BQN Documentation
BQN Documentation


Subscriber Metrics

gives accessto several metrics per subscriber. Several subscribers are listed. If the subscriber of interest is not listed, type the IP address on the filter field.

The most recent metrics are shown for each subscriber (flows, traffic usage, latencies, retransmissions, etc.).

A click on a metric value leads to a chart with historical data up to three months. For example, clicking on CURR-Mbps leads to a chart of traffic throughput over time.

A very useful metric to monitor the quality experienced by a subscriber is the maximum downlink speed measured over a time window:

To investigate possible quality issues, the Subscriber latency metrics show the access latency experienced by the subscriber compared with the average access latency for the whole network:

Also, the access retransmission percentage can be obtained, with the network average as a reference:

Finally, we can also see the number of active flows and the number of flows created per subscriber in a 5-minute window, which can point to virus/attack problems or to subscribers reselling their connection to other users:

Top Subscribers by Usage

The menu entry Statistics->Subscribers Analysis->Hourly Volume displays the subscriber IP addresses with the largest traffic consumption over time. The Statistics->Subscribers Analysis->Total Volume shows he total in the period being considered.

Traffic and Subscribers per Policy

Statistics->Subscribers->Per Policy shows the split of the subscribers into the different rate policies.

Statistics->Subscribers->Per Policy shows the split of the traffic volume into the different rate policies:

Traffic per Service

In Statistics->Service Analysis there is information about traffic composition.

The BQN shows the overall traffic composition per service in Statistics->Service Analysis->Total Volume per Service.

The hourly evolution can be obtained in Statistics->Service Analysis->Hourly Volume per Service.

By default, all DPI samples are considered by the reporting (All UDRs), both the samples generated automatically by the BQN and those generated by monitoring policies. If the monitoring policies generate so many samples that they can cause a bias in the reporting, those samples can be excluded by selecting Only auto UDRs . This could be the case if several subscribers have a monitoring policy that generates UDRs for all their traffic and make them over-represented in the traffic sample mix.

Latency per Service

To see the latency per service, go to Statistics->Service Analysis->Latency per Service.

To see the latency distribution of a particular service, click on the bar chart icon in the DETAILS column

The distribution shows the percentage of measurements falling into the different intervals of the range of latency values. In the example, over 70% of latencies are between 40ms and 45ms.

To see the evolution over time of those Internet latencies, click on the dial icon in the DETAILS column:

For each time interval, the chart shows the relative percentages of each latency range. In the example, most latencies are in the 0-10ms range (dark blue) but during the night, most latencies fall in the 20-30ms range (orange).

This latency per service analysis, whether globally or over time, can be further refined by filtering with a subscriber address IP address (or range), or by an Internet-side IP address (or range), which will let you study the latency of different services coming from different providers, and specifically for certain subscribers:

Main IPs per Service

It is possible to identify the main IP addresses of a given service, both subscriber addresses (access-side IPs) and addresses of content servers over the Internet.

In Statistics->DPI Service Analysis->Total Volume Per Service, click on the pie sector of the service whose main IPs you want to display. A histogram of the main IP addresses will be shown, with access IP addresses at the top and Internet addresses at the bottom. The histogram shows the percentage of the total service volume of that IP address.

Overall Traffic Metrics

In Statistics->Throughput->Overview shows the temporal evolution of total traffic throughput, adding both directions and all wires.

The evolution over time per network interface is available in Statistics->Throughput->Interfaces.

It is possible to check how much traffic is being processed according to each of the configured policies. For Subscriber Flows policies, it can be checked in Statistics->Throughput->Subscriber Flows Policies and similarly for Subscriber Rate Policies and Subscriber Monitoring Policies.

The chart in Statistics->System->Latencies shows the access RTT (RTT-Down) and Internet RTT (RTT-Up). Average across all flows of the minimum value per flow are provided. They could help as reference to set TCP metric thresholds set in Configuration->TCPO Settings.

Also, Statistics->System->Retransmissions shows the average retransmission percentages in downlink and uplink directions.

To see the number of flows per policy and per protocol, click on Statistics->Flow->Per Policy and Statistics->Flow->Per Protocol respectively.

You can also see the instantaneous number of Flows per protocol in Status->Flows->Per Protocol and per subscriber in Status->Flows->Per Subscriber.


The BQN detects Denial of Service attacks. To do this, DoS thresholds must be configured in Configuration->DoS:

  • Downlink failed handshake rate. SYNs per second without an answer in the direction towards the subscribers (initialized from the Internet). A typical value is 50.
  • Uplink failed handshake rate. SYNs per second without an answer initialized by a subscriber. A typical value is 50.
  • Minimum rate. Minimum speed rate that can be considered a volumetric attack. The exact value depends on the network speed, but a typical value is 50 Mbps.
  • Multiplier of subscriber rate policy. If the subscriber has a known rate policy, a threshold is defined as multiplier *downlink limit. A typical multiplier is 3. For example, a subscriber with a 20Mbps plan will have a DoS threshold of 3*20=60Mbps.

The DoS events are shown in Statistics->DoS Attacks. In DoS Attacks Over Time, the DoS attack events are displayed showing its type, its duration and parameters such as the affected subscriber IP and the main IP contributing to the attack.

In Details of DoS Attacks all DoS events are listed, with information about the time, event type, IP address affected, the direction of the attack (ingress or egress) and its duration. In SYN Attacks can be found attacks of SYN type, with the number of failed SYN and its rate per second. In Volume Attacks there is a list of volumetric attacks, with information of the traffic volume and its average rate.