Monitoring, Troubleshooting, and Operations
Domain 6 tests operational judgment: how you collect evidence, isolate a layer, and prove a fix. Questions often present a symptom such as intermittent drops, slow storage, or a flapping adjacency and ask for the next diagnostic step or the most likely cause.
Telemetry and evidence
- SNMP polling gives coarse counters on a fixed interval; streaming telemetry (gNMI) pushes samples at sub-second rates and is better for microbursts.
- Flow records from NetFlow or IPFIX show who talked to whom; sFlow samples packets; ERSPAN copies traffic to an analyzer.
- Synchronize clocks with NTP. Without consistent timestamps, correlating logs across devices is guesswork.
- Establish a baseline of normal utilization, latency, and error counts so anomalies are visible.
Troubleshooting sequence
- Confirm scope: one host, one rack, one VLAN, or the whole fabric.
- Check physical layer and interface counters for CRC, alignment, and pause frames.
- Verify Layer 2 and Layer 3 reachability, then routing and overlay tables.
- Test MTU with DF-bit pings at increasing sizes to find the real payload limit.
Worked example
Users report that large file copies across an overlay stall while pings succeed. A 9000-byte DF ping fails; 8950 succeeds. That points to encapsulation overhead: the underlay cannot carry the encapsulated frame. Check the underlay MTU on every hop, confirm VXLAN overhead of 50 bytes, and clamp TCP MSS at the edge. Small pings succeeding and large payloads failing is the classic MTU black-hole signature, especially when ICMP is filtered.
Traps that cost marks
- Trusting an up/up interface as proof the path works.
- Using five-minute averages to diagnose microburst drops.
- Forgetting that flow export and packet capture are directional and may miss the reverse path.
- Overlooking clock skew when logs disagree.
- Changing configuration before capturing evidence, destroying the reproduction.