Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
interface_details
interface_details
Detailed information and stats of network interfaces.
| Column | Type | Description |
|---|---|---|
| collisions | bigint | Packet Collisions detected |
| connection_id | text | Name of the network connection as it appears in the Network Connections Control Panel program. Only available on Windows |
| connection_status | text | State of the network adapter connection to the network. Only available on Windows |
| description | text | Short description of the object a one-line string. Only available on Windows |
| dhcp_enabled | integer | If TRUE, the dynamic host configuration protocol (DHCP) server automatically assigns an IP address to the computer system when establishing a network connection. Only available on Windows |
| dhcp_lease_expires | text | Expiration date and time for a leased IP address that was assigned to the computer by the dynamic host configuration protocol (DHCP) server. Only available on Windows |
| dhcp_lease_obtained | text | Date and time the lease was obtained for the IP address assigned to the computer by the dynamic host configuration protocol (DHCP) server. Only available on Windows |
| dhcp_server | text | IP address of the dynamic host configuration protocol (DHCP) server. Only available on Windows |
| dns_domain | text | Organization name followed by a period and an extension that indicates the type of organization, such as 'microsoft.com'. Only available on Windows |
| dns_domain_suffix_search_order | text | Array of DNS domain suffixes to be appended to the end of host names during name resolution. Only available on Windows |
| dns_host_name | text | Host name used to identify the local computer for authentication by some utilities. Only available on Windows |
| dns_server_search_order | text | Array of server IP addresses to be used in querying for DNS servers. Only available on Windows |
| enabled | integer | Indicates whether the adapter is enabled or not. Only available on Windows |
| flags | integer | Flags (netdevice) for the device |
| friendly_name | text | The friendly display name of the interface. Only available on Windows |
| ibytes | bigint | Input bytes |
| idrops | bigint | Input drops |
| ierrors | bigint | Input errors |
| interface | text | Interface name |
| ipackets | bigint | Input packets |
| last_change | bigint | Time of last device modification (optional) |
| link_speed | bigint | Interface speed in Mb/s Only available on Linux and macOS |
| mac | text | MAC of interface (optional) |
| manufacturer | text | Name of the network adapter's manufacturer. Only available on Windows |
| metric | integer | Metric based on the speed of the interface |
| mtu | integer | Network MTU |
| obytes | bigint | Output bytes |
| odrops | bigint | Output drops |
| oerrors | bigint | Output errors |
| opackets | bigint | Output packets |
| pci_slot | text | PCI slot number Only available on Linux |
| physical_adapter | integer | Indicates whether the adapter is a physical or a logical adapter. Only available on Windows |
| service | text | The name of the service the network adapter uses. Only available on Windows |
| speed | integer | Estimate of the current bandwidth in bits per second. Only available on Windows |
| type | integer | Interface type (includes virtual) |
Example
select interface, mac, type, flags, (1<<3) as loopback_flag from interface_details where (flags & loopback_flag) > 0;
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
