Four stages, always looping
The PhysicalLayer agent mirrors a senior network engineer's four-stage process, operating at machine speed around the clock.
Watch
To build a baseline telemetry view, the agent gathers SNMP polls, gRPC telemetry, syslog events, and device state from every managed node.
- SNMP v2c/v3 counter polling at configurable intervals, 30s default
- gRPC/gNMI streaming telemetry on supported Cisco IOS-XR and Junos
- Syslog intake with structured, per-vendor parsing
- CDP/LLDP neighbor discovery updates the topology map
Detect
Each telemetry sample is checked against threshold rules and deviation models. The agent separates transient spikes from sustained faults before raising an event.
- Threshold rules for counters: CRC errors, input drops, output drops
- State machine monitoring for BGP, OSPF, and STP events
- A debouncing window separates transient blips from real faults
- Severity classification: informational, degraded, fault, critical
Diagnose
When a fault appears, the agent traverses the topology graph to separate root causes from downstream symptoms. This stops one physical failure from creating dozens of alert tickets.
- Topology graph traversal reveals upstream and downstream relationships
- Multiple events correlated to one physical root cause
- Confidence scoring assigns a probability to each diagnosis
- Evidence trace shows telemetry points behind the diagnosis
Root cause: core-sw-01 Gi0/2 duplex mismatch
Confidence: 94%
Evidence:
- CRC errors: 847/min sustained >90s
- No upstream trunk errors on peer port
- CDP reports full-duplex; SNMP reports half
Downstream effects:
- dist-sw-03: elevated packet drops (symptom)
- access-sw-12: latency increase (symptom)
Recommended action: correct duplex on Gi0/2Repair
For every fault type, choose autonomous, approval-gated, or notify-only repair. Policies are set per action type and device group.
- Autonomous mode: execute immediately above the confidence threshold
- Approval mode: queue action, send to Slack or email for one-click approval
- Notify-only mode: send analysis, make no changes
- Post-repair health check re-samples counters to confirm the fix
Requirements to get started
It connects to existing infrastructure rather than replacing it. No traffic mirroring or inline appliance.
Management-plane IP
It uses your existing out-of-band management network for device access. Only SNMP read access and SSH for NETCONF repair actions are required.
Device inventory
Import a CSV inventory, or discover devices through a CDP/LLDP seed from one known device. Supports Cisco, Juniper, Arista, and Palo Alto.
One notification channel
Connect Slack, PagerDuty, or email. After each autonomous repair, the agent sends a structured change report and routes approval requests in approval mode.