Network Telemetry

Unlike legacy Simple Network Management Protocol (SNMP) polling, modern telemetry uses a publish/subscribe architecture. Devices push data to collectors only when specific conditions are met or at defined intervals, eliminating the overhead of constant pull requests. This is typically implemented via gRPC Network Management Interface (gNMI) or NETCONF with YANG Push, allowing collectors to subscribe to specific YANG data paths and receive structured, high-frequency updates.

Legacy polling often captured data every 5-15 minutes, missing transient microbursts and short-lived anomalies. Modern streaming telemetry delivers sub-second granularity, capturing every counter increment and state change. This high-resolution data is critical for detecting latency spikes, packet loss events, and buffer congestion that occur in milliseconds but severely impact user experience and service-level agreements.

Data is no longer transmitted as opaque, vendor-specific Management Information Bases (MIBs). Modern telemetry relies on model-driven schemas defined in YANG (Yet Another Next Generation). This provides:

• Strict typing for all metrics (integers, strings, enums)
• Hierarchical data trees representing hardware and protocol states
• Vendor-neutral standardization via OpenConfig models This structure allows analytics engines to consume data without custom parsers for each device type.

Modern systems distinguish between synthetic counters (cumulative values like total bytes sent) and absolute gauges (instantaneous values like current CPU temperature). Telemetry collectors maintain state to compute delta values and detect state transitions. Event-driven triggers can initiate a high-frequency burst of data collection only when a threshold is crossed, such as a Bit Error Rate (BER) exceeding a critical limit, conserving bandwidth during normal operation.

Streaming telemetry commonly uses Protocol Buffers (protobuf) as the serialization format, replacing verbose XML or CSV. Protobuf provides:

• Compact binary encoding for efficient wire transmission
• Backward-compatible schema evolution without breaking collectors
• Strict message validation ensuring data integrity Combined with gRPC's HTTP/2 multiplexing, this enables bidirectional streaming of millions of data points per second from a single network element.

A paradigm shift where telemetry data is collected directly by the data plane as packets traverse the network. Instructions embedded in packet headers instruct switches to append metadata—such as switch ID, ingress/egress port, and queue depth—to the packet itself. This provides hop-by-hop visibility into the exact path and per-hop latency of real traffic, enabling precise detection of micro-burst congestion and path asymmetry that control-plane monitoring cannot see.

Cumulative counters on network elements that record the frequency of specific events, such as handover attempts, call drops, or RRC connection failures. These counters are periodically collected and analyzed for performance monitoring.

• Provide granular, per-cell visibility into RAN health
• Form the baseline for KPI anomaly detection
• Often aggregated into 15-minute or 5-minute intervals
• Essential for capacity planning and fault isolation

An adaptive method that automatically adjusts anomaly detection boundaries based on the statistical properties of recent data, rather than relying on static, manually configured values.

• Accounts for time-of-day and day-of-week seasonality
• Reduces false positives during natural traffic fluctuations
• Uses rolling statistics like median absolute deviation (MAD)
• Essential for networks with highly variable load patterns

The process of identifying abrupt shifts in the underlying generative process of a time series, such as a sudden change in mean, variance, or frequency distribution. These shifts often correspond to system state changes or faults.

• Distinguishes transient spikes from sustained regime changes
• Algorithms include PELT and Bayesian Online Change Point Detection
• Triggers automated root cause analysis workflows
• Reduces mean time to detection (MTTD) for silent failures

The desensitization of operations staff caused by an overwhelming number of alerts, particularly false positives. Effective telemetry strategies must prioritize signal over noise.

• Use anomaly scoring instead of binary threshold alerts
• Implement alert correlation to group related events
• Apply deduplication across time windows
• Leverage unsupervised learning to surface only novel anomalies