Network Assurance: Monitoring, Telemetry, and Troubleshooting
Classic tooling
Ping and traceroute remain first-line tools; remember that Cisco traceroute defaults to UDP probes and that ICMP filtering can make a path look broken. Debug output must be scoped with conditional debug or ACLs on production devices. Syslog severities run from 0 (emergencies, highest) to 7 (debugging), so lower numbers are more severe. SNMPv3 adds authentication and privacy beyond v2c community strings; traps are unacknowledged, informs are acknowledged.
Flow and synthetic data
NetFlow (v5, v9, IPFIX) exports flow records from the cache and describes who talked to whom; Flexible NetFlow lets you define exactly which fields to export. IP SLA generates synthetic probes and can drive object tracking to fail over routes. SPAN copies traffic locally, RSPAN carries it over a dedicated VLAN, and ERSPAN tunnels it in GRE across a routed network.
Model-driven assurance
NETCONF and RESTCONF provide programmatic configuration; gRPC-based telemetry pushes structured data continuously rather than polling. Cisco DNA Center Assurance adds health scores, client 360 views, and path trace, which are intent-level answers rather than raw counters. EEM applets automate reactions to syslog or SNMP events.
Traps
Do not confuse polling (SNMP) with streaming (telemetry). NetFlow shows traffic composition; IP SLA shows reachability and latency. SPAN sessions capture what the ASIC forwards, and oversubscribed sessions drop frames silently, so a capture that looks clean is not proof of no drops.
Worked example
A logging line shows severity 5. Counting from 0 as emergencies, level 5 is notifications. To see interface state changes, level 5 or lower is sufficient; level 7 debugging is the most verbose and the least safe on a busy device.