Network Telemetry

SNMP polling makes a manager ask every device for every value each cycle, so data arrives late, averaged and lost under stress. Streaming telemetry subscribes once; each device then pushes YANG-modelled values on a timer or on change.

Syslog severities run from 0 Emergency to 7 Debug, and a lower number means a more urgent message. 'Warning and more urgent' therefore selects 0 to 4: Emergency, Alert, Critical, Error and Warning.

The inactive timeout expires a flow that has gone quiet; the active timeout exports a long-lived flow in slices. Collectors see traffic only when records arrive, so a long active timeout piles a long transfer into one graph spike.

A SPAN port is switch configuration copying frames best effort; a TAP sits in the cable and copies the signal. A passive optical TAP needs no power, so a power cut is harmless; an active copper TAP typically drops the link briefly.

Counters change with every packet, so a gNMI SAMPLE subscription sends them on a fixed sample_interval; status changes rarely, so ON_CHANGE sends it only when it moves. heartbeat_interval forces periodic re-sends so silence is distinguishable from a dead stream.

PRI is facility times 8 plus severity, so divide by 8: the quotient is the facility, the remainder the severity. 134 = 16 x 8 + 6, which is facility 16 (local0) and severity 6 (Informational).

Both directions of the link converge on one 10 Gb/s destination port, so coinciding bursts offer up to 20 Gb/s. The egress buffer fills within milliseconds and the switch drops the surplus copies first, even though the averages total only 7 Gb/s.

Whole messages vanish and nothing tells the collector: RFC 5426 gives UDP syslog no acknowledgement, retransmission or congestion control. You can only see the loss if messages carry a sequence number, such as RFC 5424's meta sequenceId, or syslog-sign signature blocks.

A SPAN session makes an Ethernet switch copy frames received, sent, or both on chosen source ports or VLANs to a destination port for a capture host. It is needed because a switch sends known unicast only out of the destination's port.

An sFlow agent keeps no flow state: it sends a copy of the header of about 1 in N packets, plus periodic interface counters. A NetFlow or IPFIX exporter keeps a flow cache and exports aggregated records when entries expire.

RSPAN, a vendor feature, floods copies into a reserved VLAN that trunks carry to another switch, so it needs an unbroken layer-2 path. ERSPAN wraps each copy in GRE over IP, so it routes but needs MTU headroom and a trusted path.

In gNMI, ONCE sends all subscribed values, a sync_response and closes the RPC; POLL keeps the RPC open and answers each Poll message with values plus a sync_response; STREAM sends initial values, one sync_response, then updates indefinitely.

RFC 5424 adds a VERSION, a timestamp with year, fractional seconds and UTC offset, separate APP-NAME, PROCID and MSGID fields, and STRUCTURED-DATA. RFC 3164 only recorded BSD practice: local time without year or zone, a hostname, then free text.

RFC 5425 adds TCP retransmission and congestion control, octet-counted framing, encryption, integrity and certificate authentication on each hop. It has no application acknowledgement, so a broken connection can lose messages unnoticed, and it does not prove who wrote a message across relays.

Multiply sampled packet and byte counts by N, the 1-in-N sampling rate. With random sampling, an estimate from c samples has a relative error near 1/sqrt(c): big aggregates are accurate to a fraction of a percent, small flows are mostly noise.

IPFIX and NetFlow v9 data records can only be parsed with the template they reference, and a restarted collector has lost its templates. Over UDP the exporter cannot tell, so decoding resumes at its next periodic template retransmission.

The receiving port checks each frame's FCS and discards a damaged frame before the forwarding pipeline, where mirror copies are made, so a SPAN copy typically never includes it. A passive TAP plus a capture interface that keeps bad frames shows them.

Dial in when the collector can reach every device and should own the subscriptions. Dial out when devices sit behind NAT or firewalls, or subscriptions must survive reboots: RFC 8639 configured subscriptions live in device configuration and connect to receivers themselves.

A YANG-Push on-change subscription starts with a full push-update when sync-on-start is true, then sends push-change-update YANG Patch deltas. A receiver detects loss through gaps in a counting patch-id or an incomplete-update flag, then resynchronises.

Trust an RFC 5424 TIMESTAMP only as far as the originator's clock was synchronised, which timeQuality can state. BSD timestamps lack year and zone and may be a relay's own time. Arrival order and the datagram's source address prove neither sequence nor origin.

gNMI encodes a path as a list of PathElem messages: a node name plus an optional map of list keys, sent as strings. A prefix is prepended to each path; omitted keys, * and ... are wildcards, and subscriptions include descendants.

Each packet enters on one mirrored port and leaves by the other, and both passes are copied. Receive-only mirroring on both ports copies each once; broker deduplication needs a window and a field list, and can discard genuine packets.