Reading the discovery graph

The discovery graph uses two independent colour scales: the colour of the line and its arrow tells you about traffic severity, while the colour of the label text tells you which protocol family the connection belongs to. An orange label does not mean an alert.

The two scales at a glance

What is coloured	What it encodes	Palette
The line and its arrow head	Traffic threshold severity on the two endpoints	Green / yellow / orange / red, grey when nothing was measured
The label text above the line	Protocol family (database, web, RPC, messaging…)	Purple / blue / orange / teal / grey
The line style (dashed, dotted, faded)	TCP connection state	—
The line thickness	Measured bandwidth, relative to the busiest link on the map	—

Because both scales contain an orange, a link can perfectly well be drawn as a grey idle line carrying an orange label — that is a database connection with no measured traffic, not a problem.

Why a MySQL link shows an orange label

«MySQL» is written in orange (#e8710a) because MySQL belongs to the database protocol family, which is the family colour. It says what is talking, not how well. The health of that link is the colour of the line itself: if the line is grey, no bandwidth was measured on it; if it is green, traffic is within thresholds.

Link colour — traffic severity

The line and the arrow head take the worst of two statuses: the outbound traffic status of the source process, and the inbound traffic status of the target process. Both statuses come from the traffic thresholds configured on the Sentinel Agent.

Colour	Status	Meaning
Grey	not measured	Bandwidth is `0` — the link is idle, or packet capture was unavailable on that host
Green	OK	Traffic measured and within thresholds
Yellow	MINOR	Minor traffic threshold breached
Orange	MAJOR	Major traffic threshold breached
Red	CRITICAL	Critical traffic threshold breached

The severity order is CRITICAL > MAJOR > MINOR > OK, so a single breached endpoint colours the whole link.

The same four severity colours are reused on the border of each host box, which is why the map reads consistently: green borders and green links mean a quiet, healthy host.

Grey is not a failure

A grey link means no kbits/s value, and a bandwidth of 0 looks the same whether a link is genuinely idle or whether no capture driver was there to measure it. When packet capture is unavailable, the toolbar shows an amber No packet capture badge and edge tooltips read “not measured — no packet capture” instead of 0.000 kbits/s. See packet capture troubleshooting.

Label colour — protocol family

Protocols are grouped into families so the map colours by role — an RPC call versus a database query — rather than by every distinct protocol name.

Family	Colour	Protocols
RPC	Purple	gRPC, Arrow Flight, Arrow Flight SQL
Web	Blue	HTTP/1.1, HTTP/2, WebSocket
Database	Orange	MySQL, PostgreSQL, MSSQL, Oracle, MongoDB, Redis, Elasticsearch
Messaging	Teal	AMQP, Kafka, MQTT
TLS (opaque)	Dark grey	TLS — encrypted, the inner protocol could not be read
Infrastructure	Light grey	SSH, DNS, SMTP, RDP, SMB, IMAP, POP3
Other	Light grey	Anything identified but outside the families above

A protocol seen over TLS maps to the same family as its cleartext form, so HTTP/2 and HTTP/2 (TLS) are coloured alike. When the agent identifies nothing, the label simply carries no protocol and keeps the default black text.

Anatomy of a link label

A full label reads like this:

«~HTTP/2» Traffic: 0.129 kbits/s [Wi-Fi | HTTPS] (CLOSE_WAIT)

Part	Meaning
`«~HTTP/2»`	Identified protocol, coloured by family, with a confidence marker
`Traffic: 0.129 kbits/s`	Measured bandwidth — omitted entirely when nothing was measured
`[Wi-Fi \\| HTTPS]`	Network interface, then the well-known service name of the remote port
`(CLOSE_WAIT)`	TCP state, shown only when it is not `ESTABLISHED`

Confidence markers

The prefix inside the guillemets says how the protocol was identified, so a signature seen on the wire never looks like a port guess:

Notation	Confidence	Evidence
`«gRPC»`	observed	Matched on the wire from the packet payload
`«~gRPC»`	inferred	ALPN negotiation or a linked library
`«?gRPC»`	guessed	Port number or process name only

On a host without packet capture every identification falls back to the guessed tier, which is why the Unidentified bucket of the PROTO filter grows there.

Line style — TCP state

Line colour stays severity-driven; the TCP state only changes the stroke and opacity.

State	Rendering
`ESTABLISHED`	Solid dashed line, full opacity
`TIME_WAIT`	Dashed, faded
`CLOSE_WAIT`	Dashed with a tighter pattern, thicker
`SYN_SENT`	Dotted, faded
`FIN_WAIT1`, `FIN_WAIT2`, `CLOSING`	Dashed, faded
`LISTEN`	Dotted, very faint, thin

Line thickness

Thickness is proportional to the measured bandwidth, scaled against the busiest link currently on the map: the thinnest links are 1 px, the busiest link is drawn at 20 px. A thick green arrow is therefore a healthy but very active link — the arrow head points in the direction of the flow.

Change overlays

When you compare two discovery snapshots, changed connections are marked without disturbing the severity colours:

Overlay	Rendering	Meaning
New connection	Green glow around the line	The link did not exist in the earlier snapshot
Disappeared connection	Faded red, finely dashed, red label	The link existed before and is gone now

Other lines on the map

The thin dotted grey line linking a system information panel to its host box is not a connection: it only attaches the panel to the host it describes. It carries no status, no protocol and no traffic, and it is hidden together with the panel by the Sys toolbar toggle.

The Legend button

Everything above is summarised in the Legend panel at the top right of the graph — click it to expand the severity colours, the TCP states, the change overlays, the protocol families and the confidence markers side by side with the map.