Frequently Asked Questions – LiveSP

Q. What are LiveSP main features?

A. Keywords: Overview, Implementation, User features.

LiveSP is a multi-tenant platform that delivers Communication Service Providers (CSP), Managed Service Providers (MSP) and network integrators with a powerful application-aware management tool, helping them to assure the delivery of WAN connectivity services to their business customers.
For all the traffic and applications going through the WAN links and accesses, for thousands of enterprise customers, LiveSP is divided into several modules that allow to:

  • display executive view of the network and critical application KPIs;
  • drill down near real-time dashboards and assess end-user experience with fine-grain end-to-end application performance metrics across LAN, WAN and Application servers;
  • troubleshoot hybrid network path (SD-WAN) issues;
  • alert when critical application performance is out-of-policy;
  • report daily, executive view of your Network SLA
  • closely customize customers’ network (dashboard, alerting, site clustering, custom applications, etc.);
  • easily admin multi-tenant profiles and rights
  • monitor flow and polling collection.

Q. What capabilities does LiveSP provide to build custom dashboards and reports?

A. Keywords: User features.

Dashboards are made of customizable dashlets. A dashlet may use various visualization formats and can be configured as easily as you build an Excel timeline graph:

  • pie, to display top nodes on one specific metrics (example: top loaded interfaces);•
  • bar graph, to display aggregated view for several metrics and nodes (example: traffic repartition per DSCP for Citrix, Gmail and FTP);
  • timeline, to visualize trend of KPIs (example: traffic per primary / secondary network for hybrid network);
  • gauge, to highlight performance status of a KPI (example: salesforce response time over the end-customer network);
  • table, to detail performance metrics for Top nodes (example: top path changes with jitter /drop /latency out-of-policy event count);
  • pie-line, to mix gauge and timeline visualization (example: business/leisure traffic repartition)

Reports can include images, text, date and shapes, to have a powerful communication tool.

Q. Is it possible in LiveSP to have executive dashboards beside expert visualization?

A. Keywords: User features.

LiveSP is designed to give both non-specialists and specialists the right insight of network SLAs and end-user experience.

  • The home page provides a workspace to build an overview of network usage, performance and status.
  • The dashboard module provides a fully customizable tab-centric workspace. Admins browse the KPI library and mix in the same tab metrics coming from SNMP polling and SD-WAN features. End-users drill down near real-time data from one dashboard to another for more details or to spot the root cause of an issue.
  • The report module helps Service Providers structure their communication with their multiple enterprise customers. It turns application or network information from the LiveSP platform into synthetic, decision-driven, and good looking PDF report. End-customer chose a template in the report library. They customize the timeframe and schedule a PDF e-mailing for daily / weekly / monthly reporting. Each widget is a dynamic object that is automatically updated when the report is sent.

Q. Does LiveSP provide default resources out of the box, such as dashboards?

A. Keywords: User features.

LiveSP includes several resources out of the box: default dashboards, reports, alerting, home page, KPI, poller, etc. These resources are based on years of network monitoring expertise and make LiveSP available from day one for many use cases.

Q. Can I drill down an issue for more details?

A. Keywords: User features.

Yes, the “drill down” feature is available across the platform. It will help IT managers to deep-dive, step-by-step by displaying the useful dashboards/visualization of their network.
When you select an element (site, application, DSCP, etc.), using the magnifying glass, from any module (home page, flow map, etc.), LiveSP will automatically display the available dashboards. Pick the view you need and LiveSP will switch on the new view, with the right scope on right time frame.
For example, you detect unusual spikes of traffic for ms-update. You need more details to understand who is updating its PC during working hours (thus generating a spike of WAN load). Click on the magnifying glass beside the ms-update legend. LiveSP will automatically propose the compliant dashboards.

Q. What is the data retention period? Is there a way to admin the purge?

A. Keywords: Collection, User features.

When received, data is aggregated to minimize storage without deleting history. Available granularities are 5 minutes, hour and day. By default, data retention is 3 weeks for 5 minutes granularity, 3 months for 1-hour granularity, and day data are never purged. Specific KPI such as daily 5 minutes max period can, however, be stored for a longer period for capacity planning needs.

Q. What does “near real time” dashboards” mean?

A. Keywords: Collection, User features, Implementation.

CPEs send flows on a scheduled period. Let’s take 5 minutes as the export period: for 5 minutes, the CPEs aggregate traffic. Then, they export the aggregated flows, the next 5 minutes (smooth export to prevent the spike of traffic in the collection link). LiveSP collects the data on the fly and starts data processing at the end of the five minutes export period. So when an event occurs, it will be displayed between 5:30 minutes (best case) to 14 minutes after the event (the worst case with the heavy load on the LiveSP servers).


Q. Has the end-customer any customization capabilities?

A. Keywords: User features.

Yes. End-customers (or account manager) can define a dedicated environment including dashboard, reports, alerting, custom application, site clustering. They can group sites in clusters to focus on the specific areas of their network. They can build their custom applications on top of the vendor DPI dictionaries (Cisco NBAR, Qosmos, Sandvine, OneAccess, Huawei…)

Q. How my customers connect to LiveSP? Is it possible to use SSO authentication?

A. Keywords: Implementation, User rights.

Service Providers administrators and operations teams access LiveSP using login and password, through a login page, or via Single Sign-On (SSO) from their internal portal. Customers access LiveSP preferably using SSO, via existing external portal. It prevents customer login/password administration on the LiveSP platform.
LiveSP is compliant with any SSO configuration. As SSO implementations are often different, LiveAction professional services team provides specific plugin compliant with your SSO environment (preferably RESTful or SOAP Web Services).

Q. Does LiveSP alert me when one of my critical application is out of policy?

A. Keywords: User features.

LiveSP allows admins to configure alerts based on network or application metrics in order to increase visibility of end-user experience or network events. When the chosen KPI is above a threshold, an alert is raised.

Q. Can I implement different levels of services depending on customer profiles?

A. Keywords: User features, Implementation, User rights.

LiveSP as a dedicated solution for Service Provider enables customer profiling in a unique instance. Depending on the offer a customer has subscribed to, end-user access specific features, KPI and resources (Dashboard, report, etc.). Service Provider can also decide to keep specific features for internal use in order to improve their operating efficiency and proactivity (scheduled reports, alerting).

customer profiles

Q. What capabilities does LiveSP provide to troubleshoot hybrid network?

A. Keywords: User features.

When a VPN architecture is used and application traffic is transiting between sites, obtaining visibility on the flows is an important facet of the QoE management. With SDWAN (Cisco, Fortinet, Nokia Nuage, etc.), in-depth knowledge of the application flows is becoming even more critical.
With its WAN path module, LiveSP offers a simple and innovative visualization of the end-to-end flows. Designed for VPN set across a few or thousands of sites, it adapts to each enterprise context and builds maps showing the flow going through their network.
Combining traffic metrics and distribution with performance metrics, the flow map is an extremely effective tool to troubleshoot or optimize the network and application delivery infrastructure.

Q. Is there a way to recognize an application which is not in the vendor DPI dictionary?

A. Keywords: IWAN, Admin features.

On Top of DPI applications specific to vendors (Cisco, Qosmos, Sandvine, Huawei…), and exported in IPFIX flows, LiveSP can recognize traffic based on IP, port, HTTP hostname, SSL (HTTPS) server name. The workflow is the following:

Does the flow match an embedded LiveSP customer specific application?

  • If no match, does it belong to the NBAR2 dictionary?
  • If no match, does it match with an IANA service based on well-known ports?
  • If no match then the flow is classified as unknown.

Cisco NBAR2

Q. Does LiveSP support IP range discovery?

A. Keywords: Collection, Admin features, Implementation.

As a multi-tenant platform, LiveSP does not support network discovery. A seed file is required to enable LiveSP.

Q. Can LiveSP poll CoS and IPSLA metrics?

A. Keywords: Collection, Implementation, Admin features.

Yes. Expert polling mode leverages a scripting interface to connect the monitored device and its counterparts (Provider Edge, IPSLA probe) and collect advanced metrics (CoS, IPSLA, Metrics, etc.). Admins can mix CLI, attributes coming from the topology and routers template to build advanced metrics such as traffic per CoS, IPSLA jitter, etc.

Standard SNMP polling mode helps admin to quickly add metrics based on OID (for example CPU, traffic, drop, etc.).

Q. Is it possible to record and display raw flows coming from the router?

A. Keywords: Collection, Implementation, Admin features.

Yes, an expert mode is available on LiveSP. It records raw flows (data + template) coming from the specified CPE and make the data available for analysis. It helps admins troubleshoot issues on router template configuration.

Q. What are the several flow record types that I see when I use the LiveSP raw flow analyzer?

A. Keywords: Collection, Admin features.

The flow record represents the atomic building block exported by the device. NFv9 and IPFIX define 4 types of flow records: template, data, options template, options data. While template and data records describe the actual live traffic, the two latter stand for static mapping information, such as devices, interfaces, applications, etc.

Q. Does LiveSP provide DSCP fields?

A. Keywords: Collection, User features.

LiveSP stores and reports metrics down to the DSCP level per application and interface. This helps know whether a given application may have been misclassified when there is a DSCP-based QoS.

Q. Is it possible to define his own Key Performance Indicators based on raw counters provided by the collection?

A. Keywords: Collection, Implementation, Admin features.

Yes, besides default KPI included in the KPI library, admins can define custom KPIs they need to assess the network and end-user experience. They use a graphical interface to build formulas mixing raw counters and operand. New KPIs are immediately available for building new graphs or tables.


COSClass Of Service
CSPCommunication Service Providers
DPIDeep Packet Inspection
FEField Extraction
FNFFlexible NetFlowLatest Netflow version
IPInternet ProtocolLayer 3 datagram protocol.
IPFIXInternet Protocol Flow Information ExportIndustry standard for Netflow.
LANLocal Area Network
MSPManaged Service Providers
NATNetwork Address Translation
DPIDeep Packet InspectionGeneric name for application recognition engine over a telecommunication network.
SSOSingle Sign On
SNMPSimple Network Management Protocol
SPService Provider
TCPTransmission Control ProtocolLayer 4 reliable transport mechanism.
UDPUser Datagram ProtocolLayer 4 transport mechanism. Connectionless transport layer protocol.
VRFVirtual Routing and Forwarding
WANWide Area Network

Q. What is Netflow/IPFIX?

A. Keywords: Cisco IWAN, Collection, Implementation, Sizing.

Netflow provides the ability to collect IP network information as it enters or exits an interface. A Flow Record consists of keyed fields and non-keyed fields. Keyed fields are all field(s) which need to be unique in order for a new Flow Record cache entry to be created in the CPE memory. Non-keyed fields provide information such as metrics (byte count, packet count, latency or jitter). For every record, a cache table is created to track and store flow entry. A new cache entry is created when the keyed field(s) of the packet does not match existing cache entry. Otherwise, only the non-keyed fields are updated, such as byte count is incremented.

LiveSP main features

Q. What makes Netflow collection different from SNMP monitoring?

A. Keywords: Cisco IWAN, Collection, Implementation, Sizing.

The key difference resides in the information access: SNMP requires collectors to request the information. Netflow collectors passively receive and process flows from all devices. For first case (polling), devices need to store the data available on request. With Netflow, devices send data once processed. Thus, if devices embed the right processing engines (Deep Packet Inspection, passive probe, etc.), one could have much more detail on traffic and performance using Netflow.

Frequently Asked Questions LiveSP

Q. What are the differences between Netflow versions?

A. Keywords: Implementation, Collection, Cisco IWAN.

Most architecture are compatible with Cisco IWAN, as it runs on top of an overlay transport protocol (DMVPN for IWAN 2). However, the concrete deployment of IWAN requires a Cisco Validated Design: Cisco provides online in-depth PDF guides for deployment and configuration.

Netflow 5 (IPv4 specific)

NFv5 is the most commonly deployed version. The flows exported by the equipment provides 5-tuple keyed fields, source IP / port, destination IP / port and protocol, to describe the identities of the systems involved in the conversation and the amount of data transferred.

Flexible Netflow FNF V9 (IPv4 and IPv6 compatible)

Version 9 has brought FNF capability, which makes Netflow a highly versatile protocol. Its flexibility makes it particularly more relevant for complex reporting and heterogeneous data. Here are a few key components:

  • flexible key field aggregation;
  • variable number of data fields;
  • unidirectional or bidirectional;
  • sampled or not;
  • multi-vendor (430 standardized fields, thousands vendor-specific fields);
  • aggregated, synchronized or not for exports.


IPFIX (IP Flow Information eXport) also referred to as NFv10, IPFIX is the industry standardized version of Netflow. It builds on NFv9 for most of the features, and brings additional flexibility (variable-length fields, sub-application extracted fields, options-data, etc.).

Note: Netflow version 9 and IPFIX are the export protocols of choices for AVC, because they can accommodate flexible record format and multiple records required by Flexible Netflow infrastructure. IPFIX is recommended.