gRPC & gNMI — Streaming Telemetry

Mental model

SNMP is poll-based: every few minutes, the management station asks each device “what’s your CPU? interface octets? memory?” Each round of polls floods devices with queries and produces metrics with 1-5 minute resolution.

Streaming telemetry turns this around. The device opens a persistent connection to a collector and pushes structured data continuously — sometimes every second, sometimes on-change. The collector just receives.

Benefits over SNMP:

• Sub-second resolution (vs SNMP’s minute-scale polling)
• Lower load on devices — push once, instead of answering hundreds of polls
• Structured payloads — protobuf instead of OIDs you have to look up
• Modern tooling — works with Kafka, InfluxDB, Splunk, Grafana out of the box

The cost: more bandwidth to the collector, more state to manage. For real-time analytics, observability, capacity planning — streaming is the right answer in 2026.

The technology stack

Layer	Component
Transport	TCP, usually TLS-encrypted
Protocol	HTTP/2
RPC framework	gRPC (Google’s high-performance RPC)
Payload format	Protocol Buffers (protobuf) — compact, schema-driven binary
Network mgmt API	gNMI (gRPC Network Management Interface)
Data model	YANG (same as NETCONF)

So when you see “gNMI/gRPC streaming telemetry” — that’s gNMI on top of gRPC on top of HTTP/2 on top of TLS/TCP, with YANG-modelled protobuf payloads.

gNMI operations

gNMI defines four core RPCs:

RPC	Purpose	Like NETCONF’s
Get	One-shot read	<get> or <get-config>
Set	Modify config	<edit-config>
Capabilities	What does this device support?	<hello>
Subscribe	Streaming telemetry	(new — NETCONF didn’t have this until RFC 8639)

The Subscribe RPC is the killer feature. It establishes a long-running stream where the device pushes data as it changes (or on a schedule).

Three subscription modes:

Mode	Behavior
SAMPLE	Push every N milliseconds (regular interval)
ON_CHANGE	Push only when the value changes
TARGET_DEFINED	Device picks the optimal mode per path

For interface counters: SAMPLE every 1s. For interface state (up/down): ON_CHANGE — most efficient.

Why protobuf instead of JSON

gRPC payloads use Protocol Buffers — Google’s binary serialization format. Compared to JSON:

• Smaller wire size — typically 30-50% the bytes of equivalent JSON
• Faster to parse — compiled schema, no string-to-type conversion
• Schema-driven — .proto files define the structure; both sides know what they’re sending

Trade-off: you can’t tail -f a protobuf stream the way you can a JSON log. You need a decoder. Tools like grpcurl handle this.

A working example — gNMI Subscribe with gnmic

gnmic is the open-source CLI for gNMI (developed by Cisco/Nokia).

$ gnmic -a 10.0.0.1:6030 \
        -u admin -p cisco123 \
        --insecure \
        subscribe \
        --path "/interfaces/interface[name=Ethernet1]/state/counters/in-octets" \
        --sample-interval 5s

Output: every 5 seconds, the current in-octets counter for Ethernet1, streamed in real time. Pipe to InfluxDB / Prometheus / a Python script. The exact same path syntax (XPath-style over YANG models) you’d use in NETCONF, but with streaming.

Cisco platform support

Platform	gNMI / Streaming Telemetry
IOS-XR	First-class support since 6.0
IOS-XE	Supported since 16.6 (Catalyst 9000, ISR4000)
NX-OS	Supported since 7.0(3)I7
Older IOS classic	No — stuck with SNMP

If you’re running modern Catalyst 9300/9500, ISR4400, ASR9000, Nexus 9300 — streaming telemetry is available. Enable it.

Enable on Cisco IOS-XE

R1(config)# grpc port 50051
R1(config)# telemetry ietf subscription 100
R1(config-mdt-subs)# encoding encode-kvgpb
R1(config-mdt-subs)# filter xpath /interfaces-ios-xe-oper:interfaces/interface/statistics
R1(config-mdt-subs)# stream yang-push
R1(config-mdt-subs)# update-policy periodic 1000           ! 10 seconds (in centiseconds)
R1(config-mdt-subs)# receiver ip address 10.0.99.5 57500 protocol grpc-tcp

Now the device pushes interface statistics to the collector every 10 seconds. The collector (a gRPC server listening on 10.0.99.5:57500) ingests.

Tools to know

Tool	Use
gnmic	CLI for gNMI Get/Set/Subscribe operations
grpcurl	Generic gRPC CLI — like curl but for gRPC
gNMI Python client	Native Python bindings for scripting
InfluxDB / Telegraf	Time-series storage + ingester
Grafana	Dashboard tool, reads from InfluxDB / Prometheus
Cisco Crosswork	Cisco’s commercial telemetry collector + analyzer
Telegraf + cisco_telemetry_mdt plugin	Open-source collector for Cisco MDT

Common mistakes

1. Trying to subscribe to too many paths at once. Each subscription consumes resources. Start with a few key metrics; expand as you confirm device + collector can handle it.

2. Mismatched encoding. Cisco supports several payload encodings (JSON, kvGPB, GPB). Subscriber and collector must agree. kvgpb is the most common for IOS-XE.

3. No collector listening. Subscriptions are established on the device side; if no collector is reachable, the device silently fails. Always verify the collector socket first.

4. Reading data and not aggregating. Streaming gives you raw points every second. Without aggregation (a time-series database like InfluxDB), you’ll drown in data. Plan storage and aggregation.

5. Treating it as a drop-in for SNMP. Streaming is fundamentally different — push vs pull, structured vs OID. Your monitoring tool may need rework, not just a config change.

6. Skipping TLS. Streaming telemetry can flow plain or TLS. In production: TLS always. Plain only for lab.

Lab to try tonight

Use Cisco DevNet sandbox with IOS-XE (Catalyst 9300 sandbox available).

1. Install gnmic on your laptop: brew install gnmic (macOS) or download the binary.
2. Verify the device supports gNMI: gnmic -a <ip>:50052 --insecure capabilities.
3. Try a simple Get: gnmic -a <ip>:50052 --insecure get --path "/interfaces".
4. Subscribe: gnmic ... subscribe --path "/interfaces/interface[name=GigabitEthernet0/0]/state/counters" --sample-interval 5s.
5. Watch counters stream in real time.
6. Configure a Telegraf collector with the cisco_telemetry_mdt input plugin. Point the device at it.
7. Visualize the data in Grafana.

Cheat strip

Concept	Plain English
gRPC	Google’s high-performance RPC framework over HTTP/2
gNMI	gRPC Network Management Interface — config + telemetry
Streaming telemetry	Device pushes data continuously to collector
Subscribe modes	SAMPLE (interval) · ON_CHANGE · TARGET_DEFINED
protobuf	Compact binary serialization — faster + smaller than JSON
YANG	Same data model as NETCONF
gnmic	CLI tool for gNMI
Replaces	Mostly SNMP polling, eventually
Cisco support	IOS-XR (full), IOS-XE 16.6+, NX-OS 7.0(3)I7+
Default port	TCP 50051 (gNMI) — also 57500 for some collectors