Aggregator Telemetry - Type 5

The Type 5 Aggregator provides detailed, time-based telemetry for individual network interfaces, delivering a comprehensive view of network health. Unlike flow-based aggregators, it focuses on interface-level metrics, making it applicable across environments ranging from edge networks to data centers and virtualized infrastructure.

This aggregator is similar to the Interface Stats Telemetry from the core plugin, but it adds bandwidth stats and timestamps.


Data Profile

The Type 5 Aggregator provides 20+ detailed metrics per monitored network interface. See details below.

Requirements

Plugin Release
1.0.88

Attributes

Please review the direction conventions documentation for context on local vs other metrics.

Timestamps

log_time_start

integer
Unix epoch timestamp (seconds) for the beginning of the aggregation interval.

log_time_end

integer
Unix epoch timestamp (seconds) for the end of the aggregation interval.

Dimensions

ifname

string
Interface name.

Metrics

capture_dropped

integer
Total number of packets dropped by the packet capture layer.

capture_filtered

integer
Total packets filtered out (removed) in the case where Berkely Packet Filters are in use.

discarded

integer
Total packet counts being discarded prior to entering the DPI engine for analysis. An example is an unsupported protocol like NetBEUI.

discarded_bytes

integer
Total number of discarded bytes.

ethernet

integer
Total number of supported Ethernet header counts seen.

flow_dropped

integer
Total number of packets dropped during flow processing.

fragmented

integer
Number of fragmented IP packets observed.

icmp

integer
Total number of ICMP packets.

igmp

integer
Total number of IGMP packets.

ip

integer
Total number of IP packets.

ip_bytes

integer
Total number of bytes carried in IP packets.

largest_bytes

integer
Largest frame size, in bytes.

local_bytes

integer
Total transmitted bytes.

local_packets

integer
Total transmitted packets.

mpls

integer
Total number of MPLS packets.

other_bytes

integer
Total received bytes.

other_packets

integer
Total received packets.

pppoe

integer
Total number of PPPoE packets.

queue_dropped

integer
Total number of packets dropped due to internal queue limits.

raw

integer
Total number of raw packets captured on the interface.

tcp

integer
Total number of TCP packets.

tcp_resets

integer
Total number of TCP reset (RST) packets.

tcp_seq_errors

integer
Total number of TCP sequence errors.

udp

integer
Total number of UDP packets.

vlan

integer
Total number of VLAN tagged packets.

wire_bytes

integer
Total number of bytes observed on the wire, including frame overhead.

Example Data

The aggregator formats are available in two different formats. The flat format is well suited for importing into databases, creating CSVs, and managing other row-based solutions. The nested format is well suited for cache keys, internal data structures in memory, and other key-based solutions.

Aggregator 5 - Flat Mode

{
  "log_time_end": 1745002518,
  "log_time_start": 1745002508,
  "stats": [
    {
      "capture_dropped": 0,
      "capture_filtered": 0,
      "discarded": 11,
      "discarded_bytes": 552,
      "ethernet": 83084,
      "flow_dropped": 0,
      "fragmented": 0,
      "icmp": 1,
      "ifname": "wlp1s0",
      "igmp": 0,
      "ip": 83073,
      "ip_bytes": 153700217,
      "largest_bytes": 26130,
      "local_bytes": 151480246,
      "local_packets": 53358,
      "mpls": 0,
      "other_bytes": 2227891,
      "other_packets": 29738,
      "pppoe": 0,
      "queue_dropped": 0,
      "raw": 83084,
      "tcp": 83044,
      "tcp_resets": 2,
      "tcp_seq_errors": 0,
      "udp": 28,
      "vlan": 0,
      "wire_bytes": 155693969
    }
  ]
}

Aggregator 5 - Nested Mode

{
  "log_time_end": 1774718812,
  "log_time_start": 1774718807,
  "stats": {
    "eno1": {
      "capture_dropped": 0,
      "capture_filtered": 0,
      "discarded": 19,
      "discarded_bytes": 1104,
      "ethernet": 135,
      "flow_dropped": 0,
      "fragmented": 0,
      "icmp": 0,
      "ifname": "eno1",
      "igmp": 0,
      "ip": 116,
      "ip_bytes": 38499,
      "largest_bytes": 3990,
      "local_bytes": 9178,
      "local_packets": 60,
      "mpls": 0,
      "other_bytes": 29321,
      "other_packets": 56,
      "pppoe": 0,
      "queue_dropped": 0,
      "raw": 135,
      "tcp": 80,
      "tcp_resets": 0,
      "tcp_seq_errors": 0,
      "udp": 36,
      "vlan": 0,
      "wire_bytes": 41283
    }
  }
}