How to read the network map: where does a machine’s traffic go

List views answer "what is there" well: this many machines, this many bridges, this many cards. They do not answer "where does this machine's traffic pass" with the same ease. It can be answered, but you have to open four screens and join the chain together in your head, and you have to join it again every time you ask.

Why a map is not a list

Every network entry in this wiki describes the same method: follow the chain. Machine, bridge, physical port, outside world. A list does not hand you that chain, it hands you its parts; you build the chain each time. A map is the chain.

The difference shows up during a fault. On a calm day, walking four screens is no trouble. When something is broken and the hour is late, a chain held in the head joins up wrong.

The links a map has to have

In order: the outside world, the physical port, the bond if there is one, the bridge, the tag if there is one, and finally the machine itself. If one of these links is missing the map looks good and is useless, because the missing link is exactly where you get stuck.

What a map must not do

It must not be pretty at the cost of being true. A map that draws a line which does not exist, or omits one that does, is worse than a list: a list forces you to think, a wrong map persuades you to be certain.

The difference between a drawn diagram and a live map

A diagram someone drew once cannot tell you two things: whether that link is carrying traffic right now, and whether a rule is filtering it. Both are questions asked during a fault. A diagram on the wall does not describe reality six months later; a live map shows whatever is there.

What to look for on a map

A machine attached to nothing. If its network card hangs loose, the matter is at the first link of the chain.

A bridge with no physical port. The machines on it see each other and nothing else. It is the picture of the symptom "the machines can see each other but there is no internet".

A tag present on one side only. If the tag is there in one place and not on the other side, no error appears and no packet passes.

Two machines that should not see each other sitting on the same bridge. This is where what you thought you separated turns out not to be separated.

Where the map cannot see

The map shows what the host reports. What goes on inside a virtual machine is not on this map: its own firewall, its own routing, its own settings. In the case of "everything is open on the server but I cannot connect", the map will look clean to you, because the server side genuinely is clean.

Knowing this does not weaken the map, it lets you use it correctly: the map eliminates the server side, and what remains is the inside of the machine.

What Atlas does

Atlas draws the chain end to end on one screen: the outside world, the physical cards, bonded links if there are any, the bridges, the tagged interfaces, and at the far end the virtual machines and containers. So all of the links above are on the map, and you do not have to open a fourth screen.

Line thickness follows live traffic, so you see by looking which link is actually doing work; that is one of the two things a drawn diagram cannot give you. The second sits on the nodes themselves: if a firewall is active on an interface and a tag is present, the map shows that next to the machine.

What the symbols mean is written in the map's own legend, so you do not have to memorise a colour or a shape.