MMT User Guide

Monitoring Tool of MEASURE Platform

Montimage Monitoring Tool (MMT) is a monitoring solution that combines data capture, filtering and storage, events extraction and statistics collection, and traffic analysis and reporting, providing network, application, session, and user-level visibility. Furthermore, it is able to correlate information from different sources to detect complex events, and thanks to an advanced rule-based engine, propose counter-measures to react to detected situations (e.g., performance, security, operational incidents). MMT performs online and offline monitoring of the traces of a running system, and it allows the extraction of complex measurements from individual pieces of data. It is able to operate in a non-obstructive fashion, since the execution traces are observed without interfering with the behaviour of the system.

MMT can be easily integrated with third parties in various ways: structured data produced by other applications or systems can feed the Extract module; extracted data and detected events can be used by other tools; behaviour models, pattern matching rules, etc. can be converted to properties to correlate information; and verdicts and events can be used by external tools. All these functionalities are summarized in the MMT global view presented in Figure below.

https://bytebucket.org/montimage/mmt-operator/wiki/img/archi.png?token=cdd9de8d59539305052dfce8a5e94e21a69e1f96&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edf

MMT-Operator

This document presents Graphical User Interface of MMT-Operator.

MMT-Operator is a Web application. It has typically 2 parts: Client (front end) and Server (back end).

         The Server is written in NodeJS running at the server side.

         The Client is written in JavaScript and HTML running on Web browsers at the client sides. There may be many users using their Web browsers to connect to the Server to statistics of MMT. These statistics will be graphically represented in Web browsers of users in forms of chart elements, such as, bar, line, pie, or table. This document presents in detail of the elements.

 

General Structure

The followings are some basic notations being used in MMT:

The following things are applied on GUI:

Tab

Statistics will be grouped into tabs, e.g., Link, Network, Application, DPI, Security, Evasion and Setting.

Each tab has a Toolbar and a set of Reports. The Figure below represents the Application tab having 3 reports: Top Users, Top Applications and Top Remotes.

https://bytebucket.org/montimage/mmt-operator/wiki/img/tab.example.png?token=e26da39ebd7eeb25e78aded21344359042ea295b&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edf

Toolbar

The toolbar often shows the following buttons, from left to right:

  1. Export Charts to Images https://bytebucket.org/montimage/mmt-operator/wiki/img/btn.download.png?token=87347b3fb5c15cd70d4f11686688cbe1d4b0863b&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edf: When click on this button, all displayed Reports will be exported to .png files. You might allow Google Chrome to download multiple files to download several report pictures.
  2. Delete a Report https://bytebucket.org/montimage/mmt-operator/wiki/img/btn.trash.png?token=4fbf0bbf3603705269415534231217d131a59468&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edf: Drag and drop a Report over this button to delete that Report.
  3. Reset View https://bytebucket.org/montimage/mmt-operator/wiki/img/btn.reload.png?token=7f35e4bdbb737ec3ab5b520fa029580a3f66e73e&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edf: Click on this button to reset the view of reports to the initial state.
  4. Auto Reload https://bytebucket.org/montimage/mmt-operator/wiki/img/btn.auto.reload.png?token=98a84aeef03442a67361770a08ec9bd0f48c3ea3&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edf: When it is enabling, the current Tab is automatically reloaded periodically.
  5. Period https://bytebucket.org/montimage/mmt-operator/wiki/img/btn.period.png?token=78ba0bde224a2edf5329da8b40947ece700d0e84&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edfdecides a period of statistic to shown, such as, the statistic of the last 5 minutes. The available periods are: Last 5 minutes, Last hour, Last 6 hours, Last 12 hours, Last 24 hours, Last 7 days, and, Last 30 days.

One might also select a period between two dates by clicking on a small calendar button at the right of combobox.

  1. Probe https://bytebucket.org/montimage/mmt-operator/wiki/img/btn.probe.png?token=2da8fc9f7cebd5ee0bda659f4994ad99773d5c97&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edflists all running MMT-Probe in the current Period. If there is only one MMT-Probe, this combobox has only one value "All". When more than one MMT-Probe is running, one might select the combobox to see the statistics of one or all MMT-Probes.

Please note that, one of the buttons above can be hidden on some specific Tabs.

Report

A Report graphically represents a statistic of MMT. A Report consist of :

  1. A title located on the top-left corner
  2. One or many Filters to filter out unnecessary data. When user changes value of a Filter, the other Filters and Charts will be reloaded.
  3. One or many Charts is the main part of a Report. A Chart might depend on another, e.g., when an element in a Chart is selected another Chart will be reloaded to show the statistic concerning to the selected element.

One can do the following actions on Report:

  1. Delete a Report: This action is available when there are more than one Report on a Tab. In such a case, there exists a RecycleBin icon on the left of Toolbar.

To delete a Report, click and hold on the title of the report, then drag and drop it on the RecycleBin icon.

  1. Resize a Report: To resize a Report, move cursor to an edge of Report, then drag cursor to resize it. Some Reports cannot be resized.
  2. Reorder Reports in a Tab: To reorder Reports, drag and drop a Report to a position by click and hold on its title.
  3. Save a Report as a Picture: Click on the left button on the Toolbar.

Chart

Tab Link

This tab gives an overview of the network being monitored by MMT-Probes, such as, Input/output traffic, the top 7 protocols having highest traffic, list of active nodes since the last 5 minutes. On each report, one can click on detail button https://bytebucket.org/montimage/mmt-operator/wiki/img/btn.detail.png?token=65b790272dc53cc1834a70c8d3bcad49d7619794&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edfto view bandwidth of an individual such as a protocol or a node.

https://bytebucket.org/montimage/mmt-operator/wiki/img/tab.link.png?token=a7e23cc1e8d56b54e90c1d741fa2354f309b1b9e&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edf

Tab link consists of 3 reports:

  1. Traffic represents the total bandwidth of the network representing via 3 lines: in-bound and out-bound of IP traffic, along with the total bandwidth of other traffic that are non-IP based protocols such as ARP.

One can click on a legend item https://bytebucket.org/montimage/mmt-operator/wiki/img/btn.traffic.legend.png?token=748298f70f7d9fe50c4c0c2293409cf878253754&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edfto hide/unhide the line corresponding.

  1. Top Protocols contains the top 7 protocols. This report consists of 2 charts: the left one represents historical bandwidth, in bit per second, of the top protocols; the right one is the list of these protocols along with their total data and percentage.

One can click on one item of the list to hide/unhide the line corresponding on the left side.

  1. Active Nodes contains the information about the nodes in the network that are being active since the last 5 minutes. A node in a network is identified by its unique media access control address (MAC address).

This report is not influenced by the Period filter on the toolbar. It always shows the active nodes since the last 5 minutes or the moment started MMT if MMT has been started less than 5 minutes.

Each row in the table represents a unique. Only the active nodes since the last minutes have statistical data. The statistic of the nodes, that were active since the last 5 minutes and inactive since the last minutes, are set to zero.

The start time and the last updated time are respectively the first and latest moment MMT saw a packet coming/outgoing to this node

Tab Network

This tab gives at the glance the top factors in the networks, such as, top users, top profiles, top locations, top links. These factors consume the most traffic. One can also inspect deeply one session.

https://bytebucket.org/montimage/mmt-operator/wiki/img/tab.network.png?token=695427f47c8643468721b97ce3ddc04c235d839f&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edf

Tab Network consists of first 4 reports. Each report contains the top 7 factors being represented in 2 charts:

For each row of the table,

  1. Top Users is the top 7 users in the network. Each user is identified by a unique IP address.
  2. Top Profiles is the top 7 Profiles in the network. When click on one profile name, one will get the top 7 applications or protocols of the profile.
  3. Top Geo Locations is the top 7 destination countries. _local represents the traffic of 2 users in the network.
  4. Top Links is the top 7 links. One link represents the traffic between 2 users in the network or one user with another from outside the network.

To inspect in detail of one session, one can click on name of each factor. For example, on can:

  1. click on Vietnam in the Top Geo Location,
  2. then Web on the Profiles,
  3. then HTTP:80
  4. then 192.168.0.198 <-> 111.65.248.144,

then one obtains the following list:

https://bytebucket.org/montimage/mmt-operator/wiki/img/tab.network.detail.png?token=c6bc786e90feaf041a11625c5a459991cde4c332&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edf

Tab DPI

Tab DPI gives information about hierarchy of protocols/applications. It consists of 1 Report: Protocol Hierarchy.

https://bytebucket.org/montimage/mmt-operator/wiki/img/tab.dpi.png?token=bb0ae11b0a7d9939a55112c92f8f088b08b5c565&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edf

The Protocol Hierarchy report has 2 charts: a tree chart on the left and a line chart on the right.

         The tree chart represents the hierarchy of protocols, e.g., there are 36 distinct protocols/application in the figure above.

         The line chart represents the traffic of the selected protocols of the tree chart. These lines do not represent the bandwidth of the protocols but their total traffic during a sample period that is 5 seconds by default.

Through this chart, one can easily see a consistency between protocols. For example, in the figure above, we found that the HTTP traffic vs the total traffic that is represented by ethernet.

Tab Application

Tab Application shows the information about the network's round-trip time, data transfer time, application response time and data rate for the selected application type from the App tab. Moreover, the detailed information is provided in the tables for each application every 5 seconds, that are application response time, data transfer time, server data transfer time, client transfer time, network round-trip time, Number of HTTP transaction, number of active flows, packet rate, data rate, packet size and percentage of payload.

This Tab currently supports only protocols/applications on the top of HTTP and FTP.

https://bytebucket.org/montimage/mmt-operator/wiki/img/tab.application.png?token=90cd41b099576ff3eb7b9196d619bf9d0dbf7c6a&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edf

Initial TCP RTT (Handshake): Initial RTT of an application is determined by looking at the TCP Three Way Handshake. It is the time elapsed between TCP-SYN and TCP-ACK in the TCP Three Way Handshake.

Tab Security and Evasion

Tab Security and Tab Evasion list all security alerts. The alerts are grouped by property and probe ID. These tabs list only the latest 5000 alerts.

https://bytebucket.org/montimage/mmt-operator/wiki/img/tab.evasion.png?token=2a51f40358471de12dfbdc08f43ca5c17479f871&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edf

Each tab has only one report consisting of one table. Each row of the table represents the alerts of one property. One can click on one row to see the alerts as in the figure below.

https://bytebucket.org/montimage/mmt-operator/wiki/img/tab.evasion.detail.png?token=52012faedac3c1910f78166285a0a7f6876d4e1c&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edf

Tab Setting

Tab setting gives some statistic of server hosting MMT-Operator such as CPU usage, memory and hard driver free space. It also allows user to update setting of MMT-Operator, backup database.

https://bytebucket.org/montimage/mmt-operator/wiki/img/tab.setting.png?token=b76b25cda0fba45030ce250345095343d2ae532d&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edf

Tab Setting consists of 4 reports.

  1. System Usage gives a statistic of usage of the server on that MMT-Operator is running.
  2. Configuration allows to:
  3. MMT-Probes allows to manager MMT-Probe. One can install MMT-Probe on a remote server by giving permission to MMT-Operator to log on that server via SSH.

When clicking on Add new Probe button, one is led to another window to enter SSH information of the remote server. After entering successfully, MMT-Operator will install a new MMT-Probe on the server and add it to the list of management.

For the existing MMT-Probe, one can:

  1. DataBase

After clicking on the button, one need to confirm in another windows before MMT-Operator can empty its database.

Others

  1. Login: Default login information are admin/ mmt2nm for username/password respectively.
  2. Change Password: One can change the current password by clicking on https://bytebucket.org/montimage/mmt-operator/wiki/img/btn.user.png?token=8649b01aec5427dcc4cbe60dccf30b48e06f5b15&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edfbutton, then "Change password".

Update Licence: One can update the licence by clicking on https://bytebucket.org/montimage/mmt-operator/wiki/img/btn.user.png?token=8649b01aec5427dcc4cbe60dccf30b48e06f5b15&rev=1ab3b5c4209d60b3893801e7f46de809dc5d3edfbutton, then "Profile".