Skip to main content

Streaming Telemetry

A read-only, real-time feed of subscriber and session state — delivered over SSH, driven from JSON-RPC, and managed entirely from configuration.

Overview​

External collectors, dashboards, and NMS platforms often need live BNG state without polling SNMP or scraping the CLI. AthenaBNG exposes a read-only JSON-RPC feed modelled on the way NETCONF rides over SSH:

  • show.* queries — the same data the CLI shows (subscriber table, session detail, counters), as structured JSON.
  • monitor.subscribe event stream — a live push of session events: session up/down, rate changes, and other lifecycle transitions.

Transport: JSON-RPC over SSH​

The feed is newline-delimited JSON-RPC 2.0. Internally, abngd serves it on a local Unix socket; an SSH forced-command bridge exposes only the read-only surface to remote collectors.

  • No new listener or port — it rides the existing SSH daemon. SSH provides the authentication and encryption.
  • Read-only by construction — the bridge forwards only show.* and monitor.subscribe; anything else is rejected. A collector cannot change configuration or state.
  • Per-collector keys — each collector authenticates with its own SSH key, pinned to a restricted forced-command feed. Revoking a collector is removing its key.

Configuration​

Telemetry access is declared in the BNG config — add a collector's public key and enable the feed:

set monitoring telemetry enabled true
set monitoring telemetry authorized-keys "ssh-ed25519 AAAA... collector@nms"
commit

On commit (and at startup), abngd reconciles the authorized collector keys so remote access always matches configuration. No manual authorized_keys editing, and no service restart.

Why SSH?​

Reusing SSH means the telemetry feed inherits the same authentication, key management, transport encryption, and firewalling you already operate for device access — nothing new to secure, and nothing new to expose. It is the NETCONF model applied to a streaming JSON-RPC feed.