Network Operations and Troubleshooting
The Network Operations and Troubleshooting domain tests disciplined fault isolation and the operational tooling that lets you see a problem before a user reports it.
Method and tooling
- Pick bottom-up (physical upward), top-down (application downward) or divide-and-conquer (start at a layer you can verify, then bisect). Any works if you can state why you chose it.
- Interface counters tell the story: runts and FCS/CRC errors point to cabling or duplex mismatch; late collisions on the half-duplex side pair with FCS errors on the full-duplex side; output drops indicate QoS or congestion; input discards indicate buffering or policing.
- ICMP echo tests reachability; traceroute increments TTL to map the path, but filtered ICMP makes a healthy path look broken.
- Syslog severities: 0 emerg, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 info, 7 debug. It is UDP and unreliable, so trap critical events separately.
- SNMP polling (UDP 161) scales badly for high-frequency metrics; traps go to 162 and informs are acknowledged traps. Flow export (NetFlow, IPFIX, sFlow) answers who talked to whom.
- NTP (UDP 123) at stratum 1–15 keeps logs, certificates and billing coherent; stratum 16 means unsynchronised.
Worked example
Users at one site report a slow file copy, yet ping shows 0% loss and 4 ms RTT. Divide and conquer: interface counters are clean; a throughput test gives 940 Mbps locally but 40 Mbps to the remote site; the WAN circuit is at 98% utilisation. The path is healthy at Layer 3 and the problem is capacity, not loss - so a latency complaint to the carrier would have been wrong, and the fix is QoS or a larger circuit. The reasoning, not the tool, earns the mark.
Traps that cost marks
Calling a path broken because traceroute shows stars. Clearing counters before recording a baseline. Treating a loss-free ping as proof of application health while ignoring jitter and micro-bursts. Correlating events across devices with unsynchronised clocks. Changing configuration mid-incident without logging it, which destroys the post-incident review.