Network Observability

August 17, 2026 · View on GitHub

Background and description

This project aims to establish unified and comprehensive network semantic conventions for OpenTelemetry, enabling traditional network observability methods (like NetFlow, IPFIX, SNMP) to integrate natively into the ecosystem.

Current challenges

Currently, OpenTelemetry's network semantic conventions are sparse and predominantly reflect an application's perspective of its own network activity. This creates a significant gap for network-centric observability, which relies heavily on L3 and L4 attributes for protocols like Netflow, SNMP, and SNMP Trap. Compounding this issue is a general lack of defined network-related metrics and traces, including standardized metrics and flow trace instrumentation within OpenTelemetry eBPF Instrumentation (OBI).

On the collection side, the existing OpenTelemetry collector contrib receivers for Netflow and SNMP lack the necessary functionality to be useful and do not adhere to standard network semantic conventions. Furthermore, there is currently no SNMP trap receiver available in the collector contrib.

Goals, objectives, and requirements

This project makes OpenTelemetry viable for network-centric observability. We will expand core semantic conventions (network, source, destination, dns), define standards for traditional telemetry (Netflow, SNMP), and fix fragmented collector receivers. Acting now prevents the spread of non-standard L3/L4 implementations. This work establishes OpenTelemetry as a unified standard for network engineers and provides foundational network telemetry for other SIGs (like OBI and Entities).

  • Expand, clarify, and maintain core network-related semantic conventions: This includes maintaining the network, source, destination, and dns areas. We will work closely with several SIGs, particularly the main Semantic Conventions SIG, as well as the Entities, System, and OBI SIGs.

  • Define deep network semantic conventions for traditional network telemetry methods: This objective focuses on deep network concepts where we will take advantage of a federated semantic convention repository. Key deliverables include:

    • Defining Netflow metrics and trace spans
    • Defining traceroute / network-path telemetry conventions
    • Defining BGP telemetry conventions
    • Defining standard SNMP metrics
    • Defining standard SNMP trap logs

  • Define and develop network-related entities and attributes: Focus on network entity domains—Traffic (Application; Tunnel/Encapsulation; Control Plane), Forwarders, Endpoints, Forwarding/Data Plane, and Control Planes—by identifying entities within the 7-layer ISO model (in collaboration with the Entities SIG). Entities are groupings of attributes; work includes identifying core network attributes shared across scenarios, plus attributes required for standard instrumentation through OBI and the network receiver. Inventories will iterate as work progresses (Layer 5–7 entities remain to be identified).

  • Stabilize a core set of network semantic conventions and corresponding instrumentations: Not every convention will reach stability, but a primary goal is to find a core set of conventions applicable across multiple scenarios and drive those conventions, and the instrumentations that depend on them, to stability. Stabilizing core and instrumentation attributes is also the path to stable entity definitions. Conventions should be defined with the intent to stabilize as soon as confidence is high, to avoid widely adopted unstable conventions.

  • Provide support and contributions across the broader OpenTelemetry ecosystem: Addressing the objectives above establishes the foundation needed to support and contribute across the broader OpenTelemetry ecosystem. Key examples of these separate but related efforts include:

    • Improving the usability of network-related opentelemetry-collector-contrib receiver components (e.g., snmpreceiver and netflowreceiver) and adding an snmptrapreceiver.
    • Supporting other SIGs (such as OBI) with their network-related telemetry functions.

Deliverables

Near-term:

  1. Review existing attributes within network, source, destination, and dns areas to clarify language and definitions.
  2. Triage and resolve existing open issues related to labels: area:network, area:source, area:destination, and area:dns.
  3. Document the new pattern for source/destination attribute.
  4. Establish a guiding heuristic to dictate what belongs in the system.network vs. network namespace.

Mid-term:

  1. Expand core network attributes (DNS, AS, CIDR, and VPC attribution; network interfaces).
  2. Establish protocol-related metrics (e.g., TCP/UDP proposal, ICMP issue).
  3. Define semantic conventions for flow, path, and routing telemetry:
    • Netflow metrics and netflow trace spans
    • Traceroute / network-path telemetry (hops, hop index, address/hostname/ASN, per-hop RTT, timeouts or unreachable outcomes)
    • BGP telemetry (ASN, advertised and withdrawn prefixes, route updates, and related metrics/log events)
  4. Establish network-related entities and attributes (initial inventory; refine as work progresses):
    • Focus domains: Traffic (Application; Tunnel/Encapsulation; Control Plane), Forwarders, Endpoints, Forwarding/Data Plane, and Control Planes
    • Approach entities via the 7-layer ISO model. Starting points:
      • Layer 2: network interface, OSPF interface, 802.1d bridge, 802.1d bridge port, spanning tree
      • Layer 3: IP subnet, BGP, BGP peer, OSPF, OSPF area, OSPF neighbor
      • Layer 4: service access point (SAP — layer-4 network session/socket), TCP, UDP, session, flow
      • Layers 5–7: still to be identified
    • Identify core network attributes shared across entities and scenarios
    • Identify instrumentation attributes required by OBI and the network receiver
  5. Define semantic conventions for common SNMP MIB objects and SNMP Trap events as OpenTelemetry logs.

Long-term:

  1. Collaborate with the Collector SIG to provide official receivers for Netflow, SNMP, and SNMP Trap.
  2. Collaborate with the OBI SIG to instrument the network, targeting the generation of flow traces and metrics via eBPF.
  3. Stabilize the core network attribute set and the instrumentation attribute set required by OBI and the network receiver, and drive corresponding entity definitions toward stability.
  4. Define SNMP semantic conventions for less-common and vendor-specific MIBs.

Staffing / Help Wanted

SIG

Network

Required staffing

Project Leads(s)

  • Rob Cowart (@robcowart) (affiliation: entities)
  • Sven Cowart (@svencowart) (affiliation: semconv)
  • Antonio Jimenez (@ajimenez1503)
  • Braydon Kains (@braydonk) (affiliation: system + collectors)

Other Staffing

  • Jake Smith (@jksmth)
  • Giuseppe Ognibene (@pinoOgni) (affiliation: obi)
  • Stephen Lang (@skl) (affiliation: obi)
  • Mario Macias (@mariomac) (affiliation: obi)
  • Matthieu Noirbusson (@MatthieuNoirbusson)
  • Henrik Rexed (@henrikrexed)
  • Christian Adell (@chadell)

Sponsorship

TC Sponsor

Liudmila Molkova (@lmolkova)

GC Liaison

Ted Young (@tedsuo)

Expected Timeline

  • Months 1-2: Complete near-term deliverables: review core attributes, triage issues, establish namespace heuristics.
  • Months 3-6: Complete mid-term deliverables: expand attributes, establish protocol and flow metrics, define entities and SNMP standards.
  • Months 7-18: Complete long-term deliverables: collaborate on collector receivers and eBPF instrumentation, stabilize a core set of conventions and corresponding instrumentations/entities once validated, and define vendor-specific MIBs.

Project Board

Network Semantic Conventions and Instrumentation libraries

Labels

  • area:network
  • area:source
  • area:destination
  • area:dns