Theoretical foundations and architecture

Monitoring of a modern operator core is moving from periodic SNMP polling to streaming telemetry (subscriptions to YANG-modelled data: gNMI Subscribe or dial-out gRPC) and to NetFlow v9/IPFIX flow analysis (RFC 7011). SNMP polled every 1-5 minutes averages the data and misses microbursts and sub-second events. Streaming telemetry works on a push model: the router sends structured data on its own under a subscription (interface counters, BGP and LDP state, queues) over gRPC/HTTP/2 with a period of a few seconds (sample mode) or on change (on_change); the collector stores it in a time-series database (Prometheus, InfluxDB), often through a broker. The load is not zero: a 1 s rate on thousands of interfaces loads the router CPU and the collector, so paths and period are limited. IPFIX (IP Flow Information Export) exports flow records (addresses, ports, protocol, MPLS labels, DSCP, byte and packet counters), usually on 1:N sampling: volumes must be multiplied by N (the samplingInterval element), so the picture is statistical, not complete. Together they show where congestion is and who causes it, per customer VRF and per link.

Four kinds of network data

Monitoring an MPLS core relies on four independent sources. Counters and state (interface load, LDP, BGP, BFD state) are collected by SNMP polling or streaming telemetry. Events (neighbor down, LSP state change) arrive as SNMP traps/informs and syslog. Flows (who sent how much to whom) are exported via NetFlow v9 and IPFIX. Active probes (LSP ping, BFD) measure availability on their own. No source replaces the others: counters show that a link is loaded, flows explain by whom, and events tell when it started.

SNMP: polling, traps and MIBs

SNMP answers requests on UDP 161 and sends notifications to UDP 162. Version v2c is protected only by the community string, while v3 adds authentication and encryption (USM). A trap is sent without acknowledgment, while an inform is acknowledged by the receiver and retransmitted when lost, so informs are used for critical events. Polling usually runs every 1-5 minutes; this sets the resolution of graphs, and short load spikes vanish in the averaging. Interface counters require the 64-bit ifHCInOctets/ifHCOutOctets from ifXTable: a 32-bit octet counter on 10 Gbit/s wraps in roughly 3.4 seconds, and with a one-minute poll the result would be bogus.

MPLS has standardized MIBs: MPLS-LSR-STD-MIB (RFC 3813, LFIB tables), MPLS-LDP-STD-MIB (RFC 3815, sessions and bindings), MPLS-TE-STD-MIB (RFC 3812, tunnels), MPLS-L3VPN-STD-MIB (RFC 4382, VRF tables and notifications about exceeding the route limit), BGP4-MIB (RFC 4273, bgpBackwardTransition), BFD-STD-MIB (RFC 7330, bfdSessUp/bfdSessDown) and IF-MIB (linkUp/linkDown). Implementation and coverage depend on the vendor, and some metrics are only available in proprietary MIBs. The ifIndex can change after a reload, so enable its persistence (snmp-server ifindex persist on Cisco).

Syslog

Syslog (RFC 5424) carries text events with a severity from 0 (emergency) to 7 (debug) and a facility; the default transport is UDP 514, and TCP or TLS on 6514 is more reliable. For MPLS the neighbor messages matter: %OSPF-5-ADJCHG, %LDP-5-NBRCHG, %BGP-5-ADJCHANGE on Cisco. Practice: a single source (loopback), NTP time synchronization so events from different nodes can be correlated by time, and correlation with BFD events.

NetFlow v9 and IPFIX: templates and the flow key

A flow is a series of packets with the same key (usually source and destination addresses, ports, protocol, ToS, ingress interface). The router keeps a flow cache and exports records to the collector when the flow has ended (FIN/RST, inactive timeout, usually 15 s) or has reached the active timeout (30 min by default on Cisco, in practice set to 60 s, otherwise a flow stays invisible for a long time). NetFlow v5 has a fixed format and covers IPv4 only, so it is unsuitable for MPLS and IPv6. NetFlow v9 (RFC 3954) and IPFIX (RFC 7011) are template based: a Template Set (ID 0 in v9, ID 2 in IPFIX) describes the fields, and a Data Set with ID 256 or above carries the values. The fields come from the IANA registry of information elements: sourceIPv4Address (8), destinationIPv4Address (12), protocolIdentifier (4), ingressInterface (10), octetDeltaCount (1), packetDeltaCount (2). IPFIX runs over UDP, TCP or SCTP, with the standard port 4739 (2055 is customary for v9 but is not reserved).

For MPLS, IPFIX has the elements mplsTopLabelStackSection and the following ones (70-79: up to ten labels), mplsTopLabelType (46), mplsTopLabelIPv4Address (47); VRFs are conveyed as ingressVRFID (234) and egressVRFID (235). Classic MPLS-aware NetFlow on a P router exports labels (positions are configured separately, on Cisco ip flow-cache mpls label-positions), while a PE sees customer traffic as IP inside the VRF, so the flow monitor is attached to customer-facing interfaces (ingress). Exporting every packet is too expensive, so 1:N sampling is used: the received bytes and packets must be multiplied by N, and the samplingInterval option (34) is added to the template, otherwise the collector underestimates the volume.

Streaming telemetry: gRPC, YANG, gNMI

The telemetry model: the router publishes data on a subscription instead of on request. Data is described by YANG models (OpenConfig or native), the transport is gRPC over HTTP/2 with Protobuf (GPB key-value or compact) or JSON, usually within TLS. In gNMI (the RPCs Capabilities, Get, Set, Subscribe) a subscription is STREAM (modes sample, on_change, target_defined), ONCE or POLL. Dial-in (the collector connects to the device) differs from dial-out (the device establishes the connection itself; this is how Cisco MDT and Huawei Telemetry work). On Cisco IOS-XE update-policy periodic is set in hundredths of a second (1000 is 10 s), while Junos Telemetry Interface reporting-rate is in seconds. Advantages over SNMP: second-level periodicity, structured data, on_change for events and lower CPU load with large tables. But there is no "zero" load: sensors compute data on the control plane, and the collector must withstand the volume, so limit paths and frequency.