A computer-implemented method comprising: receiving an indication to quiesce a first network device; pausing new communication processing on the first network device for a first period of time sufficient to complete processing of at least a portion of any in-progress communications on the first network device; creating a first snapshot copy of a first state of the first network device, the first state including information from the first network device describing software application run-time execution parameters, software application configuration parameters, hardware run-time execution parameters, and hardware configuration parameters; resuming communication processing on the first network device; storing the first snapshot copy of the first state of the first network device to a first memory communicatively coupled to a first processor of the first network device; receiving an indication to quiesce a second network device concurrently with quiescing the first network device; pausing new communication processing on the second network device for a second period of time sufficient to complete processing of at least a portion of any in-progress communications on the second network device; creating a second snapshot copy of a second state of the second network device, the second state including information from the second network device describing software application run-time execution parameters, software application configuration parameters, hardware run-time execution parameters, and hardware configuration parameters; resuming communication processing on the second network device; storing the second snapshot copy of the second state of the second network device to a second memory communicatively coupled to a second processor of the second network device; restoring the first snapshot copy to a third network device; restoring the second snapshot copy to a fourth network device; and diagnosing a network anomaly using information from the third network device and the fourth network device. receiving an indication to quiesce a first network device; pausing new communication processing on the first network device for a first period of time sufficient to complete processing of at least a portion of any in-progress communications on the first network device; creating a first snapshot copy of a first state of the first network device, the first state including information from the first network device describing software application run-time execution parameters, software application configuration parameters, hardware run-time execution parameters, and hardware configuration parameters; resuming communication processing on the first network device; storing the first snapshot copy of the first state of the first network device to a first memory communicatively coupled to a first processor of the first network device; receiving an indication to quiesce a second network device concurrently with quiescing the first network device; pausing new communication processing on the second network device for a second period of time sufficient to complete processing of at least a portion of any in-progress communications on the second network device; creating a second snapshot copy of a second state of the second network device, the second state including information from the second network device describing software application run-time execution parameters, software application configuration parameters, hardware run-time execution parameters, and hardware configuration parameters; resuming communication processing on the second network device; storing the second snapshot copy of the second state of the second network device to a second memory communicatively coupled to a second processor of the second network device; restoring the first snapshot copy to a third network device; restoring the second snapshot copy to a fourth network device; and diagnosing a network anomaly using information from the third network device and the fourth network device.