Source

Source Attributes

Attributes:

Key	Stability	Value Type	Description	Example Values
source.address		string	Source address as observed at the point of instrumentation - typically an IP address, or a UNIX domain socket name; a domain name only when the sender was addressed by name (for example a peer-to-peer node dialed by hostname), never obtained via reverse DNS lookup. [1]	10.1.2.80; source.example.com; /tmp/my.sock
source.as.number		int	The Autonomous System Number (ASN) associated with the source IP address. [2]	64496; 15169
source.as.organization		string	The name of the organization associated with the autonomous system of the source IP address. [3]	Example Networks Inc.; Google LLC
source.mac.address		string	Source Media Access Control (MAC) address. [4]	00-00-5E-00-53-23
source.port		int	Source port number	3389; 2888
source.prefix		string	The IP prefix associated with the source IP address, in CIDR notation. [5]	192.0.2.0/24; 2001:db8::/32

[1] source.address: source.address SHOULD be the sender address as observed at the point of instrumentation, for example the source of the packet, flow, or exchange seen on the wire or socket. Instrumentation SHOULD capture the available address and SHOULD NOT try to resolve the address behind intermediaries such as proxies or load balancers, or perform a reverse DNS lookup to obtain a domain name.

[2] source.as.number: This attribute SHOULD only be set when the source address is an IP address and the ASN is available from routing, enrichment, or lookup data. The value SHOULD be represented as an integer without the AS prefix.

[3] source.as.organization: This attribute SHOULD only be set when source.as.number is set and the organization name is available. The value SHOULD be the organization name as provided by the lookup or enrichment source, not the AS name or short code.

[4] source.mac.address: MAC addresses MUST be represented in IEEE RA hexadecimal form: as hyphen-separated octets in uppercase hexadecimal form from most to least significant.

[5] source.prefix:

The value MUST be an IPv4 or IPv6 network prefix in CIDR notation, as defined in RFC 4632 for IPv4 and RFC 4291 for IPv6. IPv4 prefixes MUST use a dotted-decimal address followed by / and a decimal prefix length from 0 to 32. IPv6 prefixes MUST use the canonical address text representation defined in RFC 5952, followed by / and a decimal prefix length from 0 to 128. All host bits in the address MUST be set to zero. The value MUST NOT contain a domain name, UNIX domain socket name, or IPv6 zone identifier.

Instrumentation or Collector receivers that populate this attribute MUST convert native representations, such as an address and subnet mask or an address and prefix length, to equivalent CIDR notation before emitting it.

This attribute MAY be set whether or not source.address is set. If source.address is also set to an IP address, it MUST use the same IP version and be contained in this prefix.