Chord Diagram in queries

[aparfenov]

I am running the following query in the the demo VM (nagiosna-2.2.3-64.ova):

(src ip 10.1.2.3) and (dst ip 10.4.5.6) aggregated by srcip,dstip

There is just one line in the result: ~300K flows from 10.1.2.3 to 10.4.5.6

But the chord diagram for this query only shows 10.4.5.6 (most of the circle) and tiny Other

Is it expected behavior? Should it show both IPs, since all flows in the result are between them?

[tgriep]

The chord diagram represents the amount of connections being made between the hosts in your query, not the bandwidth of those connections.
So if the IP address that takes up the most area in the diagram made the most connections to any IP address, it will show that IP address in the diagram as the largest section.

[aparfenov]

All connections in this query's result are from 10.1.2.3 to 10.4.5.6.
Does the diagram reflect the results of the current query or all available data?
Why does it only show 10.4.5.6 and does not even mention 10.1.2.3?

[tgriep]

The diagram seems to show the output from the query and not from all of the available data.
I would assume that the number of connections that IP address 10.1.2.3 is much smaller than the other IP address, so it is part of the other section.

[aparfenov]

The query was
(src ip 10.1.2.3) and (dst ip 10.4.5.6) aggregated by srcip,dstip

So all connections in the result are from 10.1.2.3 to 10.4.5.6. Shouldn't the diagram be divided equally between the two IP addresses?

You can run a similar query with fixed source and destination IPs in NNA online demo (http://nagiosna.demos.nagios.com/nagiosna)

A sample query: (src ip 172.12.3.30 and dst ip 192.168.1.81) aggregated by srcip,dstip
and the diagram only shows 192.168.1.81

[tgriep]

I am going to have to ask the developer on the details on how the chord is created and get back to you.

[jomann]

There is a setting in the admin panel that allows you to set the amount of shown objects on the cord diagram. Once it goes over about 100 it becomes unreadable, slow, and unhelpful.
Can you verify the amount you have it set to in your admin settings section?

[aparfenov]

Max Mapped Relations is set to 60.

In both examples there are only two IP addresses to show.

[scottwilkerson]

The query was
(src ip 10.1.2.3) and (dst ip 10.4.5.6) aggregated by srcip,dstip

So all connections in the result are from 10.1.2.3 to 10.4.5.6. Shouldn't the diagram be divided equally between the two IP addresses?

You can run a similar query with fixed source and destination IPs in NNA online demo (http://nagiosna.demos.nagios.com/nagiosna)

A sample query: (src ip 172.12.3.30 and dst ip 192.168.1.81) aggregated by srcip,dstip
and the diagram only shows 192.168.1.81

I think the question went off the rails.

With this query
(src ip 10.1.2.3) and (dst ip 10.4.5.6) aggregated by srcip,dstip
you are only showing connections that started at 10.1.2.3 and ended at 10.4.5.6, so there is only 1 connection and it is taking all of the pie (with "Other" taking a nil percentage)

There is no other thing to separate by.

This is expected behavior

[aparfenov]

Scott,

Could you please explain the logic used to show chord diagrams. I cannot find it in the documentation.
In this case I would think the pie would be split in two halves (10.1.2.3 and 10.4.5.6, with all flows/chords going from one to another). But apparently it is not how it works, and it only shows 10.4.5.6, and you are saying this is expected.
Do chords represent flows?