# Network
Site [llms.txt](/llms.txt)
---
- [Network Attributes](#network-attributes)
- [Deprecated Network Attributes](#deprecated-network-attributes)
## Network Attributes
These attributes may be used for any network related operation.
**Attributes:**
| Key | Stability | Value Type | Description | Example Values |
| --- | --- | --- | --- | --- |
| `network.carrier.icc` |  | string | The ISO 3166-1 alpha-2 2-character country code associated with the mobile carrier network. | `DE` |
| `network.carrier.mcc` |  | string | The mobile carrier country code. | `310` |
| `network.carrier.mnc` |  | string | The mobile carrier network code. | `001` |
| `network.carrier.name` |  | string | The name of the mobile carrier. | `sprint` |
| `network.connection.state` |  | string | The state of network connection [1] | `close_wait` [(see more)](#network-connection-state-values) |
| `network.connection.subtype` |  | string | This describes more details regarding the connection.type. It may be the type of cell technology connection, but it could be used for describing details about a Wi-Fi connection. | `LTE` [(see more)](#network-connection-subtype-values) |
| `network.connection.type` |  | string | The internet connection type. | `wifi` [(see more)](#network-connection-type-values) |
| `network.interface.name` |  | string | The network interface name. | `lo`; `eth0` |
| `network.io.direction` |  | string | The direction of traffic from the perspective of the observing host's physical or virtual network interface. It should not be used to represent the logical direction of a stateful connection or network flow. | `transmit` [(see more)](#network-io-direction-values) |
| `network.local.address` |  | string | Local address of the network connection - IP address or UNIX domain socket name. | `10.1.2.80`; `/tmp/my.sock` |
| `network.local.as.number` |  | int | The [Autonomous System Number (ASN)](https://www.iana.org/assignments/as-numbers/as-numbers.xhtml) associated with the local IP address. [2] | `64496`; `15169` |
| `network.local.as.organization` |  | string | The name of the organization associated with the autonomous system of the local IP address. [3] | `Example Networks Inc.`; `Google LLC` |
| `network.local.mac.address` |  | string | Local Media Access Control (MAC) address of the network connection. [4] | `00-00-5E-00-53-23` |
| `network.local.port` |  | int | Local port number of the network connection. | `65123` |
| `network.local.prefix` |  | string | The IP prefix associated with the local IP address, in CIDR notation. [5] | `192.0.2.0/24`; `2001:db8::/32` |
| `network.peer.address` |  | string | Peer address of the network connection - IP address or UNIX domain socket name. | `10.1.2.80`; `/tmp/my.sock` |
| `network.peer.as.number` |  | int | The [Autonomous System Number (ASN)](https://www.iana.org/assignments/as-numbers/as-numbers.xhtml) associated with the peer IP address. [6] | `64496`; `15169` |
| `network.peer.as.organization` |  | string | The name of the organization associated with the autonomous system of the peer IP address. [7] | `Example Networks Inc.`; `Google LLC` |
| `network.peer.mac.address` |  | string | Peer Media Access Control (MAC) address of the network connection. [8] | `00-00-5E-00-53-23` |
| `network.peer.port` |  | int | Peer port number of the network connection. | `65123` |
| `network.peer.prefix` |  | string | The IP prefix associated with the peer IP address, in CIDR notation. [9] | `192.0.2.0/24`; `2001:db8::/32` |
| `network.protocol.name` |  | string | [OSI application layer](https://wikipedia.org/wiki/Application_layer) or non-OSI equivalent. [10] | `amqp`; `http`; `mqtt` |
| `network.protocol.version` |  | string | The actual version of the protocol used for network communication. [11] | `1.1`; `2` |
| `network.transport` |  | string | [OSI transport layer](https://wikipedia.org/wiki/Transport_layer) or [inter-process communication method](https://wikipedia.org/wiki/Inter-process_communication). [12] | `tcp`; `udp` [(see more)](#network-transport-values) |
| `network.type` |  | string | [OSI network layer](https://wikipedia.org/wiki/Network_layer) or non-OSI equivalent. [13] | `ipv4`; `ipv6` [(see more)](#network-type-values) |
**[1] `network.connection.state`:** Connection states are defined as part of the [rfc9293](https://datatracker.ietf.org/doc/html/rfc9293#section-3.3.2)
**[2] `network.local.as.number`:** This attribute SHOULD only be set when the local address is an IP address and the ASN is available from routing, enrichment, or lookup data. The value SHOULD be represented as an integer without the `AS` prefix.
**[3] `network.local.as.organization`:** This attribute SHOULD only be set when `network.local.as.number` is set and the organization name is available. The value SHOULD be the organization name as provided by the lookup or enrichment source, not the AS name or short code.
**[4] `network.local.mac.address`:** MAC addresses MUST be represented in [IEEE RA hexadecimal form](https://standards.ieee.org/wp-content/uploads/import/documents/tutorials/eui.pdf):
as hyphen-separated octets in uppercase hexadecimal form from most to least significant.
> [!WARNING]
>
> This attribute may contain sensitive (PII) information.
**[5] `network.local.prefix`:**
> [!WARNING]
>
> This attribute may contain sensitive (PII) information. A `/32` IPv4 prefix
> or `/128` IPv6 prefix preserves the complete endpoint IP address.
> Using CIDR notation does not guarantee that the data is anonymous.
The value MUST be an IPv4 or IPv6 network prefix in CIDR notation, as defined in
[RFC 4632](https://www.rfc-editor.org/rfc/rfc4632.html) for IPv4 and
[RFC 4291](https://www.rfc-editor.org/rfc/rfc4291.html#section-2.3) for IPv6.
IPv4 prefixes MUST use a dotted-decimal address followed by `/` and a decimal
prefix length from 0 to 32. IPv6 prefixes MUST use the canonical address text
representation defined in [RFC 5952](https://www.rfc-editor.org/rfc/rfc5952.html),
followed by `/` and a decimal prefix length from 0 to 128. All host bits in
the address MUST be set to zero. The value MUST NOT contain a domain name,
UNIX domain socket name, or IPv6 zone identifier.
Instrumentation or Collector receivers that populate this attribute MUST
convert native representations, such as an address and subnet mask or an
address and prefix length, to equivalent CIDR notation before emitting it.
This attribute MAY be set whether or not `network.local.address` is set. If
`network.local.address` is also set to an IP address, it MUST use the same IP version
and be contained in this prefix.
**[6] `network.peer.as.number`:** This attribute SHOULD only be set when the peer address is an IP address and the ASN is available from routing, enrichment, or lookup data. The value SHOULD be represented as an integer without the `AS` prefix.
**[7] `network.peer.as.organization`:** This attribute SHOULD only be set when `network.peer.as.number` is set and the organization name is available. The value SHOULD be the organization name as provided by the lookup or enrichment source, not the AS name or short code.
**[8] `network.peer.mac.address`:** MAC addresses MUST be represented in [IEEE RA hexadecimal form](https://standards.ieee.org/wp-content/uploads/import/documents/tutorials/eui.pdf):
as hyphen-separated octets in uppercase hexadecimal form from most to least significant.
> [!WARNING]
>
> This attribute may contain sensitive (PII) information.
**[9] `network.peer.prefix`:**
> [!WARNING]
>
> This attribute may contain sensitive (PII) information. A `/32` IPv4 prefix
> or `/128` IPv6 prefix preserves the complete endpoint IP address.
> Using CIDR notation does not guarantee that the data is anonymous.
The value MUST be an IPv4 or IPv6 network prefix in CIDR notation, as defined in
[RFC 4632](https://www.rfc-editor.org/rfc/rfc4632.html) for IPv4 and
[RFC 4291](https://www.rfc-editor.org/rfc/rfc4291.html#section-2.3) for IPv6.
IPv4 prefixes MUST use a dotted-decimal address followed by `/` and a decimal
prefix length from 0 to 32. IPv6 prefixes MUST use the canonical address text
representation defined in [RFC 5952](https://www.rfc-editor.org/rfc/rfc5952.html),
followed by `/` and a decimal prefix length from 0 to 128. All host bits in
the address MUST be set to zero. The value MUST NOT contain a domain name,
UNIX domain socket name, or IPv6 zone identifier.
Instrumentation or Collector receivers that populate this attribute MUST
convert native representations, such as an address and subnet mask or an
address and prefix length, to equivalent CIDR notation before emitting it.
This attribute MAY be set whether or not `network.peer.address` is set. If
`network.peer.address` is also set to an IP address, it MUST use the same IP version
and be contained in this prefix.
**[10] `network.protocol.name`:** The value SHOULD be normalized to lowercase.
**[11] `network.protocol.version`:** If protocol version is subject to negotiation (for example using [ALPN](https://www.rfc-editor.org/rfc/rfc7301.html)), this attribute SHOULD be set to the negotiated version. If the actual protocol version is not known, this attribute SHOULD NOT be set.
**[12] `network.transport`:** The value SHOULD be normalized to lowercase.
Consider always setting the transport when setting a port number, since
a port number is ambiguous without knowing the transport. For example
different processes could be listening on TCP port 12345 and UDP port 12345.
**[13] `network.type`:** The value SHOULD be normalized to lowercase.
---
`network.connection.state` has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.
| Value | Description | Stability |
| --- | --- | --- |
| `close_wait` | close_wait |  |
| `closed` | closed |  |
| `closing` | closing |  |
| `established` | established |  |
| `fin_wait_1` | fin_wait_1 |  |
| `fin_wait_2` | fin_wait_2 |  |
| `last_ack` | last_ack |  |
| `listen` | listen |  |
| `syn_received` | syn_received |  |
| `syn_sent` | syn_sent |  |
| `time_wait` | time_wait |  |
---
`network.connection.subtype` has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.
| Value | Description | Stability |
| --- | --- | --- |
| `cdma` | CDMA |  |
| `cdma2000_1xrtt` | CDMA2000 1XRTT |  |
| `edge` | EDGE |  |
| `ehrpd` | EHRPD |  |
| `evdo_0` | EVDO Rel. 0 |  |
| `evdo_a` | EVDO Rev. A |  |
| `evdo_b` | EVDO Rev. B |  |
| `gprs` | GPRS |  |
| `gsm` | GSM |  |
| `hsdpa` | HSDPA |  |
| `hspa` | HSPA |  |
| `hspap` | HSPAP |  |
| `hsupa` | HSUPA |  |
| `iden` | IDEN |  |
| `iwlan` | IWLAN |  |
| `lte` | LTE |  |
| `lte_ca` | LTE CA |  |
| `nr` | 5G NR (New Radio) |  |
| `nrnsa` | 5G NRNSA (New Radio Non-Standalone) |  |
| `td_scdma` | TD-SCDMA |  |
| `umts` | UMTS |  |
---
`network.connection.type` has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.
| Value | Description | Stability |
| --- | --- | --- |
| `cell` | cell |  |
| `unavailable` | unavailable |  |
| `unknown` | unknown |  |
| `wifi` | Wi-Fi |  |
| `wired` | wired |  |
---
`network.io.direction` has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.
| Value | Description | Stability |
| --- | --- | --- |
| `receive` | receive |  |
| `transmit` | transmit |  |
---
`network.transport` has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.
| Value | Description | Stability |
| --- | --- | --- |
| `pipe` | Named or anonymous pipe. |  |
| `quic` | QUIC |  |
| `tcp` | TCP |  |
| `udp` | UDP |  |
| `unix` | UNIX domain socket |  |
---
`network.type` has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.
| Value | Description | Stability |
| --- | --- | --- |
| `ipv4` | IPv4 |  |
| `ipv6` | IPv6 |  |
## Deprecated Network Attributes
These attributes may be used for any network related operation.
**Attributes:**
| Key | Stability | Value Type | Description | Example Values |
| --- | --- | --- | --- | --- |
| `net.host.ip` | 
Replaced by `network.local.address`. | string | Deprecated, use `network.local.address`. | `192.168.0.1` |
| `net.host.name` | 
Replaced by `server.address`. | string | Deprecated, use `server.address`. | `example.com` |
| `net.host.port` | 
Replaced by `server.port`. | int | Deprecated, use `server.port`. | `8080` |
| `net.peer.ip` | 
Replaced by `network.peer.address`. | string | Deprecated, use `network.peer.address`. | `127.0.0.1` |
| `net.peer.name` | 
Replaced by `server.address` on client spans and `client.address` on server spans. | string | Deprecated, use `server.address` on client spans and `client.address` on server spans. | `example.com` |
| `net.peer.port` | 
Replaced by `server.port` on client spans and `client.port` on server spans. | int | Deprecated, use `server.port` on client spans and `client.port` on server spans. | `8080` |
| `net.protocol.name` | 
Replaced by `network.protocol.name`. | string | Deprecated, use `network.protocol.name`. | `amqp`; `http`; `mqtt` |
| `net.protocol.version` | 
Replaced by `network.protocol.version`. | string | Deprecated, use `network.protocol.version`. | `3.1.1` |
| `net.sock.family` | 
Split to `network.transport` and `network.type`. | string | Deprecated, use `network.transport` and `network.type`. | `inet`; `inet6`; `unix` [(see more)](#net-sock-family-values) |
| `net.sock.host.addr` | 
Replaced by `network.local.address`. | string | Deprecated, use `network.local.address`. | `/var/my.sock` |
| `net.sock.host.port` | 
Replaced by `network.local.port`. | int | Deprecated, use `network.local.port`. | `8080` |
| `net.sock.peer.addr` | 
Replaced by `network.peer.address`. | string | Deprecated, use `network.peer.address`. | `192.168.0.1` |
| `net.sock.peer.name` | 
Removed. No replacement at this time. | string | Deprecated, no replacement at this time. | `/var/my.sock` |
| `net.sock.peer.port` | 
Replaced by `network.peer.port`. | int | Deprecated, use `network.peer.port`. | `65531` |
| `net.transport` | 
Replaced by `network.transport`. | string | Deprecated, use `network.transport`. | `ip_tcp`; `ip_udp`; `pipe` [(see more)](#net-transport-values) |
---
`net.sock.family` has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.
| Value | Description | Stability |
| --- | --- | --- |
| `inet` | IPv4 address |  |
| `inet6` | IPv6 address |  |
| `unix` | UNIX domain socket path |  |
---
`net.transport` has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.
| Value | Description | Stability |
| --- | --- | --- |
| `inproc` | In-process communication. [14] |  |
| `ip_tcp` | ip_tcp |  |
| `ip_udp` | ip_udp |  |
| `other` | Something else (non IP-based). |  |
| `pipe` | Named or anonymous pipe. |  |
**[14]:** Signals that there is only in-process communication not using a "real" network protocol in cases where network attributes would normally be expected. Usually all other network attributes can be left out in that case.