Network Path¶

Network Path uses eBPF-based Traceroute detection to display the hop-by-hop network path from the source (client) to the destination (server) and the detection quality.

Prerequisites¶

Before using Network Path, ensure the following steps are completed:

Register and log in to TrueWatch;
Install DataKit on the host;
Enable the eBPF collector.

Network Path List¶

Go to Infrastructure > Network > Network Path to view the detection results of all network paths in the current workspace.

Quick Filters¶

The left side supports filtering by the following dimensions:

Dimension	Field
Path Status	Destination Reachable / Partial Path / Detection Failed
Detection Protocol	tcp / udp / icmp
Source Host	source_host
Source IP	src_ip
Source Port	src_port
Source Process	source_process
Source Service	source_service
Destination Domain	dst_domain
Destination IP	dst_ip
Destination Port	dst_port

List Fields¶

Column	Description
Path Status	Overall detection status, indicated by green/orange/red dots
Source	Source hostname; hover to display IP
Destination Domain	Destination domain; displays IP when no domain exists
Destination Port	Destination port, e.g., 443
Protocol	tcp / udp / icmp
End-to-End Latency	Average RTT from the detection source to the destination
Packet Loss Rate	End-to-end non-response ratio
Hop Count	Actual TTL hop count
Latest Detection Time	Start time of the most recent detection
Actions	View details

Click a path record in the list to access the details page.

Network Path Details¶

The details page displays detection details for a single network path, including metric overview, path topology diagram, historical detections, and node details.

Metric Overview¶

Displays key path detection metrics within the current time range:

Metric	Description
Path Status	Overall detection completion status `Destination Reachable` indicates the destination has been reached `Partial Path` indicates only some intermediate nodes were obtained `Detection Failed` indicates an exception occurred during detection execution
End-to-End Latency	Average round-trip delay (RTT) from the detection source to the destination, with the minimum/maximum latency range also displayed
End-to-End Non-Response Ratio	Ratio of probes that received no response from the destination during end-to-end detection, with the actual number of sent/received response samples shown in parentheses
Path Hop Count	Number of intermediate nodes (TTL hops) the current path traverses
Detection Count	Number of Traceroute detection rounds executed for this record

Path Topology Diagram¶

By default, displays the hop-by-hop path topology of the latest detection.

Source Node: The source that initiates the detection, displaying information such as source process, service, IP address, and port;
Intermediate Nodes (TTL 1, TTL 2 ...): Intermediate network nodes that the packets pass through, displaying node name, reachability status, RTT, and ownership information;
Destination Node: The detection destination.

Click the upper-right corner to switch to the Path Change View, which vertically compares the results of multiple detections.

Note

The RTT of each node in the topology diagram reflects the round-trip time from the detection source to that node, not the link latency between two adjacent hops. For path quality, please refer to the End-to-End Latency and End-to-End Non-Response Ratio at the top.

Historical Detections¶

Below the topology diagram, a continuous color band displays the distribution of all detection results for the path within the selected time range.

Color	Status	Description
Green	Destination Reachable	The detection successfully reached the destination
Orange	Partial Path	Only some intermediate nodes were obtained
Red	Detection Failed	An exception occurred during detection execution
Gray	Unknown Status	No data or no detection

Click any color block to synchronously refresh the metric cards, topology diagram, and result bar above with the detection data at that point in time. Switch the time widget at the top to re-render the historical detection area. Up to 100 historical records are displayed.

Node Details¶

Click the source node or any intermediate node in the topology diagram to expand detailed information about the node below, including fields such as IP address, port, host, source process, service, and detection response.

Note

If a TTL node displays No Response, it only indicates that the node did not return a response to this detection, which may be caused by rate limiting on intermediate network devices, firewall policies, or anonymous routing. It cannot be directly concluded that the device is down or the link is interrupted.