Why does SNMP exporter show uppercase MAC?

[Elliott Balsley]

Why does SNMP exporter show MAC addresses as uppercase?  For example, using the default snmp.yml with if_mib module I get this:

ifPhysAddress{ifAlias="",ifDescr="eth0",ifIndex="2",ifName="eth0",ifPhysAddress="3C:EC:EF:3C:B1:5E"} 1

Net-snmp tools show these values as lowercase, as does the snmp-exporter README: 

#   PhysAddress48: A 48 bit MAC address, rendered as 00:01:02:03:04:ff.

If you're wondering why this matters... I'm trying to migrate some SNMP configs from Telegraf to the Prometheus SNMP Exporter.  I have a bunch of existing data in Prometheus, so I'm hoping to build the configs such that all my time series continue. Telegraf uses lower-case MACs.

[Elliott Balsley]

I figured out how to change this with relabel_configs so it's just a curiosity.

[Brian Candler]

> Why does SNMP exporter show MAC addresses as uppercase?

That's what the code does:

https://github.com/prometheus/snmp_exporter/blob/v0.28.0/collector/collector.go#L871-L877

        case "PhysAddress48":
                subOid, indexOids := splitOid(indexOids, 6)
                parts := make([]string, 6)
                for i, o := range subOid {
                        parts[i] = fmt.Sprintf("%02X", o)
                }
                return strings.Join(parts, ":"), subOid, indexOids

I don't think there's any standard which says hex MAC addresses should be rendered as uppercase or lowercase, and I've seen both on physical hardware (i.e. switches and routers).

[Ben Kochie]

The only place where I can think of would be in the textual convention RFCs.

* https://www.rfc-editor.org/rfc/rfc1213.html

* https://www.rfc-editor.org/rfc/rfc2579.html

A quick scan doesn't seem to indicate a case preference.

On Wed, Mar 26, 2025 at 9:58 AM 'Brian Candler' via Prometheus Users <promethe...@googlegroups.com> wrote:

> Why does SNMP exporter show MAC addresses as uppercase?

That's what the code does:

https://github.com/prometheus/snmp_exporter/blob/v0.28.0/collector/collector.go#L871-L877

        case "PhysAddress48":
                subOid, indexOids := splitOid(indexOids, 6)
                parts := make([]string, 6)
                for i, o := range subOid {
                        parts[i] = fmt.Sprintf("%02X", o)
                }
                return strings.Join(parts, ":"), subOid, indexOids

I don't think there's any standard which says hex MAC addresses should be rendered as uppercase or lowercase, and I've seen both on physical hardware (i.e. switches and routers).

On Wednesday, 26 March 2025 at 05:25:28 UTC Elliott Balsley wrote:

I figured out how to change this with relabel_configs so it's just a curiosity.

On Tuesday, March 25, 2025 at 6:28:38 PM UTC-7 Elliott Balsley wrote:

Why does SNMP exporter show MAC addresses as uppercase?  For example, using the default snmp.yml with if_mib module I get this:

ifPhysAddress{ifAlias="",ifDescr="eth0",ifIndex="2",ifName="eth0",ifPhysAddress="3C:EC:EF:3C:B1:5E"} 1

Net-snmp tools show these values as lowercase, as does the snmp-exporter README: 

#   PhysAddress48: A 48 bit MAC address, rendered as 00:01:02:03:04:ff.

If you're wondering why this matters... I'm trying to migrate some SNMP configs from Telegraf to the Prometheus SNMP Exporter.  I have a bunch of existing data in Prometheus, so I'm hoping to build the configs such that all my time series continue. Telegraf uses lower-case MACs.

--
You received this message because you are subscribed to the Google Groups "Prometheus Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to prometheus-use...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/prometheus-users/2b82d181-165c-4c04-b0cf-75acaa4cfa3fn%40googlegroups.com.

[Brian Candler]

I note that the IEEE's official list of assigned OUIs uses capitals (but not colons).

https://standards-oui.ieee.org/oui/oui.txt

For SNMP,  it boils down to the interpretation of DISPLAY-HINT "1x:" and I don't see any guidance on rendering hex characters.

It does say "For all types, when rendering the value, leading zeros are omitted" which to me suggests that :00: should be rendered as :0: - but that's a different issue.

[Brian Candler]

Actually, net-snmp does drop leading zeros.

# snmpbulkwalk gw1 ifPhysAddress
...
IF-MIB::ifPhysAddress.33 = STRING: 0:0:5e:0:1:1
IF-MIB::ifPhysAddress.34 = STRING: 0:0:0:0:0:0
...