# SNMP-Based Flow Enrichment

## Overview

Flow records generally include the index of ingress and egress interfaces by which the network traffic traversed the exporting device. NetObserv Flow will attempt to determine the names, and additional attributes, of these interfaces as learned by polling the exporting device using SNMP.

## Configurations

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_ENABLE

This setting determines whether SNMP polls will be used to gather these network interface attributes.

* Valid Values
  * `true`, `false`
* Default
  * `false`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_PORT

If SNMP polling of attributes is enabled (`EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE` is `true`), this setting specifies the UDP port used for such polls.

* Default
  * `161` (the default SNMP port number)

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_VERSION

If SNMP polling of attributes is enabled (`EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE` is `true`), this setting specifies the SNMP version used for such polls.

{% hint style="info" %}
All network devices which may be polled MUST support this version of SNMP.
{% endhint %}

* Valid Values
  * `1` - use SNMPv1
  * `2` - use SNMPv2c
  * `3` - use SNMPv3
* Default
  * `2`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_COMMUNITIES

If SNMP polling of attributes is enabled (`EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE` is `true`), this setting specifies the SNMP community strings that may be used for such polls. If a comma-separated list is specified, the collector will try each community in the order specified. Once a community returns a successful response, the collector will remember this community for future polls of the device.

{% hint style="info" %}
All network devices which may be polled MUST be configured to all visibility of collected attributes using this community. It may be necessary to specify a *view* associated with this community. The documentation for your devices should contain the necessary information that you will need for determining the correct configuration steps.
{% endhint %}

* Example
  * `public,private,whatever`
* Default
  * `public`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_V3\_USERNAME

The username used to authenticate with the device using SNMPv3.

* Default
  * `''`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_V3\_AUTHENTICATION\_PROTOCOL

The authentication protocol used to authenticate the username with the device using SNMPv3.

* Valid Values
  * `noauth`, `md5`, `sha`, `sha224`, `sha256`, `sha384`, `sha512`
* Default
  * `noauth`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_V3\_AUTHENTICATION\_PASSPHRASE

The authentication passphrase used to authenticate the username with the device using SNMPv3.

* Default
  * `''`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_V3\_PRIVACY\_PROTOCOL

The privacy protocol used to encrypt SNMPv3 traffic between the SNMP input and the device.

* Valid Values
  * `nopriv`, `des`, `aes`, `aes192`, `aes256`, `aes192c`, `aes256c`
* Default
  * `nopriv`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_V3\_PRIVACY\_PASSPHRASE

The privacy passphrase used to encrypt SNMPv3 traffic between the SNMP input and the device.

* Default
  * `''`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_TIMEOUT

If SNMP polling of attributes is enabled (`EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE` is `true`), this setting specifies the number of seconds to wait for the polled device to respond.

* Default
  * `2`

### EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_RETRIES

If SNMP polling of attributes is enabled (`EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE` is `true`), this setting specifies the number of retries to attempt after the initial poll has timed out or otherwise fail. The timeout period will be doubled for each retry.

* Default
  * `1`


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.elastiflow.com/flowcoll/configuration/enrichment-options/enrich_netif_options/enrich_netif_snmp.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.