1. A method comprising: receiving, at an endpoint device in a network, a traffic analysis query from a network controller, the traffic analysis query including one or more query parameters, wherein the one or more query parameters are provided to select portions of traffic analysis data; identifying a portion of traffic analysis data stored in a buffer that satisfies the one or more query parameters, wherein the traffic analysis data characterizes traffic data that has traversed the endpoint device, and wherein the endpoint device is configured to provide network access to one or more client devices for accessing the network; and providing the identified portion of the traffic analysis data to the network controller in response to the traffic analysis query, wherein: when the traffic analysis query is a first query type, providing the identified portion of the traffic analysis data that has been obtained since a time relative a reference indicator; and when the traffic analysis query is a second query type, providing the identified portion of the traffic analysis data that has been obtained since last sending traffic analysis data.