Watchtower

Safe Network Observability

Watchtower monitors your SONiC switches without ever writing to their databases. It runs as a Docker container on each switch, continuously reading local network state via Redis and producing human-readable findings when anomalies are detected.

Core guarantee: Watchtower never writes to CONFIG_DB, APPL_DB, ASIC_DB, or STATE_DB. It cannot cause outages.

What It Monitors

• Port counters — rx/tx bytes, errors, drops, packets
• Interface state — admin/oper status changes
• BGP sessions — session state transitions
• LLDP topology — neighbor discovery and mapping
• Optic health — DOM sensor data (RX power, temperature)
• Syslog — anomalous log entries

Anomaly Detection

Watchtower learns statistical baselines over time and flags deviations. Configurable thresholds (5x deviation default, 10x immediate alert) let you tune sensitivity to your environment. During a one-week warmup period, it builds p50/p95/p99 baselines before alerting.

Resource Self-Policing

A built-in resource governor monitors its own CPU and memory usage with graduated states — throttle, pause, dormant — preventing Watchtower from ever competing with SONiC for switch resources.

CLI

watchtower show findings     # active or historical findings
watchtower show topology     # LLDP neighbor map
watchtower show events       # raw event log
watchtower show baselines    # learned statistical baselines
watchtower show resources    # CPU/memory/disk usage

Part of the DendroLabs SONiC Stack

Watchtower pairs with SONiC Firewall as part of our effort to make SONiC more accessible. Phase 1 (local observer, anomaly detection, CLI) is complete with 132 tests passing. Future phases include peer-to-peer cross-switch correlation, LLM-powered natural language findings, and fleet-wide aggregation.