Feature · Observability

See the network now, and track how it behaved over time.

Live operator dashboards and a NOC wall display, a living inventory of every device with its full history, and aggregate statistics over your retention window — all on the appliance, with no cloud dependency.

Client Behavior LIVE
DHCP Shield Pro Client Behavior dashboard: a vendor-distribution donut and bar chart alongside a treemap of the most active clients, built from configurable widgets.
Configurable widget dashboards — here, client behaviour: vendor mix and the most active devices at a glance.
Live dashboards NOC wall display Device inventory Printable reports CSV exports v4 + v6 DHCP

Overview

What it does

Observability is about seeing the network as it is right now and tracking how it has behaved over time. Every DHCP transaction the appliance inspects is recorded, so the same data feeds a live operator dashboard, a per-device history, and aggregate statistics. You move from a wall-display overview down to a single device and back without leaving the appliance.

The dashboards and reports here are deterministic: they describe what the DHCP traffic actually did. Optional model-produced risk scores can appear alongside this data when you configure an LLM backend, but the observability surfaces below stand on their own without one.

Activity Timeline
DHCP Shield Pro client activity timeline: a stacked bar chart of one device's DHCP messages over several days, broken down by type — DISCOVER, OFFER, REQUEST, ACK — with a min/max/mean/total table beneath.
Every device's history, by message type — what it did, and when.

Dashboards & NOC display

Live operator dashboards and a wall display

Dashboards are built from configurable widget panels covering network health, DHCP message rates by type, firewall load and dropped packets, client behaviour, pool utilisation, automation alarms, and IPv6/DHCPv6 activity. Every dashboard is per-user and saved automatically, you can build as many as you want, and a protocol selector scopes any dashboard to DHCPv4, DHCPv6, or both. A shared time-range picker drives every widget on the page.

The same dashboards drive the NOC Display — a full-screen, low-chrome wall view for the operations room. It rotates through your saved dashboards on a configurable timer, runs in kiosk mode with the screen kept awake, and visually escalates the page border when alert counts climb. The benefit is one screen the room can read at a glance, built from the dashboards operators already use.

Dashboards › Editor
DHCP Shield Pro dashboard editor: a dashboard being built from draggable widget panels — DHCPv4 outbound and DHCPv6 inbound traffic charts — with Add Widget, View Mode, and Save controls.
Dashboarding under your fingers — drag in widgets, pick a time range, and save.

Device inventory & history

A living inventory of every device, and its full history

Devices History is the complete record of DHCP events the appliance has observed. You browse, search, and filter every device — by MAC, hostname, vendor class, IP or subnet, transaction ID, message type, or protocol — with full Option 82 relay-agent detail and the DHCPv6 fields (DUID, IA addresses, delegated prefixes) on expanded rows.

From any device you open Device Details: identity, first/last seen, assigned IPv4 and IPv6, current enforcement state, an activity timeline by message type, and long-term activity heatmaps — a 90-day calendar and a 30-day day-of-week × hour punch card that reveal a device's normal rhythm. The benefit is a single page that tells you what a device is, what it has been doing, and whether that behaviour is consistent over time.

Device Details › Activity Pattern
DHCP Shield Pro weekly activity pattern: a 30-day day-of-week by hour heatmap for one device, each cell shaded by how active the device was at that time — revealing its normal daily rhythm.
A device's normal rhythm — the 30-day day-of-week × hour activity pattern.

Statistics

Aggregate statistics over the retention window

The Statistics page slices the event store without writing a query. The Overview tab ships four pre-built tables — top active clients, vendor distribution, DHCP pool utilisation with full address counts, and a request-frequency histogram — each with sorting, pagination, and CSV export. The Custom Reports tab adds a visual report builder: group by MAC, DUID, protocol, vendor class, relay, hostname, or matched rule; pick metrics; set a time window; and save the report to rerun on demand. The benefit is a tabular answer to almost any "who, how many, which pool" question, ready to export.

Traffic Flow
DHCP Shield Pro traffic flow: a Sankey diagram splitting total DHCP traffic into accepted and dropped, broken down by message type.
Accepted versus dropped, by message type — at a glance.

Flow visualizer

See accepted vs dropped traffic, and the kernel path

Two complementary views show what the firewall is doing to your traffic. A Traffic Flow (Sankey) dashboard widget shows total DHCP traffic split into accepted and dropped, broken down by message type — the clearest single picture of accept-versus-enforce. The Flow Visualizer page then renders the live kernel packet pipeline itself — hooks, chains, sets, and live packet/byte counters — as a left-to-right diagram, so you can walk a packet from entry to exit and see exactly where it is dropped. Together they turn "why was this packet dropped?" from a log search into a picture.

Network map

Devices on a map, with a replayable timeline (beta)

The Network Map plots every located device on a geographic map, coloured by status — blocked, throttled, tracked, monitored, or healthy. Zoom out for clustered donut markers that summarise a hotspot's status mix; zoom in for individual markers; click one for a device panel that jumps straight to Device Details. A historical timeline mode lets you replay device status for any past date and hour.

This one is still in beta: it needs a third-party system integrated to resolve where each device physically sits, so until that location source is connected there is nothing to plot. The map tiles themselves are served from your own infrastructure, so browsing the map sends no device data off the network.

Compliance exports

Export device history and records

Records leave the appliance as CSV. Devices History exports every filtered event with full field detail, including all the DHCPv6 fields, streamed directly from the database so large exports start immediately. Device Details exports a single device's events, or a formatted printable report covering its status, activity, actions, and history. Statistics tables and saved reports export their results the same way. These exports give you the repeatable, off-appliance records that compliance and audit reviews ask for.

Device Report
DHCP Shield Pro printable device report: a single device's status, enforcement state, activity-timeline statistics, activity patterns, and a table of its DHCP events — formatted for printing or saving to PDF.
A printable per-device report — status, activity, and full event history, ready to save or hand to an auditor.

From overview to one device

How it fits together

  1. 1

    Every inspected DHCP transaction is recorded on the appliance, feeding all of the views below from one source.

  2. 2

    Dashboards and the NOC display give the live, minute-resolution overview — on a desk or on a wall.

  3. 3

    Statistics and the network map let you pivot the same data by device, vendor, pool, relay, status, or location.

  4. 4

    Devices History and Device Details drill all the way down to one device's full event history and behaviour over time.

  5. 5

    CSV and printable exports take any of it off the appliance — for compliance, audit, or an offline record.

Keep reading

Related

See it on your own network.

Open documentation, a real product, and a team that knows DHCP.