Network Observability: From SNMP to Flow, Streaming Telemetry, and eBPF

Monitoring tells you it broke; observability tells you why

Most networks are monitored and few are observable, and the difference shows up at 2 a.m. Monitoring answers questions you already knew to ask: is the link up, is the CPU under 80 percent, did the interface flap. Observability is the property of being able to ask new questions of a system after the fact — to take a symptom nobody predicted and follow it to a cause without deploying new instrumentation first. That property comes from the breadth and granularity of the telemetry you collect, and network telemetry has changed more in the last decade than in the two before it.

The practical goal is not to chase every new data source but to understand what each one sees, what it misses, and where it costs you. A device counter, a sampled flow record, a pushed gauge, and a kernel-level socket event are four very different windows onto the same packet. Knowing which window to look through is the whole skill.

SNMP: the polling era, and why it endures

The Simple Network Management Protocol is decades old and still nearly universal. A collector polls agents on UDP port 161, walking an OID tree defined by MIBs, and devices can push unsolicited traps on 162. It is the lowest common denominator: almost every switch, router, firewall, UPS, and printer speaks it, which is exactly why it will not disappear.

Its limits are structural, not incidental:

• Pull-based and coarse. Polling every 60 to 300 seconds is normal, so a microburst, a brief loss event, or a short queue spike lands entirely between two samples and is invisible.
• Counters, not context. SNMP is excellent at "how many bytes crossed this interface" and useless at "which conversations those bytes belonged to."
• Scale tax. Walking large MIB trees across thousands of devices puts real load on both collector and agent, and GETBULK only softens it.

Use SNMP for what it is genuinely good at — inventory, interface counters, hardware health, environmental sensors — and stop expecting it to explain traffic.

Flow: who is talking to whom

Flow records answer the question SNMP cannot: conversations. Instead of per-interface totals, the device summarizes traffic into flows keyed on the classic 5-tuple — source and destination IP, source and destination port, and protocol — plus byte and packet counts, timestamps, and often interface and BGP data. There are three families worth distinguishing:

• NetFlow / IPFIX. Cisco's NetFlow v9 and its IETF-standardized successor IPFIX (RFC 7011) build flow records from observed packets and export them to a collector. They are accurate for volumetric and relational analysis and are the backbone of most traffic-accounting and security-analytics pipelines.
• sFlow. A fundamentally different design: it exports sampled packet headers (1-in-N) plus periodic interface counters, rather than aggregating flows on the device. Sampling makes it cheap and hardware-friendly at high speed, at the cost of statistical rather than exact fidelity for small flows.

Flow is where you find top talkers, unexpected east-west traffic, exfiltration patterns, and the application mix behind a saturated circuit. It is the single highest-value telemetry upgrade most networks are missing, and it feeds both capacity planning and network security detection off the same export.

Streaming telemetry: push instead of poll

Polling has a ceiling, and model-driven streaming telemetry removes it by inverting the relationship. Instead of a collector asking every interval, the device subscribes the collector to a stream and pushes updates — either on a fixed sample interval that can drop to sub-second, or on-change, the instant a value moves. The dominant stack is gNMI (gRPC Network Management Interface) carrying data modeled in OpenConfig YANG and encoded as Protobuf over HTTP/2.

The gains are concrete:

• Granularity. Sub-second visibility catches queue depth, microbursts, and transient errors that a 5-minute SNMP poll averages into nothing.
• Efficiency at scale. Pushing structured deltas over one persistent connection is far lighter than repeatedly walking MIB trees across a large fleet.
• Consistent schema. A vendor-neutral model means the same field means the same thing across platforms, which is what makes cross-device correlation tractable.

Streaming telemetry is the modern replacement for SNMP polling on device state — but it still describes the device's view of traffic, not the endpoints'.

eBPF: instrumenting the path itself

The newest layer moves observation into the host kernel. eBPF lets you attach small, verified programs to hooks in the Linux networking stack and elsewhere, capturing per-socket and per-flow data at the source — with no sampling and very low overhead, because the work happens in-kernel without shipping every packet to user space. On servers and Kubernetes nodes it exposes what the network devices never see: which process and which service owns a connection, DNS resolution latency, TCP retransmits and round-trip times per flow, and policy drops. Projects in the service-mesh and container-networking space have made this the default way to observe east-west traffic inside modern platforms.

eBPF does not replace flow or streaming telemetry — it complements them. The switch knows the packet crossed a port; eBPF knows the pod and the syscall behind it. Cause analysis frequently lives in the seam between those two views.

Putting the layers together

No single source is observability; the value is in correlation. A saturated uplink seen in streaming telemetry, explained by a top talker in flow data, traced to a specific service by eBPF, against an inventory of hardware health from SNMP — that is a question answered end to end. The prerequisite is a platform that ingests all four and lets you pivot between them, which is what a modern infrastructure monitoring practice provides.

Where to start

Do not rip anything out. Start by mapping what you already collect and where the blind spots are, then fill the highest-value gap first — for most networks that is flow, because relational traffic data unlocks both capacity and security work immediately. Add streaming telemetry on platforms that support it to retire slow SNMP polling for live state, and layer in eBPF where you run Linux hosts and containers and need endpoint context. Keep SNMP for the inventory and hardware role it still does best. The end state is a single pane where a symptom leads to a cause in minutes, not a maintenance window. intSignal designs and operates telemetry pipelines that turn scattered counters into answers — talk to our team about making your network observable, not just monitored.