Telemetry Collection

Unlike legacy SNMP polling where a management station requests data at intervals, streaming telemetry uses a publish-subscribe model. Devices continuously push state information to configured collectors as soon as changes occur. This eliminates the inherent latency and overhead of request-response cycles, enabling sub-second visibility into network state. Protocols like gRPC Network Management Interface (gNMI) and NETCONF with YANG-Push establish persistent, bidirectional streams that deliver structured data without the CPU penalty of repeated polling queries.

Streaming telemetry relies on YANG data models to define the exact structure, syntax, and semantics of the data being streamed. This model-driven approach ensures that both the network device and the collector share a common, machine-readable contract for every metric. Data is serialized in efficient formats like Protocol Buffers (protobuf) or JSON-IETF, eliminating the parsing ambiguity and text-based inefficiency of traditional CLI scraping or SNMP MIBs. This structured payload enables deterministic, code-level consumption by analytics engines.

Collectors can subscribe to telemetry data using two primary modes. Cadence-based subscriptions deliver data at a fixed, high-frequency interval (e.g., every 500ms), ideal for trend analysis and capacity planning. On-change subscriptions trigger a push only when a monitored data leaf's value actually changes, dramatically reducing bandwidth for stable metrics while providing instantaneous notification of state transitions. This event-driven capability is critical for detecting rapid anomalies like interface flaps or BGP session drops without waiting for the next polling cycle.

Streaming telemetry exposes granular, high-cardinality data paths that are invisible to traditional monitoring. This includes per-queue packet drops, individual flow table utilization on switches, and real-time environmental sensor readings like optical transceiver temperature and voltage. By streaming raw counters at high frequency, the assurance loop can calculate precise microburst detection and derive second-by-second utilization trends. This granularity is the foundational input for machine learning models performing predictive anomaly detection and dynamic resource optimization.

Streaming telemetry supports flexible transport architectures to fit any security posture. In dial-out mode, the network device initiates a TCP connection to an external collector, ideal for environments where devices sit behind firewalls or NAT. In dial-in mode, the collector establishes a gRPC session directly to the device. Both modes leverage TLS encryption for secure transport. This flexibility ensures that telemetry can be collected from distributed edge sites, cloud-native network functions, and core data center fabrics without complex firewall reconfiguration.

Streaming telemetry is the critical data ingestion layer that enables the intent assurance loop. The continuous flow of real-time state data is fed into a time-series database and analyzed by the intent engine. This engine compares the operational telemetry against the declared Service-Level Objectives (SLOs). If a deviation is detected—such as latency exceeding a defined threshold—the closed-loop system triggers an automated remediation workflow to restore compliance, completing the observe-orient-decide-act cycle without human intervention.