Topology

The Monitor > Topology page shows a topological visualization of network equipment and their connecting interfaces by leveraging the Cisco Discovery Protocol and Link Layer Discovery Protocol.

Overview

The Topology map displays network nodes, such as routers, switches, firewalls, and other managed devices, connected by weighted lines. Darker, thicker lines indicate a higher number of connections between two devices, while lighter, thinner lines indicate fewer.

Groups

Clicking the Groups icon in the upper right corner of the page header opens the Groups tray. This tray lists all configured device groups and displays the following columns for each:

Column	Description
Name	The group name. The currently active group is highlighted with a purple dot.
Obj.	The number of objects (devices) in the group.
Conn.	The number of connections associated with the group.

A search bar at the top of the tray lets you quickly locate a specific group by name.

Selecting a group from the list updates the topology canvas to show only the devices and connections belonging to that group. The page title reflects the active group (e.g., Topology: BCPMap). Select All at the top of the list to return to the full network view.

Filtering Devices

Clicking the Filters icon beside the Groups icon opens the Filter Devices panel. This panel lists all discovered devices by hostname and includes a search bar for quickly locating specific devices. Selecting one or more devices focuses the topology view on those devices and their connections.

Visualization Types

Clicking the Chart Type icon opens a dropdown menu that displays different visualization/chart types. The currently active chart type is shown in the toolbar with a tooltip. The following visualization types are available:

Force Directed

By default, the topology information is displayed in this visualization type. Devices are rendered as labeled circular icons with connecting lines. This is the recommended view for most networks.

Circle Layout

All devices are arranged evenly around the circumference of a circle. Connections are drawn as straight lines through the interior. This is useful for identifying which devices have the most cross-connections at a glance.

Adjacency Matrix

Devices are listed along both axes of a grid. A filled cell at the intersection of two devices indicates a connection exists between them. Cell color intensity reflects connection strength, in which, darker purple indicates more connections. This view is best for spotting asymmetric relationships or verifying that expected connections are present.

Bubble Matrix

Similar to the Adjacency Matrix, but connections are represented as circles scaled by connection count rather than filled cells. Larger, darker circles indicate a stronger relationship. The row device (x-axis) is the source and the column device (y-axis) is the destination.

Arc Diagram

Devices are placed along a horizontal axis in order. Arcs drawn above the line represent connections between nodes, while the arc height and thickness scale with the number of connections. This is effective for identifying which pairs of devices communicate most heavily across the network.

Chord Diagram

A circular layout where each device occupies a segment of the outer ring. Ribbons drawn through the center connect devices, with ribbon width proportional to connection volume. This view is most useful for quickly seeing which device has the most total traffic relative to others.

Sankey Diagram

Devices are arranged in two vertical columns. Flow bands connect source devices on the left to destination devices on the right. Band thickness represents connection count. This view is suited to hierarchical or directional traffic analysis.

Collapsed Force

Devices with fewer connections are grouped into a single collapsed node labeled with a count (e.g., “4 devices”). This simplifies the topology view when many low-activity devices are present.

Devices

Clicking a device node on the topology map opens a tray with additional details and the following options:

Field	Description
IP Address	The device’s primary IP address
Device Name	Fully qualified hostname
Device Type	Category such as Layer 3 Switch, Firewall, etc.
Vendor	Hardware manufacturer (e.g., Cisco)

The tray also provides two actions:

• View - Opens the host details page to view traffic summaries, interface activity, and any alarms/events or anomalous behavior associated with the host

• Reports - Run any report type supported by the device

Note

A device must be a flow exporter to generate reports. Devices discovered via CDP/LLDP that are not configured as exporters will appear on the topology map but will not produce any reports when Reports is selected.

Hovering over a device node on the map shows a quick-reference tooltip with the device’s IP address, type, and vendor without opening the full tray.

Interfaces

Clicking a connection line between two devices in the map opens a tray showing the interface counts for each endpoint (e.g., 13 ↔ 18) and the connected devices, displayed as cards with their hostname and IP address details. Clicking a device card opens the device tray that displays more details.

Below the device cards, a Connections table lists every protocol observed between the pair:

Column	Description
#	Row index
Protocol	The discovery protocol used for this connection
A Int.	The interface number on Device A
B Int.	The interface number on Device B

Clicking a row in the Connections table opens a second tray that shows:

• The protocol name as the tray title

• First Seen and Last Seen timestamps for when this connection was first and most recently observed

• A Interface — Details for the interface on Device A, including description, name, IP address, interface index, and device type

• B Interface — Details for the interface on Device B, including description, name, IP address, interface index, and device type

Each interface card also includes icons for viewing interface traffic reports and copying the interface link directly.