Platform
How FishEye is built.
One server on your own hardware, or two and a witness for high availability. Collectors and probes at your sites, agents on your users’ computers. What runs where, what is kept, and what leaves your network.
What runs where
Everything on your own machines.
The server
One Linux program that serves the console and the API over HTTPS, takes in every measurement, runs the alert rules and keeps time-based jobs on schedule. Settings live in PostgreSQL; every measurement lives in ClickHouse.
Collectors
A collector sits at a site near your devices. It polls them over SNMP, receives flow, traps and syslog, and keeps what it has gathered on its own disk until the server has it. Two collectors at one site can share the work, so one takes over if the other stops.
Probes
A small agent for a Linux host at each of your other sites. It runs the ping, HTTP, DNS, path MTU and traceroute checks you give it, never as root, and keeps up to 24 hours of results on disk if the server is out of reach.
Endpoint agents
A service for Windows 10 or Server 2016 and later, and for Linux, that reports what the computer sees: its gateway and FishEye round trips, its Wi-Fi, its own health, and checks to the services your users rely on.
The appliance
A virtual machine image on Ubuntu 24.04 LTS for VMware, Proxmox or KVM, and Hyper-V, hardened and with no outside package sources. A first-boot wizard sets the network, the admin account, the licence and the role. Packages for Linux hosts you run yourself are also available.
High availability
A licensed option: two servers and a small witness that holds the deciding vote. If either server fails, the other carries on by itself, with no one switching it over.
What is kept
History you can go back to.
| Data | Kept for |
|---|---|
| Ping results, and their one-minute summaries | 180 days |
| Traceroutes, and HTTP, DNS and path MTU results | 90 days |
| Hourly summaries of ping, HTTP, DNS and path MTU | 400 days |
| SNMP interface samples, raw and hourly | 30 days and 365 days |
| Flow records, one-minute and hourly flow summaries | 3 days, 7 days and 400 days |
| Traps and syslog | 90 days and 30 days |
| Endpoint agent readings, raw and hourly | 30 days and 400 days |
| Resolved alerts | 90 days |
A storage guard watches the measurement database’s disk. Above 80% full it warns on the Health page; above 90% it deletes the oldest days, raw data first, and says what it deleted.
Capacity
Measured, not promised.
We load-test a complete FishEye install on one 4-vCPU machine that also runs the traffic and SNMP generators. Here is what it kept up with.
Tested with generated traffic, not on a customer network. Not measured yet: the console and API under load while data comes in, weeks of retention, real traffic, and probes. Our sizing guide starts at 4 vCPU and 16 GB of memory for up to 250 targets.
Security
Each caller has its own key.
- Sign-in. FishEye accounts, RADIUS or an OpenID Connect provider, and an optional one-time code for FishEye accounts. The session cookie cannot be read by the page’s scripts, and nothing is kept in the browser’s storage.
- Access groups. A group is a set of sites. People outside the administrators see only their groups’ sites.
- Credentials encrypted. SNMP communities and keys, device and RADIUS secrets are encrypted with a master key that is never stored in the database or in a backup.
- A certificate for every agent. Collectors, probes and endpoint agents enrol once with a token, then talk to the server over mutual TLS with a certificate from FishEye’s own authority, renewed by itself.
- Signed releases. Releases and offline update bundles are signed with a key kept offline. Agents install only a release signed with the key built into them, and never an older version.
- Read-only towards your devices. Collectors never write to a device: SNMP, gNMI and NETCONF are used only to read.
- Encrypted backups. One backup covers both databases and the settings, encrypted with a key you hold. A restore drill into a scratch copy runs on a schedule and reports the result.
Outside calls
Nothing leaves without a switch.
Every call the server makes to the internet is listed under Settings, Outbound calls, with what stops working without it, and each has its own switch. There are ten: two lookups of public hop addresses for their network and place (RIPEstat), Telegram, email and webhook alerts, Let’s Encrypt certificates and their DNS update, the release feed, and OIDC and RADIUS sign-in. Answer yes to air-gapped at install, and every call to a fixed internet address starts switched off.
Private addresses, and the shared 100.64.x.x addresses a provider gives many customers at once (CGNAT), are never looked up. The licence is a signed file your server checks itself. Your measurements, flow records and alerts stay in your own databases.
Integrations
Fits the tools you already run.
Imports
Devices and checks from a CSV file in bulk, up to 1,000 rows at a time, with SNMP credentials from a saved profile. Devices start polling at once, and the import shows which ones answered.
UniFi
Sites, access points, switches and gateways from a UniFi Network controller, read through its official read-only API by the collector at that site.
Routing
BGP routes streamed from your routers over BMP, IS-IS neighbours, MPLS LSP state, and over gNMI the state of each BGP session and SR-TE policy. All read-only.
Topology and traffic maps
Links found through IS-IS and LLDP, a history of how the topology changed, and maps of your links coloured by how full they are.
Customers and circuits
Group checks and circuits into customers’ services, so an SLA report and a maintenance window can name them. Circuits carry their provider, commit and contract dates.
REST API
The console runs on the same REST API you can call, described in OpenAPI at /api/v1/openapi.yaml, with API tokens for scripts.
High availability is a licensed option: two servers and a witness, which must sit in a third place such as another host or site. Our failure tests recover from the loss of any one of the three within 60 seconds, with no one stepping in. Losing a server and the witness together stops the cluster, and flow, syslog and traps sent in the few seconds a collector pair’s address moves are lost.
See it on your network.
FishEye is made by Layer 10. Tell us about your network, and we will walk you through it.
Talk to us