MAC Attributes Telemetry

The MAC Attributes telemetry provides the raw, per device metadata collected locally by the Device Discovery plugin for each MAC address on the network:

DHCP fingerprint, vendor, and hostname
HTTP user agents
JA4 client hashes
mDNS services
SSDP user agents
Observed IP addresses

Flexible Integration

MAC Attributes is designed to give integrators direct access to the raw fingerprinting data collected by the Device Discovery plugin. The telemetry can be streamed into third party fingerprinting platforms such as Lansweeper and Fingerbank, or incorporated directly into your own proprietary data pipelines and device identification systems.

Integrators can also use our turnkey, no code connection to Netify Cloud to build a fully functional device discovery solution in minutes.

Data Policy

A device is included in a MAC Attributes batch once per Agent update interval (default: 15 seconds) whenever new information has been observed. This includes a new IP address, a new or changed DHCP field, or a new entry in its HTTP, JA4, mDNS, or SSDP data. A device's first observed network activity also counts as an update. As a result, a newly discovered device appears in the next batch even if no protocol-specific metadata has been collected yet.

The MAC Attributes stream does not use identification or confidence scoring to determine whether a device should be included. A device continues to appear in the telemetry whenever new information is observed, until it ages out according to max_device_age. It is a straightforward stream of newly observed device metadata. Identification and any associated confidence logic are left to the systems consuming this data.

Example: Send MAC Attributes Telemetry

"sinks": {
  "sink-mqtt": {
    "mac_attributes": {
      "type": "mac_attributes",
      "enable": true,
      "flush": true,
      "format": "json",
      "compressor": "none"
    }
  }
}

Requirements

Install and configure the Netify Agent
Install and configure a Sink Plugin for receiving the telemetry
Install and configure the Device Discovery Plugin
- Configure Sink Targets

Source: Device Discovery Plugin
Plugin Release: 1.2.12

MAC Attributes

dhcp

object

DHCP fingerprint data collected for this device. Present only once DHCP data has been observed.

dhcp.fingerprint

string

The DHCP fingerprint string. Omitted when unknown.

dhcp.hostname

string

The hostname reported via DHCP. Omitted when unknown.

dhcp.vendor

string

The vendor class identifier reported via DHCP. Omitted when unknown.

http

object

HTTP-sourced data collected for this device. Present only once HTTP data has been observed.

http.user_agent_list

array

HTTP User-Agent strings observed for this device.

is_agent_mac

boolean

True when this MAC address belongs to the interface the Agent itself is running on.

is_hardware_mac

boolean

True if the MAC is a burned-in hardware MAC, not a virtual or randomized address.

ip_list

array

Distinct IP addresses observed for this device. Omitted if empty.

client_ja4_list

array

JA4 client fingerprint hashes observed for this device, across TLS, DTLS and QUIC. Omitted if empty.

mdns

object

mDNS-sourced data collected for this device. Present only once mDNS data has been observed.

mdns.answer_list

array

mDNS DNS-SD PTR answer (service instance name) strings observed for this device.

ssdp

object

SSDP-sourced data collected for this device. Present only once SSDP data has been observed. user_agent_list and server_list are each present only once that header has been observed; at least one is present.

ssdp.user_agent_list

array

SSDP USER-AGENT product-token strings observed for this device (M-SEARCH requests).

ssdp.server_list

array

SSDP SERVER product-token strings observed for this device (NOTIFY / M-SEARCH response advertisements).

upnp

object

UPnP-sourced data collected for this device. Present only once UPnP data has been observed. user_agent_list and server_list are each present only once that header has been observed; at least one is present.

upnp.user_agent_list

array

UPnP USER-AGENT product-token strings observed for this device (control point requests).

upnp.server_list

array

UPnP SERVER product-token strings observed for this device (device description/control responses).

MAC Attributes Example

{
  "macs": {
    "ae:63:d5:e8:b8:82": {
      "dhcp": {
        "fingerprint": "1,121,3,6,15,108"
      },
      "ip_list": [
        "fe80::4a5:5677:f88c:bd29",
        "192.168.4.15"
      ],
      "is_agent_mac": false,
      "is_hardware_mac": false,
      "mdns": {
        "answer_list": [
          "MacBook-Air.local"
        ]
      }
    },
    "9c:6b:00:30:a2:f0": {
      "dhcp": {
        "fingerprint": "MSFT 5.0"
      },
      "ip_list": [
        "192.168.88.196"
      ],
      "is_agent_mac": false,
      "is_hardware_mac": true,
      "client_ja4_list": [
        "q13d0313h3_55b375c5d22e_c7319ce65786",
        "t13d3112h2_e8f1e7e78f70_1d7c12b58aec",
        "t13d2013h2_2b729b4bf6f3_e24568c0d440"
      ],
      "ssdp": {
        "user_agent_list": [
          "Chromium/126.0.6478.183 Windows",
          "Chromium/128.0.6613.138 Windows"
        ],
        "server_list": [
          "Linux/3.10.19-22 UPnP/1.0 LG Smart TV/1.0"
        ]
      },
      "upnp": {
        "user_agent_list": [
          "Google Chrome/126.0 (Windows NT 10.0; UPnP/1.0)"
        ],
        "server_list": [
          "Linux/5.4.0 UPnP/1.0 MiniDLNA/1.3.0"
        ]
      }
    }
  },
  "type": "mac_attributes"
}