Network Interfaces & IP Configuration Inventory

For every managed machine, Athena inventories each network adapter and how it is configured — its IPv4 and IPv6 addresses, subnet mask, default gateway, DNS servers, MAC address, whether it uses DHCP or a static address, its link speed and MTU, and whether the link is up. This gives you a fleet-wide answer to "what IP is that machine on, on which adapter, and how is it addressed?" without logging on to each endpoint — useful for network audits, troubleshooting connectivity, and confirming addressing before a change.

This is read-only discovery. Athena reports how each machine's adapters are already configured; it does not assign IP addresses, change DHCP/static settings, edit DNS, or enable and disable adapters. To make a change, run a remote command or a deployment that applies it on the endpoint.

What's collected#

For each machine, Athena records every non-loopback network interface and, for each interface, the following:

Field	Meaning
Interface	The adapter name — for example `Ethernet` or `Wi-Fi` on Windows, or `eth0` / `ens160` on Linux.
Address Type	Whether the adapter obtains its address by DHCP or is configured Static.
IP Address	The interface's primary address. The full set of assigned addresses is available as separate IPv4 and IPv6 lists over the API (see Reading it over the API).
Subnet Mask	The subnet mask for the interface, when available.
Default Gateway	The default gateway configured on the interface, when available.
DNS Servers	The DNS servers configured for the interface.
MAC Address	The adapter's hardware (physical) address.
Speed	The negotiated link speed, formatted for readability — for example `1 Gbps`, `10 Gbps`, or `100 Mbps`. Shown as `-` when the adapter does not report a speed.
MTU	The interface's maximum transmission unit, when available.
Status	Whether the link is currently Up or Down.

Loopback adapters are excluded. The inventory lists physical and virtual network adapters the machine uses to reach the network; the local loopback interface is not reported, so the list reflects real connectivity rather than internal plumbing.

Platform coverage#

Network interfaces are collected on both Windows and Linux endpoints, using each operating system's native facilities, so a mixed fleet answers the same question consistently. On both platforms the adapter name, MAC address, assigned IPv4/IPv6 addresses, link status, speed and MTU are reported. The DHCP-vs-static and DNS details are read from the machine's native network configuration on each operating system; on Linux this determination is best-effort across the common network managers, so an adapter may occasionally be shown as static where a live query would resolve more detail.

Where to see it#

Open a machine from the Agents list, then in the agent detail view's left-hand navigation choose Network Interfaces under the Network heading. The section lists every adapter in a table with columns for Interface, Address Type (a DHCP or Static badge), IP Address, Subnet Mask, Default Gateway, DNS Servers, MAC Address, Speed, MTU, and Status (an up/down indicator).

Like the rest of inventory, the values reflect the machine's last successful collection on its regular reporting cadence rather than a live query at open time. For the wider inventory surface and refresh behaviour, see Inventory.

Scope note. Network interfaces are a per-machine inventory field, viewed on a machine's detail view. They are not currently one of the fields you can build a dynamic collection, an automatic tag, or a report-builder column from. If you need a fleet-wide rule (for example, "flag any machine whose adapter is on the wrong subnet"), evaluate it on the endpoint with a compliance rule or a custom scan and surface the answer through the scan results — which you can then use in collections, tagging, and reports like any other collected field.

Reading it over the API#

Network interfaces are part of an agent's full inventory. Fetch the complete inventory document and read the networkInterfaces array for per-adapter detail:

# Fetch the full inventory for one agent, then inspect its network adapters
$headers = @{ Authorization = "Bearer $token" }

$inv = Invoke-RestMethod `
  -Uri "https://athena.example.com:8443/api/agents/$agentId/inventory" `
  -Headers $headers `
  -SkipCertificateCheck

# List every adapter with its address, MAC, speed and link state
$inv.data.networkInterfaces |
  Select-Object name, ipAddress, macAddress, isDhcpEnabled, speedFormatted, isUp

Each element of networkInterfaces carries name, description, macAddress, ipAddress, subnetMask, defaultGateway, the ipv4Addresses and ipv6Addresses lists, dnsServers, isDhcpEnabled, mtu, speedBps with a pre-formatted speedFormatted, and isUp. Reading inventory requires the Helpdesk role or higher. The networkInterfaces array is empty or absent when a machine has not yet reported this data.

A summary view is also available on its own sub-route. GET api/agents/{agentId}/inventory/network returns the machine's aggregate network configuration — the combined lists of ipAddresses, macAddresses, defaultGateways, and dnsServers across all adapters — which is handy when you just need the machine's addresses rather than a per-interface breakdown.

The strongly-typed PowerShell module cmdlet Get-AthenaAgentNetwork returns that same aggregate network configuration, and Get-AthenaAgentInventory returns the full inventory document (including the per-adapter networkInterfaces array). For the wider inventory surface, the per-area sub-routes, and how a refresh is triggered, see Inventory.