Monitoring Like It's 1995? Let's Talk State Streaming

In environments where downtime is costly and network infrastructure must operate flawlessly, gaining real-time visibility is a necessity. Network state streaming is a transformative approach that delivers rich, continuous, real-time telemetry, enabling organizations to move beyond periodic glimpses and achieve a continuous, accurate view of their infrastructure. It is the foundation for any form of AIOps.

"...a transformative approach that delivers rich, continuous, real-time telemetry..."

Unlike traditional polling methods, such as SNMP, where state visibility is only available at fixed polling intervals, state streaming delivers a high-fidelity, always-on view of device and network behavior. This evolutionary shift allows network teams to detect anomalies instantly, isolate root causes quickly, and optimize performance in ways not possible with legacy approaches.

State - What, How, Why?

Network state is dynamic information that devices continuously maintain. It changes frequently due to device or network conditions, or abrupt events like microbursts or errors. Capturing all state is crucial for diagnosing issues. Traditional methods used a pull-based polling approach at fixed intervals, often missing critical state changes between cycles.

Network State Examples:

• Routing and forwarding tables
• System and network protocol status
• Interface conditions and counters
• Network flow information
• Hardware status and environmentals
• Device configuration
• Device events
• Connected endpoint information

Arista EOS State Management

Arista's method involves continuously streaming all real-time state to CloudVision. The transport layer uses gRPC (Google's Remote Procedure Call), a high-performance framework built on Protocol Buffers and HTTP/2. This provides the scale and performance needed to stream full network state from each EOS-based device to CloudVision, ensuring no state 'blind spots' and making all state available for troubleshooting, performance monitoring, and capacity management.

The scope of streamed data from an EOS-based device is roughly equivalent to the continuous output of up to 2000 show commands from the CLI. Traditional polling methods can miss crucial network state between cycles. Arista's state streaming addresses this by time-stamping every single state change sent to CloudVision.

"...roughly equivalent to the continuous output of up to 2000 `show commands`..."

The Problem with Polling vs. State Streaming

Diagram Description: A line graph illustrating network telemetry data. The top line shows 'Actual State Streamed to CloudVision' as a continuous, detailed waveform. The bottom section, labeled 'What the SNMP Polling Agent Sees', shows a series of discrete data points (POLL 1, POLL 2, etc.) with significant gaps between them, indicating missed information.

Polling at fixed intervals leads to missed or delayed critical telemetry. Consider a security camera that takes a photo every 5 minutes. If a thief breaks in and leaves within 60 seconds, the event will never be captured. Similarly, polling misses transient network events.

The NetDL Streamer

The NetDL Streamer is a state streaming service integrated into every EOS-based device. It continuously updates an internal repository whenever state changes occur and streams these changes to CloudVision with millisecond granularity. This is a true state change-driven mechanism, not interval-based polling, even for high-speed interfaces (100G+).

This service streams time-stamped state data to CloudVision over an encrypted connection (HTTP/2+SSL) with minimal CPU impact. Bandwidth utilization for the NetDL Streamer typically ranges from 25kbps to 200kbps per device, depending on device configuration and state change frequency, and can be rate-limited.

The actual streaming bitrate is trackable per-device within CloudVision. The data is time-stamped, enabling users to go back in time to review network events. The CloudVision-as-a-Service (CVaaS) cloud service retains up to 90 days of telemetry data.

Diagram Description: A screenshot of the Arista CloudVision NetDL Streamer Dashboard. It displays a table listing network devices (e.g., cc-core-rt1, cc-leaf1) with their streaming agent version, streaming status (Active/Inactive), and streaming latency. A graph shows bandwidth utilization over time, with peaks and troughs indicating data flow. A timeline slider allows users to navigate through historical telemetry data.

Do I Really Need to Know Everything, All the Time?

Think 60-second polling cycles are sufficient? Consider these scenarios:

• Detecting Microbursts: Short, intense traffic spikes that cause packet loss or performance degradation. Polling every 5 minutes or even every minute will likely miss these.
• AIOps: Streaming telemetry provides the real-time, high-resolution, structured data required by AIOps to detect patterns, anomalies, and take action. Polling cannot deliver the necessary detail, speed, or scale.
• Voice and Video Traffic: Monitoring latency and jitter for real-time voice and video traffic requires sub-second telemetry granularity. Polling is too slow to catch transient problems affecting these services.
• Rapid Detection and Root Cause Analysis: Instantly see and correlate events as they happen for quick corrective action. Polling delays detection and correlation due to misaligned device polling cycles.

Modern enterprises cannot afford to operate networks based on stale, fragmented snapshots. In a world that doesn't wait for polling intervals, state streaming provides the clarity and precision to stay ahead. It's a shift from guessing to knowing, essential for today's always-on world.