Device-specific Dimensions

Dimensions that are unique to a specific data source, e.g. a particular router model, are covered in the following topics:

• About Device-specific Dimensions
• A10 Thunder CGN Dimensions
• Cisco ASA Dimensions
• Cisco ASA Syslog Dimensions
• IOS XR Dimensions
• Istio Dimensions
• Juniper PFE Syslog Dimensions
• Palo Alto Networks Firewall
• Silver Peak Dimensions
• VXLAN Dimensions
• sFlow Tunnel Decode Dimensions
• FortiGate Dimensions

Notes:
- The categorization of dimensions in the topics below corresponds to the categories by which the dimensions are shown in the Dimension Selector Dialog (part of the ad hoc filter controls in the Filtering Options dialog).
- Except where noted, the dimensions listed in the tables below are available for both filtering and group-by.
- The value type refers to the data type (text, integer, etc.) of the dimension value.
- The column type refers to whether the dimension is literally stored in KDE (native) or derived at query-time from other KDE-stored information (virtual); see KDE Query Efficiency.
- The KDE name(s) given below, which represent the KDE column(s) corresponding to each dimension, may be used in API queries made with the Query SQL Method.
- As indicated by column type, some columns are native (actually stored in the backend) while others are virtual (derived from other information). In general, filtering with dimensions based on native columns will return results faster than filtering with dimensions based on virtual columns.

Device-specific dimensions originate as flow records that are specific to given types of devices, whether physical or virtual, such as Kubernetes containers, Istio mesh, Palo Alto Networks firewalls, or Cisco ASA appliances. These records are ingested into Kentik as Universal Data Records (UDR), allowing flexible allocation of flow fields to the columns of the Kentik Data Engine. The resulting dimensions are used for filter or group-by like any other fields in Kentik-ingested flow records.

Notes:
- Kentik also stores and uses certain Device-specific Metrics.
- UDR dimensions have no persistent KDE columns.

These dimensions support the NAT NetFlow template that is provided by A10 Thunder Carrier Grade Networking devices (https://www.a10networks.com/products/thunder-cgn/). For more information on CGN, see What is Carrier Grade NAT?

These dimensions are used to filter or group-by on fields in flow records from Cisco Adaptive Security Appliances (ASA), which run Cisco ASA software to deliver enterprise-class firewall capabilities in a variety of form factors including standalone appliances, blades, and virtual appliances. For more context on these dimensions, see the Cisco document ASA NetFlow Implementation Guide.

Note: Syslog from Cisco ASA is ingested into KDE via Kentik's NetFlow Proxy Agent. For further information please contact Customer Support.

Note: See also Cisco ASA Metrics.

These dimensions are used to filter or group-by on KDE fields whose values are extracted at ingest from syslog messages generated by Cisco Adaptive Security Appliances (ASA); see About ASA Syslog Messages. Syslog data may provide additional details that supplement the data available in Cisco ASA NetFlow (see Cisco ASA Dimensions).

Note: Syslog from Cisco ASA is ingested into KDE via Kentik's NetFlow Proxy Agent. For further information please contact Customer Support.

These dimensions are used to filter or group-by on fields in flow records from Cisco products running the IOS XR operating system. These fields contain IPFIX "entity" values as described in IPFIX Information Elements. For additional information, see the Cisco document Configure NetFlow on IOS XR.

These dimensions are used to filter or group-by on KDE fields related to telemetry metrics from Istio, which is an open source insight and control layer that enables you to secure, connect, and monitor the applications that make up a distributed microservices architecture for hybrid and multi-cloud deployments. For an overview of Istio telemetry, see the Istio document Policies and Telemetry.

Note: See also Istio Metrics.

These dimensions represent event-triggered syslog messages from a Juniper switch equipped with a Packet Forwarding Engine (see the Juniper article Informal Guide to Packet Forwarding). If a given switch has multiple PFEs their messages are grouped as if they were from a single PFE. In addition to the dimensions below, the remaining portion of the syslog message may contain information (e.g. MAC address, protocol, IP addresses, and bytes) that is accessible via KDE dimensions that aren't device-specific.

Note: Syslog from Juniper PFE is ingested into KDE via Kentik's NetFlow Proxy Agent. For further information please contact Customer Support.

These dimensions are used to filter or group-by on fields in flow records from Palo Alto Networks firewalls. In addition to the port, IP address, and type of packets, the data identifies the application and includes firewall event information. For more context on these dimensions, see the Palo Alto Networks document NetFlow Templates.

These dimensions are used to filter or group-by on flow records from Silver Peak appliances running VXOA software (version 8.2.1 or higher), which is described in this Silver Peak white paper. Silver Peak analyzes the actual packets as traffic flows through their appliances, identifies the applications (e.g. SaaS service) with which each packet is associated, and prioritizes routing by applying application-specific rules.

These dimensions are used to filter or group-by on IPFIX fields (see IPFIX Information Elements Exported to the Collector) in cflowd records from Cisco SD-WAN SD-WAN routers. For more information about these devices, refer to the Cisco document Cisco SD-WAN vEdge Routers Data Sheet.

These dimensions are used to filter or group-by on fields from the headers of VXLAN-encapsulated packets on virtual networks in data centers. The dimensions are on available for traffic on devices that report flow using sFlow and whose Type (see Device General Settings) is set to "VXLAN."

Note: For information about usage, see Using VXLAN.

These dimensions are used to filter or group-by on fields from the headers of VXLAN-encapsulated packets on virtual networks in data centers. The dimensions are on available for traffic on devices that report flow using sFlow and whose Type (see Device General Settings) is set to "sFlow Tunnel Decode."

Note: For information about usage, see Using VXLAN.

These dimensions are used to filter or group-by on fields from devices whose Type is set in Kentik to "Fortinet FortiGate" (see Device General Settings). The dimensions enabled for these devices store various types of information that is specific to the data fields of NetFlow templates supported by FortiOS.

Notes:
- If the device sends flow to Kentik via kproxy, the kproxy version must be 7.39.0 or higher.
- For more information about Fortinet FortiOS NetFlow templates, see NetFlow templates.