Destination

Destination Attributes

Attributes:

Key	Stability	Value Type	Description	Example Values
destination.address		string	Destination address as observed at the point of instrumentation - typically an IP address, or a UNIX domain socket name; a domain name only when the receiver was addressed by name (for example a peer-to-peer node dialed by hostname), never obtained via reverse DNS lookup. [1]	10.1.2.80; destination.example.com; /tmp/my.sock
destination.as.number		int	The Autonomous System Number (ASN) associated with the destination IP address. [2]	64496; 15169
destination.as.organization		string	The name of the organization associated with the autonomous system of the destination IP address. [3]	Example Networks Inc.; Google LLC
destination.mac.address		string	Destination Media Access Control (MAC) address. [4]	00-00-5E-00-53-23
destination.port		int	Destination port number	3389; 2888
destination.prefix		string	The IP prefix associated with the destination IP address, in CIDR notation. [5]	192.0.2.0/24; 2001:db8::/32

[1] destination.address: destination.address SHOULD be the receiver address as observed at the point of instrumentation, for example the destination of the packet, flow, or exchange seen on the wire or socket. Instrumentation SHOULD capture the available address and SHOULD NOT try to resolve the address behind intermediaries such as proxies or load balancers, or perform a reverse DNS lookup to obtain a domain name.

[2] destination.as.number: This attribute SHOULD only be set when the destination address is an IP address and the ASN is available from routing, enrichment, or lookup data. The value SHOULD be represented as an integer without the AS prefix.

[3] destination.as.organization: This attribute SHOULD only be set when destination.as.number is set and the organization name is available. The value SHOULD be the organization name as provided by the lookup or enrichment source, not the AS name or short code.

[4] destination.mac.address: MAC addresses MUST be represented in IEEE RA hexadecimal form: as hyphen-separated octets in uppercase hexadecimal form from most to least significant.

[5] destination.prefix:

The value MUST be an IPv4 or IPv6 network prefix in CIDR notation, as defined in RFC 4632 for IPv4 and RFC 4291 for IPv6. IPv4 prefixes MUST use a dotted-decimal address followed by / and a decimal prefix length from 0 to 32. IPv6 prefixes MUST use the canonical address text representation defined in RFC 5952, followed by / and a decimal prefix length from 0 to 128. All host bits in the address MUST be set to zero. The value MUST NOT contain a domain name, UNIX domain socket name, or IPv6 zone identifier.

Instrumentation or Collector receivers that populate this attribute MUST convert native representations, such as an address and subnet mask or an address and prefix length, to equivalent CIDR notation before emitting it.

This attribute MAY be set whether or not destination.address is set. If destination.address is also set to an IP address, it MUST use the same IP version and be contained in this prefix.