This article discusses general (i.e. flow) metrics used in Kentik queries.
Notes:
For general metric information, see About Metrics.
For non-flow metrics, see Non-flow Metrics.
For device-specific metrics, see Device-specific Metrics.
Filter and group-by dimensions are covered in Dimensions Reference (see Per-flow Metrics).
Metrics are used for Kentik portal query settings and the Query API.
About General Metrics
In Kentik, general metrics are transmitted via flow protocols like NetFlow or sFlow and aren’t tied to specific devices. Their availability in settings like the Metrics Pane of the Query sidebar in Data Explorer depends on the device category (Router or Host) and the specific device type (see Supported Device Types).
Metrics from All Devices
When a query includes traffic solely from data sources (see About Data Sources) in the "Routers" category, only the following metrics are available:
Metric in portal | Variations | Calculated as... | Derived from KDE column(s) |
---|---|---|---|
Bits per second | Sampled at:
|
| in_bytes, |
Packets per second | Sampled at:
|
| in_pkts, |
Flows per second | N.A. |
| Based on rows per KDE main table |
Source IPs |
|
| inet_src_addr |
Destination IPs |
|
| inet_dst_addr |
Unique Route Prefixes |
|
| inet_src_route_prefix, |
Unique Ports |
|
| inet_src_route_prefix, |
Unique ASNs |
|
| src_as, |
Unique Countries |
|
| src_geo, |
Unique Regions |
|
| src_geo_region, |
Unique Cities |
|
| src_geo_city, |
Sample rate |
|
| sample_rate |
Notes:
The “Total” metric is available only when the chart type is set to Table or Matrix (see Chart View Types).
Metrics labeled as "unique" are evaluated across all instances on queried devices within each individual time slice of the query's time range, but not between different time slices (see Table Time-slicing).
Host Traffic Metrics
When querying traffic that includes devices in the "Host" category (using Kentik’s host agent, see About the Universal Agent), the data from these hosts is stored in KDE.
Host Metrics by Protocol
The availability of a given metric varies by protocol:
Metric in portal | TCP | HTTP | DNS | Calculated as... | Derived from KDE column(s) |
---|---|---|---|---|---|
Retransmits |
|
| N.A. |
| retransmitted_out_pkts, repeated_retransmits, |
Out-of-order packets |
|
| N.A. |
| ooorder_in_pkts, |
Fragments |
|
|
|
| fragments, |
Zero Windows |
|
| N.A. |
| zero_windows |
Receive Window | N.A. | N.A. | N.A. |
| receive_window |
Latency |
|
|
|
| client_nw_latency_ms, |
Note: The “Total” metric is available only when the chart type is set to Table or Matrix (see Chart View Types).
Host Metrics Descriptions
The following descriptions apply to the host-only metrics listed in the table above:
Retransmits: Packets re-sent from source to destination, applicable to reliable protocols like TCP.
Indicates network delivery issues affecting performance.
Measured per second and as a percentage of all packets sent.
Note: "Repeated" refers to packets retransmitted 3 or more times.
Out of order: Packets arriving out of sequence.
High values suggest variability in delivery paths, impacting latency-sensitive traffic like real-time audio/video.
Measured per second and as a percentage of all packets sent.
Fragments/second: Packets split into smaller packets for network delivery.
Fragmentation can increase CPU load and cause retransmits if fragments arrive out-of-order.
Measured per second and as a percentage of all packets sent.
Zero Windows: Count of TCP receive windows with a value of zero, indicating a full buffer.
Receive Window: Size of the TCP receive window.
Latency: Various measures include:
RTT/2 client latency (derived): One-way latency from the client perspective. High values indicate network or server-side issues
RTT/2 server latency (derived): One-way latency from the server perspective. High values indicate network or client-side issues.
RTT/2 application latency (derived): Derived from request/response pairs at the application layer, indicating end-user experience latency. Effective for protocols with clear request/response pairings.
First Payload Exchange Latency: Measures application response time when the protocol isn't understood or can’t be decoded (e.g., HTTPS, SQL). Excludes TCP setup, starting with the first packet sent and ending with the first packet returned.
Host Metrics KDE Columns
The following table shows the correspondence between the metrics described above and the columns of the Kentik Data Engine (KDE):
Metric in portal | Type: | Derived from KDE column(s) |
---|---|---|
Retransmits | bigint | retransmitted_out_pkts, repeated_retransmits, |
Out-of-order packets | bigint | ooorder_in_pkts, |
Fragments | bigint | fragments, |
Zero Windows | bigint | zero_windows |
Receive Window | bigint | receive_window |
Latency | bigint | client_nw_latency_ms, |
Application Decodes Metrics
When using Kentik's software host agent for application decodes (see About Application Decodes), both dimensions and metrics are generated and stored in or derived from KDE columns. The metrics available for queries via the metric selector (see Metrics Dialog UI) include:
Metric in portal | Description | Type: |
---|---|---|
Connection Name | TCP connection ID. | bigint |
Application Latency | One-way network latency derived by examining request/response pairs at the application layer. | bigint |
FPEX Latency | Elapsed time from first packet sent to first packet returned. | bigint |
Note: For dimensions related to application decodes, see Application Decodes Dimensions.
Legacy Application Decodes Metrics
The "legacy" metrics in the table below are from older versions (<v1.3.0) of Kentik’s legacy host software agent, kprobe:
Metric in portal | Description | Type: | KDE name(s) |
---|---|---|---|
Connection ID | TCP connection ID.
| bigint | connection_id |
Application Latency (ms) | One-way network latency derived by examining request/response pairs at the application layer. | bigint | appl_latency_ms |
First Payload Exchange Latency (ms) | Elapsed time from first packet sent to first packet returned.
| bigint | fpex_latency_ms |
© 2014-25 Kentik