Network Interfaces

The network interface enrichment module provides supplemental information for network interfaces, such as name (ifName), description (ifDescr), alias (ifAlias), type (ifType), bandwidth (ifSpeed/ifHighSpeed), committed information rate (CIR), user-defined tags, and additional user-defined metadata. These values are cached for improved performance and flow record throughput.

The following is a example of the network interface enrichment module:

The user-defined metadata enricher supports a combination of predefined metadata types as well as the ability to provide custom data as key-value pairs. Table 1 describes the types of metadata you can use for network interfaces.

Table 1: Network Interfaces Metadata Types

Attribute	Data Type	Field Populated	Description
ifName	string	<object>.netif.name	The textual name of the interface. The value of this object must match name of the network interface as assigned by the device.
ifAlias	string	<object>.netif.alias	An administratively defined "alias" name for the interface.
ifType	unsigned	<object>.netif.type.id, <object>.netif.type.name	The type of interface as specified in IF-MIB (RFC 2233). Additional values for ifType are assigned by IANA through updates to the IANAifType textual convention.
ifSpeed	unsigned	<object>.netif.bandwidth.bw	The interface bandwidth in bps (bits per second).
cirIn	unsigned	<object>.netif.bandwidth.prov.in	The interface ingress provisioned maximum bandwidth in bps.
internal	bool	<object>.isInternal	Specifies whether or not the network interface is connected to a network considered to be internal.
tags	array of strings	<object>.netif.tags	Tags that describe attributes of the network interface.
metadata	sequence of attributes	<object><attribute> or <attribute>	Key-value pairs added at the network interface object or record levels. These fields can be either custom fields specific to the needs of the user, or existing fields from the Flow Data CODEX schema. If you specify CODEX fields, the configured metadata value overrides any values that already exist in the record.

You can specify key names with or without a leading "."

• If specified with a leading "." the field is placed within the parent object containing the network interface.
• If specified without a leading "." the field is placed at the root of the record.

Consider the network interface from flow.src.ip.addr:

• If the metadata key is defined as .circuit.name, the value is assigned to flow.in.netif.circuit.name.
• If the metadata key is defined as circuit.name, the value is assigned directly to circuit.name.