 172.16.0.89 | 10.0.0.1 | 22 | 184.20 | 190.00 | 220.50 | 18,400.0 |
UDP Request/Response RTT
UDP flows with the slowest paired request/response RTT. Useful for surfacing slow DNS resolvers, slow NTP / SNMP responders.
| Source | Destination | Port | Pairs | Avg RTT (ms) | Max RTT (ms) | RTT σ (ms) |
|---|---|---|---|---|---|---|
| 10.0.12.45 | 8.8.8.8 | 53 | 28 | 420.50 | 2,184.00 | 382.40 |
| 10.0.7.42 | 1.1.1.1 | 53 | 42 | 84.20 | 410.00 | 64.10 |
| 10.0.3.118 | 10.0.0.5 | 123 | 18 | 32.40 | 120.00 | 14.80 |
| 10.0.12.201 | 10.0.0.1 | 161 | 8 | 18.10 | 84.00 | 9.20 |
UDP Inter-Arrival Jitter
Per-direction inter-arrival-time stddev. High jitter on streaming ports (5060, 5004, 16384–32767) indicates VoIP / RTP quality issues.
| Source | Destination | Port | Avg → (ms) | Jitter → (ms) | Avg ← (ms) | Jitter ← (ms) |
|---|---|---|---|---|---|---|
| 10.0.7.10 | 203.0.113.50 | 5,060 | 20.00 | 48.40 | 20.50 | 52.10 |
| 10.0.3.55 | 203.0.113.90 | 16,384 | 20.00 | 28.70 | 20.20 | 31.40 |
| 10.0.12.45 | 8.8.8.8 | 53 | 0.00 | 8.40 | 0.00 | 15.20 |
| 10.0.7.42 | 1.1.1.1 | 53 | 0.00 | 4.20 | 0.00 | 6.80 |