### WhatRoute Help

## Flow Usage

The Flow Usage window displays the contents of the Flow Monitor table as a treemap. The tiles on the treemap are coloured according to the network protocol used by the underlying flow.

The area occupied by each tile is proportional to the value of the selected property for the flow.

The flows are sorted by the selected property, the largest value appearing at the bottom left corner of the treemap and the smallest at the top right. This ordering is consistent in 4 of the treemap algorithms implemented in WhatRoute. The Pivot algorithm, however, gives a more random layout with smaller values propogating to the top and right edges of the treemap.

The choice of layout algorithm to use is up to you. The default Aspect algorithm is my preference because it is well ordered, has good tile aspect ratios and is a much simpler (i.e. lower overhead) implementation than either of the Squarify and Pivot algorithms. Also, I invented it (kind of).

The treemap is updated each time the Flow Monitor updates its table. Any flows that have been filtered out by Flow Monitor will not be shown on the treemap.

The window image below shows a treemap displaying packet rates.

Flow Detail can be inspected by clicking on the tiles that make up the treemap.

The first click on a tile, will highlight that tile and remove any highlighting from a previously selected tile. If the popover window was previously detached, it is updated with the details of the new selection.

If you again click the (now highlighted) tile, and the popover had not been previously detached, you will see a new popover (which can be detached) showing the flow details.

To close the popover, just click anywhere outside the popover window.

Toolbar
Actions button
Clicking the Actions button reveals a menu, controlling the treemap display, containing the following items:

Group by Protocol
When selected, flows sharing the same IP protocol will be grouped together

Property
The property menu selects the flow property to be displayed by the treemap.

Algorithm
There are currently 5 algorithms implemented for laying out the treemap.
Aspect - I devised the Aspect algorithm while looking at simplifying my implementation of the Squarify method. It is described at Aspect Layout
Pivot - A Pivot layout operates in a fashion similar to the widely used quicksort algorithm. The algorithm is fully described by Ben Shneiderman and Martin Wattenberg in http://hcil2.cs.umd.edu/trs/2001-06/2001-06.html
Simple - The original treemap layout algorithm devised by Ben Shneiderman.
Split - The Split layout algorithm was invented by Björn Engdahl as part of his masters research in 2005. His thesis is downloadable from https://www.nada.kth.se/utbildning/grukth/exjobb/rapportlistor/2005/rapporter05/engdahl_bjorn_05033.pdf
Squarify - An enhancement to the Simple layout algorithm added by Mark Bruls, Kees Huizing, and Jarke J. van Wijk. They describe the algorithm in their paper at http://www.win.tue.nl/~vanwijk/stm.pdf

Zoom Control
Clicking the Zoom Control in the toolbar will display a slider.
* Moving this slider to the left will zoom out the display, each tick mark quadrupling the number of low order values that have been discarded from the treemap.
* Moving the slider to the right zooms in on low order values by discarding the higher orders.
* In the central position, no zooming is performed and WhatRoute will display all the flows that have not been filtered.

Treemap
The treemap colours the tiles according to the protocol/port colours defined in the Map Window Settings panel.

If the Map Window is not open, then the fallback is to use the following colours.

- Red - The underlying flow is TCP
- Blue - The underlying flow is UDP
- Green - The underlying flow is any other protocol (e.g. icmp or icmp6)

Copyright © 2016 - 2017 B.R. Christianson (bryan@whatroute.net)