Monitoring, Troubleshooting, and Operations
Operational excellence means knowing the right tool for the symptom: interface counters, MAC/ARP tables, LLDP/CDP neighbors, syslog, SNMP, sFlow/NetFlow, and mirroring (SPAN/RSPAN). Troubleshoot methodically: physical (link/counters) → L2 (VLAN/MAC/STP) → L3 (ARP/route) → policy (ACL/QoS) → application. Change management, configuration backup, and firmware lifecycle are operational essentials.
Traps: (1) CRC/input errors point to cabling/duplex, not policy. (2) MAC flapping indicates a loop or misconfigured MLAG. (3) Mirroring a busy port without a dedicated destination can drop copies. (4) SNMP polling interval vs traps-traps are event-driven. (5) Time sync (NTP) is required for meaningful logs and certificates.
Rule of thumb: start at Layer 1-check interface counters and errors before chasing routing or ACL theories.
Worked example: Users report intermittent drops on one uplink. show interface shows CRC errors and late collisions rising. Root cause: bad cable/duplex mismatch, not QoS. Replace the cable and confirm errors stop-policy changes would have masked the real fault.