Metrics & Dimensions

Metrics and dimensions are collected or derived from network data (flow, SNMP, BGP, etc.), stored in the Kentik Data Engine (KDE), and used in the portal (and Kentik APIs) as group-by and filtering parameters in Kentik queries. Metrics and dimensions are discussed in the following topics:

• About Metrics
• Metrics in the Portal
• Metrics Reference
• About Dimensions
• Dimensions in the Portal
• Dimensions Reference
• Host Traffic Dimensions

A metric is a combination of a unit (e.g. a bit) with a method of calculation (e.g. average per second) to create a quantifiable measurement (average bits/second). In Kentik, metrics represent measurements made on flows, which are used for counts, rankings (e.g. in a top-X list), and thresholds (e.g. in alerting).

Notes:
- For metrics that aren't transmitted via a flow protocol, see Non-flow Metrics.
- For metrics that are device-specific, see Device-specific Metrics.
- Some metrics that are stored as part of the flow records in KDE may be used as dimensions (see Per-flow Metrics.
- In addition to being used for query settings in the Kentik portal, metrics and dimensions are also used for the Query API.

The following table shows the main places in the Kentik portal where metrics are specified and used:

The KB’s Metrics Reference documents the metrics available for Kentik queries. In general, metrics are available in queries involving traffic from all types of devices (routers, hosts, etc.; see Supported Device Types), though some metrics apply only to traffic from host agents such as kprobe (see About kprobe).

Metrics, which each represent an actual or derived column in the tables of the KDE (see KDE Tables) fall into the following functional categories:

Notes:
- Use the links in the Category column above to see lists of the specific metrics in each of the above categories.
- For more detailed information about metrics requiring a host agent, see Host Traffic Metrics.

Dimensions in Kentik represent specific data about flow (see Flow Overview). This data is either taken directly from flow records (e.g. NetFlow, sFlow), incorporated from correlated sources (e.g. GeoIP or threat feeds), or derived by Kentik from some combination of the two. Each dimension represents an actual or derived column in the tables of the KDE (see KDE Tables).

Dimensions are primarily used in the following contexts in the Kentik portal and the Query API:

• Group-by dimensions: Selected via the Dimension Selectors in a Dimensions pane (e.g. in the Query sidebar in Data Explorer).
• Filters: Selected in the Filtering Options Dialog in a Filtering pane (e.g. in the Query sidebar in Data Explorer).

The following table shows more specifically the various locations in the Kentik portal where dimensions are specified and used:

The KB’s Dimensions Reference documents the dimensions available for group-by and filtering in Kentik queries. In general, dimensions are available in queries involving traffic from all types of devices (routers, hosts, etc.; see Supported Device Types), though some dimensions apply only to traffic from host agents such as kprobe (see About kprobe).

Dimensions, which each represent an actual or derived column in the tables of the KDE (see KDE Tables) fall into the following functional categories:

Notes:
- Use the links in the Category column above to see lists of the specific dimensions in each of the above categories.
- For more detailed information about dimensions requiring a host agent, see Host Traffic Dimensions.

While most dimensions are available (for both group-by and filters) on traffic from all devices, the following dimensions are available only for traffic from kprobe, Kentik's software host agent (see About kprobe):

• DNS Query: A query from a DNS resolver to a DNS name server that translates a user-friendly domain name (e.g. www.domain_name.com) to a numeric IP address, either 32-bit IPv4 (93.184.216.119) or 128-bit IPv6 (2606:2800:220:6d:26bf:1447:1097:aa7).
• DNS Query Type: The resource record type requested by the DNS query. For a list of record types, see https://en.wikipedia.org/wiki/List_of_DNS_record_types.
• DNS Response: The response from a DNS server to a DNS query. DNS responses are comprised of resource records (RRs). kprobe collects information from the following RRs:
  - A: IPv4 address for given host.
  - AAAA: IPv6 address for given host.
  - CNAME: A domain name that must be queried to resolve the original DNS query.
  - PTR: Used to look up a domain name based on an IP address.
  - MX: A mail exchange server for a DNS domain name.
  - NS: An authoritative name server for given host.
  - TXT: A non-formatted text string typically used by Sender Policy Framework (SPF) to prevent the sending of emails using a fake identity.
• DNS Return Code: Status code returned from a DNS query (see https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6).
• HTTP Host Header: A mandatory HTTP header field that identifies the domain name of the server.
• HTTP Referrer: A non-mandatory HTTP header field that identifies the address from which a destination webpage is requested. Logging referrers allows websites to keep track of how users arrive at a page.
• HTTP Return Code: Status codes defined in the following document: https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
• HTTP User Agent: A non-mandatory HTTP header field that identifies the client that submitted a request. User agent information, such as operating system and browser software, helps websites determine how content will be displayed.
• HTTP URL: The filename portion of a path to a web resource, with query string (if any).

Note: Kentik supports the matching of substrings in the values of certain host-sourced group-by dimensions (see DNS/WWW Extract Function).