Path Monitoring

Pick a delivery path — an ordered set of hops such as client → edge router → firewall → core → ADC/VIP → web — and Versus watches it continuously. For each hop, and tuned to each hop's vendor, it runs a set of checks (reachability, latency and loss, interface and control-plane health, device health, firewall/ADC/DNS specifics, log scans, synthetic app tests, packet capture), schedules them constantly through your site collector, stores the time-series, and renders a live per-hop path-health view.

But the checks aren't the point — the closed loop is. When a check breaches, Path Monitoring opens a Versus Desk incident carrying the full path context, and that incident auto-triggers AI Diagnostics — the AutoPilot war-room agent — anchored on exactly the hop that degraded, followed by governed remediation, then an auto-resolve when the path recovers. Where AutoPilot is reactive (an incident fires, investigate once), Path Monitoring is its proactive counterpart: it runs on a schedule and catches the problem first.

Proactive, and safe by default. Monitoring itself is read-only. The action on breach is an escalation ladder you set — record only, alert, raise an incident, capture packets, trigger AI Diagnostics, or governed remediation — and flap suppression, dedup, and path-level rollup keep it from becoming noise. Maintenance windows suppress it entirely.

The closed loop

A path, monitored hop by hop

A path is an ordered list of hops, and Versus can build it four ways: VIP-anchored (pick an ADC virtual server and it derives client → VIP → pool → member), flow (a client subnet to a destination IP or FQDN, walked by route-trace), manual (you pick the hops), or promoted (reuse a path a Diagnostic session already discovered). The path is re-discovered on a slow cadence so a new hop or a changed next-hop is itself an event.

Each hop is a device with a vendor family and a role — client, router, switch, firewall, ADC, DNS/IPAM, cloud-WAF, or server — or a link between two devices. The role and vendor determine which checks are even offered, so you never wade through irrelevant options.

Every check, by vendor

The catalog spans eleven categories, and a hop only offers the ones its role and vendor support:

Reachability & path — ping, ARP/ND presence, port open, traceroute with path-change detection, path MTU, end-to-end synthetic.
Latency, loss & jitter — RTT and jitter, per-hop incremental latency, and TWAMP / IP-SLA / RPM where the device supports it.
Interface & link health — oper status, errors/discards/CRC, utilization, flap detection, optic DOM.
Control-plane & routing — BGP and OSPF/IS-IS adjacency and prefixes, HSRP/VRRP state, expected-route presence.
Device health — control- and dataplane CPU, memory, temperature and PSU, HA/failover and config-sync, uptime, management-cert expiry.
Firewall-specific — session-table utilization, throughput, dataplane CPU, policy hit-count and deny rate for the path's 5-tuple, HA and commit state.
ADC-specific — VIP availability, pool-member up/down, connections and new-conns/s, SSL handshake failures and VIP cert expiry, the ADC's own health monitor.
DNS / IPAM — resolution and answer validation, zone-serial consistency, GSLB wide-IP availability, DHCP-pool utilization.
Logs & events — error and critical patterns, path-specific denies and resets, config-change detection.
Application / synthetic — HTTP status, TTFB and total latency, keyword match, TLS validity and cipher; cloud-WAF edge analytics and origin health.
Packet capture — a bounded, on-breach auto-capture at the faulting hop into the PCAP Analysis pipeline.

These reuse the same probe library and collector tunnel that power AI Diagnostics — 22 vendor families, from F5, NetScaler, and Avi to Palo Alto, FortiGate, Check Point, Cisco, Arista, Juniper, NSX, Infoblox, and the cloud WAFs.

Guided setup in minutes

Because "every check for every vendor" is a huge surface, the feature ships with a branch questionnaire. It interviews you about intent, path, symptoms, SLA tier, and tolerance, then — knowing the exact vendors discovered on your path — recommends a starting configuration: which checks, at what intervals, with what thresholds and what action on breach. You review the pre-filled per-hop check matrix, tweak any cell, and save. Thresholds can be vendor-recommended defaults, static values you set, or an auto-baseline that learns for a few days and alerts on deviation.

From breach to recovery, automatically

This is the spine of the feature. On breach (after the flap rules below), Path Monitoring generates a Versus Desk incident carrying structured context so the downstream diagnosis starts already-anchored instead of rediscovering everything: the full discovered path with per-hop vendor and role, the exact hop and check that breached with its value versus threshold, the recent sample trend, correlated signals (concurrent breaches on adjacent hops, a recent config change, HA flags, a cert-expiry countdown), the last known-good time, and a severity mapped to P1–P4. The breached devices are attached as configuration items.

That incident then triggers AI Diagnostics — reusing the AutoPilot incident feed that already ships, so there's zero new wiring. Because the incident already carries the path and the suspect hop, the war-room agent starts anchored: it focuses its read-only probes on the breached hop and its neighbours, reaches root cause, and — per the severity's remediation tolerance (P1 invasive, P2/P3 read-only plus approval) — applies a governed fix. When the check holds OK through the recovery window, Path Monitoring posts a recovery update and auto-resolves the incident, closing the loop.

Noise control makes this safe to run at scale: an incident opens only after N consecutive breaches; repeated breaches update the open incident rather than spawning new ones; simultaneous breaches across a path roll up into one incident listing every affected hop; recovery auto-resolves; and maintenance windows suppress incident creation entirely.

How it's delivered

Phased:

Foundations — the data model, path binding (VIP/flow/manual), reachability-through-latency-through-device-health checks reusing the probe library, the scheduler, samples, and a basic Path Health dashboard.
Guided builder — the branch questionnaire, the suggestion engine, and the per-hop check-matrix editor.
Deep checks — firewall, ADC, and DNS categories plus synthetic and cloud-WAF.
The closed loop — breach to contextual incident with correlation, dedup, and flap suppression; the incident triggering anchored AI Diagnostics; capture-on-breach; governed remediation; recovery auto-resolve; auto-baseline.
Scale — rollups and retention, maintenance windows, SLA reporting, and topology-drift alerts.

Diagnostics AutoPilot — the reactive war-room agent a breach anchors and triggers.
Versus Foresight — continuous intent assurance verifies declared intents against the twin using the same path model.
Packet Capture — the capture-on-breach pipeline a faulting hop feeds.