QNova Client · Live telemetry

Network traffic monitoring that runs on the device

Counters update once a second, a rolling graph keeps 1, 10, 30 minute and 1 hour windows, and a details view shows the negotiated cipher suite, the tunnel address, DNS, the public address and the adapter. The history survives a reload, and it survives the lid.

What it is

The problem starts with the words: the VPN is slow

That sentence turns up in a ticket most weeks, and it never arrives with a number attached. Slow compared to what? Slow since when? Slow on the tunnel, or slow on the hotel Wi-Fi the tunnel is sitting on top of? Nobody can say, because by the time anyone looks the moment has gone: the person reconnected, rebooted, or shut the lid and went to lunch. Most desktop clients make that worse in one very specific way. They show you a live reading while the window is open, then throw it away the second the window closes. It is a speedometer with no odometer.

Counters, published once a second

They run on the device that is carrying the traffic, so there is no mirror port, no collector to stand up and no export step between the thing happening and you seeing it.

A rolling graph with four windows

1 minute, 10 minutes, 30 minutes and 1 hour. The chart is persisted locally, so it survives a reload and it survives suspend. Shut the lid at lunch, open it afterwards, and the hour behind you is still sitting there.

The connection itself, in detail

The negotiated cipher suite, the tunnel address, the DNS in use, the public address, and the adapter type and speed. This is the list support asks for and almost never gets on the first try.

The three are kept separate on purpose. Guessing about a network is how a ten minute problem turns into a Thursday.

The mechanism

Change the window. Then close the lid, and look again.

The gap is where the machine was asleep and nothing was measured. Everything before it and everything after it is still on the graph, which is the whole argument of this page in one gesture.

counters update once a second

A rolling throughput graph kept on the device itself, with four windows: one minute, ten minutes, thirty minutes and one hour. The one hour window shows a clear dip about halfway through. Underneath the graph the connection details read: cipher suite TLS_AES_256_GCM_SHA384 with a hybrid post-quantum key exchange, tunnel address 10.20.4.61, DNS 10.20.4.1 on the Finance profile, public address 81.193.44.207, and adapter QNova TUN at 1.0 Gbit/s. Closing the lid opens a gap in the line where nothing was measured, marked lid closed, and everything recorded before and after it stays on the graph. That is the difference between a live reading and a record you can argue with.

Why this exists

Four things that go wrong without it

Slow arrives without a number

Slow compared to what, and since when? Without a record the conversation is two people guessing, and guessing about a network is expensive.

The moment is gone before anyone looks

By the time somebody opens a window the person has reconnected, rebooted or gone to lunch. A live reading only helps if you are already watching.

The laptop in the airport is where the complaints come from

A collector on a span port stops exactly where your network stops, and that machine is on somebody else Wi-Fi in a building you do not own.

You are asked to prove the tunnel is encrypted

A datasheet and a confident tone is not evidence. A cipher suite line on a real connection is, and anybody can read it out.

What you get

One graph, two arguments: it is not the tunnel, and here is how we know

The person who runs the network wants the phrase to arrive with a number attached, for once. The person who signs the invoice is thinking about the box they did not have to rack, and the week somebody asks in writing to see proof.

For the network

Slow turns into a shape

A ticket that says slow is an opinion. An hour of counters with a dip in the middle is a fact. You get to ask since when, and actually get an answer.

The hour that used to vanish at lunch

The graph is persisted locally, so the evidence is still there after the reconnect, the reboot and the lid. The moment does not have to be caught live any more.

Nobody has to be at the keyboard

A heartbeat every 20 seconds is what makes a device visible to you in the console. You stop asking one person to reproduce a problem while you watch, which is fortunate, because it never reproduces while you are watching.

For the business

No collector to buy, rack and then forget

The measurement travels with the device, which is where the traffic is. The laptop in the airport lounge is the part of your estate a span port never sees.

The transparency that keeps the agent installed

The person opens the client and sees the same graph and the same details you would ask them to read out. Software that watches quietly and shows the person nothing gets uninstalled the week after the audit.

Evidence you can hand over

Every communication is encrypted, always with post-quantum cryptography, including the establishment of the tunnels. The cipher suite line is where anyone can check that on a real connection.

How it works

Three steps, and the first asks nothing of anybody

A laptop in a hotel decides how your Tuesday goes

Someone in sales is on hotel Wi-Fi and everything feels like wading through treacle. They open the QNova Client, and the graph is already there: the last minute, the last ten, the last thirty, the last hour, with the dip sitting right where they felt it. The details view underneath gives them the tunnel address, the DNS, the public address, the adapter and the negotiated cipher suite, which they read out in one sentence instead of twenty minutes of screen sharing. Nothing was enabled and no ticket was filed to make that record exist, because it was being kept the whole time.

The same Tuesday reaches your console, with the half they cannot see

That device is visible to you because it sends a heartbeat every 20 seconds. In QS-WAN you get real time cards per gateway carrying nine indicators, including the heartbeat, the tunnel, the VPN server, the control channel, and Users, Download and Upload. Those states are kept apart on purpose, because they fail independently, so everything is down splits into three different problems with three different owners before anyone has opened a terminal.

You settle it, then change something for everyone at once

With the hour from the device and the counters from the gateway side by side, you get to say which of the three it was, and say it with a screenshot. Then you act with levers that already live in the console: rules per gateway and per user, applied in real time and reapplied on reconnect, weekly schedules per VLAN, and the algorithms set for the whole fleet at once. Persistence in the database is authoritative and delivery is best effort, so a green response proves your instruction was recorded, not that a laptop asleep in a bag has already obeyed it.

Before you start

You need the client your people already run. There is no span port to mirror, no collector to stand up and nothing to switch on: the counters are already being kept.

In detail

The heartbeat, and why this is not a collector

Heartbeat

Presence, which is not the same as traffic

Every 20 seconds the client sends a heartbeat. That is what makes a device visible to administrators in the console, and what makes it reachable for assisted remote support.

Be precise about what a heartbeat is, because it gets blurred a lot. It is presence, not traffic. It answers whether this device is here right now, which is the question you have to answer before any other question about that device is worth asking. The fleet view, gateway by gateway, lives in remote device management. Assisted remote support is in its integration phase, not fully productised, and we would rather write that down than let you find out in a demo.

Collectors

What this usually means, and what it means here

Ask ten vendors for this and nine of them describe a collector. Something sits on a span port or takes a flow feed, chews on everybody packets in one place, and renders a dashboard an hour later for a person who has to go looking for it.

That is a real approach and it answers real questions. It also has a habit of stopping exactly where your network stops. The laptop in the airport lounge, on somebody else Wi-Fi, is the part of your estate that collector never sees, and it is the part your users complain about most. Putting the telemetry in the client flips that around: the measurement travels with the device, which is where the traffic is.

Where this earns its place

Four mornings this changes

The ticket that just says the VPN is slow

You ask for the hour window and get a shape instead of an opinion. The dip is either on the tunnel or it is not, and the graph says which.

Somebody wants proof the tunnels are encrypted

The cipher suite line on a live connection is the evidence. Anyone can read it out, and it beats a datasheet and a confident tone.

The machine that only misbehaves when you are not looking

It does not have to reproduce while you watch. The record was being kept before anyone thought to ask for it.

Three things went wrong and everybody says everything is down

The gateway cards keep the heartbeat, the tunnel, the VPN server and the control channel apart, because they fail independently. Three problems, three owners.

Works better with

The console half, and the two things the details view proves

Remote device management

The console side of the same heartbeat: the fleet, gateway by gateway, and what each device is doing right now.

Remote support software

What the heartbeat makes reachable. Worth reading for the plain note on where it is in its integration phase.

Post-quantum cryptography

The cipher suite line in the details view is where you check the handshake is the one we say it is, rather than taking our word for it.

Endpoint monitoring

The same device, read for what it is doing rather than for how much is moving through the tunnel.

What this does not do

The limits, because they are what make the rest believable

It does not inspect the contents of your traffic

These are counters and connection facts: how much, how fast, over which adapter, under which cipher suite. Not what was in it. And nobody here is watching your network, because this is a product and not a managed service.

It does not break traffic down per application

There is no per-destination breakdown and no alert when a number gets big. It is the record you reach for, not a system that taps you on the shoulder.

The graph is local, and it is not an archive

It is genuinely durable across reload and suspend, and it lives on the device. Do not plan a year-end report around it, because long-term retention is not what it is for.

The coverage is not even across platforms

Windows is complete. Linux is a genuine port with gaps we declare rather than hide. macOS and iOS are planned rather than shipped. If a platform matrix ever shows you a tick in every box, ask what is underneath it.

Questions people ask

The ones that come up first

What is network traffic monitoring in QNova Client?

It is telemetry kept on the device that is carrying the traffic. Cumulative counters are published once a second, a rolling graph keeps 1, 10, 30 minute and 1 hour windows, and a details view shows the negotiated cipher suite, the tunnel address, the DNS in use, the public address and the adapter type and speed.

Does the history survive a reboot or the lid closing?

The chart is persisted locally, so it survives a reload and it survives suspend. Shut the lid at lunch, open it afterwards, and the hour behind you is still there. That is the difference between a live reading and something you can argue with.

Do I need a collector or a span port?

No. The measurement travels with the device, so there is no mirror port, nothing to rack and no export step. It also means the laptop on hotel Wi-Fi is measured, which is the part a collector on your own network never sees.

What is the heartbeat, exactly?

Every 20 seconds the client reports that it is there. It is presence, not traffic. It makes the device visible to administrators in the console and reachable for assisted remote support, and it answers the question you need answered before any other one.

Can the person using the laptop see all of this?

Yes, the same window. There is no hidden version. They see their own throughput graph, their own history and the same connection details an administrator would ask them to read out. Software that watches quietly and shows the person nothing is a thing people learn to resent.

Does it tell me which application used the bandwidth?

No. There is no per-application or per-destination breakdown, and no alerting. It is a record of how much moved, how fast, over which adapter and under which cipher suite.

Bring the last ticket that just said slow.

We open the graph on a real connection, close the lid while you watch, and reopen it so you can see what is still there. Then we read the cipher suite line out loud. It is free, it lasts as long as you want, and there is nothing to sign.