Troubleshooting, Monitoring, and Performance Analysis
This domain tests a disciplined method for diagnosing network and host performance faults. CUNP questions reward evidence gathering across layers and punish jumping to a favorite tool before localizing the problem.
Core rules and concepts
- Start with scope: one host or many, one direction or both, one service or all services, and when the fault began. Establish a baseline before changing anything.
- Link evidence includes ip -s link for errors and drops, ethtool for speed, duplex, and driver statistics, and dmesg for carrier events.
- Socket evidence includes ss -lntup for listeners and ss -s for summary counts. Netstat is legacy; know it but prefer ss.
- Name resolution is tested separately with dig or getent hosts. A ping failure after a DNS timeout is not proof of packet loss.
- Path evidence uses ping, traceroute or mtr, and tcpdump. Capture on both ends when possible and use filters to limit volume.
- Host performance uses top or pidstat for CPU, vmstat for run queue and swapping, iostat for disk, sar for history, and free for memory pressure.
- Latency, loss, throughput, and jitter are different metrics. A high-throughput path can still have unacceptable latency.
Worked example
Users report intermittent packet loss to one server. Check ip -s link on both ends for RX/TX errors and drops. Run ethtool to confirm speed and duplex match. Use mtr to identify the first hop with sustained loss, then capture with tcpdump on client and server during the fault. If retransmissions appear only on the client side, inspect the client's local link, Wi-Fi, or firewall. If both sides show retransmissions, investigate the path or server load. Correlate timestamps with logs before concluding the network is at fault.
Traps that cost marks
Do not blame DNS for every delay, assume ping tests every protocol, or capture unfiltered traffic on a busy link. Remember that interface drops can be buffer-related, not just errors. A traceroute shows a sample path, not proof that every packet follows it.
Exam focus
Localize by layer and direction, then measure. State the metric, the observation, and the next discriminating test.