In one embodiment, a method includes receiving, at a network endpoint device, a traffic analysis query from a network controller, the traffic analysis query including one or more query parameters, where the one or more query parameters are provided to select portions of traffic analysis data. The method also includes identifying a portion of traffic analysis data stored in a buffer that satisfies the one or more query parameters, where the traffic analysis data characterizes traffic data that has traversed the endpoint device, and where the endpoint device provides network access to one or more client devices. The method further includes providing the identified portion of the traffic analysis data to the network controller in response to the traffic analysis query.