Skip to main content
Version: 7.4

Network Interfaces

Flow records generally include the index of ingress and egress interfaces by which the network traffic traversed the exporting device. NetObserv Flow will attempt to determine the names, and additional attributes, of these interfaces as learned from Netflow v9 or IPFIX option records, determined by polling the exporting device using SNMP or specified in user-defined metadata.

The network interface enrichment module provides supplemental information for network interface, such as name (ifName), description (ifDescr), alias (ifAlias), type (ifType), bandwidth (ifSpeed/ifHighSpeed), committed information rate (CIR), user-defined tags, and additional user-defined metadata. Values are cached for improved performance and flow record throughput.

This page provide detailed information about User-Defined Metadata Enrichment.

User-Defined Metadata Enrichment

An example of the format of this file is:

10.0.0.1:
1:
ifName: lo
ifDescr: lo
ifAlias: lo
ifType: 24
ifSpeed: 10000000
tags:
- router_mgmt
metadata:
sec.zone.name: network
3:
internal: false
ifName: eth0
ifDescr: eth0
ifAlias: internet
ifType: 6
ifSpeed: 1000000000
cirIn: 200000000
cirOut: 12000000
tags:
- verizon
metadata:
sec.zone.name: internet

10.0.0.2:
501:
ifName: vlan
ifDescr: vlan
ifSpeed: 1000000000
502:
ifName: ge-0/0/0
ifDescr: ge-0/0/0
ifSpeed: 1000000000

Metadata Types

The User-Defined Metadata enricher supports a combination of pre-defined metadata types as well as the ability to provide custom data as key-value pairs. This section describes the various metadata types. The following table provides a summary of these types.

AttributeData TypeField PopulatedDescription
ifNamestring<object>.netif.nameThe textual name of the interface. The value of this object should be the name of the network interface as assigned by the device.
ifDescrstring<object>.netif.descrA textual string containing information about the network interface.
ifAliasstring<object>.netif.aliasAn administratively defined "alias" name for the interface.
ifTypeunsigned<object>.netif.type.id, <object>.netif.type.nameThe type of interface as specified in IF-MIB (RFC 2233). Additional values for ifType are assigned by the Internet Assigned Numbers Authority (IANA) via updates to the syntax of the IANAifType textual convention.
ifSpeedunsigned<object>.netif.bandwidth.bwThe interface's bandwidth in bits per second.
cirInunsigned<object>.netif.bandwidth.prov.inThe interface's ingress provisioned maximum bandwidth in bits per second.
cirOutunsigned<object>.netif.bandwidth.prov.outThe interface's egress provisioned maximum bandwidth in bits per second.
internalbool<object>.isInternalSpecifies whether or not the network interface is connected to a network considered to be "internal".
tagsarray of strings<object>.netif.tagsTags that describe attributes of the network interface.
metadatasequence of attributes<object><attribute> or <attribute>Key-value pairs which will be added at the network interface object or record levels.

metadata

metadata is a list of key-value pairs which will be added as fields to the record. These can either be custom fields specific to the needs of the user, or existing fields from the ElastiFlow CODEX schema. When CODEX fields are specified, the configured metadata value will override any values that already exist in the record.

info

If you have enabled ECS (Elasticsearch/OpenSearch) or CIM (Splunk) support and want to override values from these schemas, you must specify the CODEX equivalent fields in the metadata attribute. Metadata is applied in the decoder portion of the collector, where all data is still in the CODEX schema. Conversion to other schemas is output-specific and thus occurs at a later phase of processing.

Key names can be specified with or without a leading ..

  • If specified with a leading ., the field will be placed within the parent object containing the network interface.
  • If specified without a leading ., the field will be placed at the root of the record.

Consider a network interface from flow.in.netif.index:

  • If the metadata key is defined as .circuit.name, the value would be assigned to flow.in.netif.circuit.name.
  • If the metadata key is defined as circuit.name, the value would be assigned directly to circuit.name.