Platform

How FishEye is built.

One master on your own server, probe nodes at your other sites, agents on workstations. What runs where, what is kept, and what leaves your network.

What runs where

Everything on your own machines.

The master runs four services: the web API; a worker that schedules checks and sends alerts; the SNMP poller, which asks your routers and switches for their own counters and health; and, if you turn flow on, a flow collector, which takes in your routers’ summaries of who talked to whom. Devices can also send traps: alerts they raise on their own. Probe nodes and agents call the master; it never needs to reach into them.

The master

A native install on Ubuntu Server 22.04 or 24.04 LTS: systemd services behind nginx, data in PostgreSQL 16 with TimescaleDB. The web API, the worker and the SNMP poller run as separate services, so one can restart without the others.

Probe nodes

A single-file agent for any Linux host with Python 3.8 or later. It repeats the master’s ping, traceroute and DNS checks from its site, holds nothing worth backing up, and keeps unsent results on disk until the master answers.

Windows agents

A service for Windows 10 or Server 2016 and later that reports what the workstation sees: its gateway, internet and DNS round trips, Wi-Fi, and its own health.

What is kept

History you can go back to.

Data	Kept by default
Ping results, one row a minute per target and vantage point	180 days
Traceroute hops, DNS, HTTP and path MTU results	90 days
SNMP samples, raw and hourly	30 days and 365 days
Hourly summaries, status history and route changes	400 days
Resolved alerts	90 days after they resolve
Flow billing summaries (5-minute)	400 days

Ping, traceroute and SNMP retention is set in one place, Settings → Storage. Raw flow records are kept for days rather than months; how many is set when flow is installed.

Capacity

Measured, not promised.

Routers can send FishEye a short report for every conversation that crosses them. We tested how many of those reports FishEye can take in and store.

10,000reports a second, for ten minutes straight, without losing a single one. This is the rate we support.

160,000a second in a one-minute rush, still without losing one

~200,000a second is roughly where the database starts to fall behind

Tested. At 10,000 reports a second, the part that receives them used about as much memory as one browser tab, and the database that stores them about 1.4 GB. We only publish what we have measured: we have not yet stress-tested how many devices FishEye can check.

Security

Each caller has its own key.

Sign-in. Local accounts or RADIUS (several servers, with an optional cached fallback), and an optional one-time code. Sessions are server-side; the browser holds no token.
Access groups. People see only the targets of their groups. Changes need an administrator.
Credentials encrypted. SNMP community strings and v3 keys are encrypted at rest.
Signed agent updates. A Windows agent installs an update only if it carries a signature from a key that never touches the server.
Requests accepted once. Windows agent requests are signed with the agent’s own key, time-limited, and refused if replayed.
First Line Check stays read-only. It is off by default, runs a fixed runbook, and refuses any other command.

Outside calls

Nothing leaves without a switch.

To name a hop’s network and place it on a map, FishEye asks up to 12 public services for extra detail, mostly about public hop addresses: Team Cymru, RIPE, PeeringDB and others. Every one of them is listed, and each can be switched off. Turn one off and FishEye shows a little less; nothing breaks.

Private addresses, and the shared 100.64.x.x addresses a provider gives many customers at once (CGNAT), are never looked up: they cannot be reached from the internet, so there is nothing to look up. Your measurements, flow records and alerts stay in your own databases.

Integrations

Fits the tools you already run.

Imports

Targets from a Zabbix export, or from CSV and Excel in bulk, with per-row overrides and SNMP set up as they come in.

UniFi

Sites, devices, status and telemetry from a UniFi Network console, locally or through Ubiquiti’s cloud connector.

MPLS

LSP state for Junos and IP Infusion OcNOS, with its history.

Prometheus

Gauges for targets, alerts, ping and DNS at /metrics, with a Grafana dashboard to start from.

IPAM and topology

Subnets and addresses, and links from LLDP or drawn by hand.

Customers and services

Group targets by customer and attach services, so an alert can say who is affected.

An option from plan T3: a standby server that keeps a streaming copy of the database. Failing over to it is a manual step, on purpose. With two servers and nothing to referee, a network split could otherwise promote both.

See it on your network.

FishEye is made by Layer 10. Tell us about your network, and we will walk you through it.

Talk to us