Outlook

The special feature in Skydive is not the colorful icons in the topology view, which move in a circle across the screen every time you click. The treasure is the connection data that the agents collect in capture mode and report to the analyzer. Skydive can process and analyze this information. The analyzer does not do the work itself but harnesses other tools for this purpose.

The Skydive Flow Matrix add-on prepares IP connections generated by those hosts on which an agent is running. The resulting list contains the protocol, source, destination address, port numbers, and address of the server that accepted the connection. If you find the comma-separated list too boring, you can also admire the data in the form of a Graphviz diagram or Circos ring graph.

Another add-on offers less eye candy but proves useful for security: Security Advisor continuously receives flow information from the analyzer and examines, filters, modifies, and saves the results. The results can be stored on Amazon S3, for example, and analyzed as Flow Logs using AWS methods.

Conclusions

Just as a skydiver admires the beautiful landscape below them, Skydive surveys the network from a bird's-eye perspective. The information comes from the Skydive agents, which collect data on Linux servers and report to a central Skydive analyzer. On the analyzer, admins can retrieve information about the network via the web interface or the command line, examine individual data streams, and even inject packets they define themselves if necessary. The added value of Skydive lies in its holistic approach, which displays the known network components in the form of a graph and visualizes interrelationships.