Second-Floor Access Switch with Late Collisions and a Near-Exhausted DHCP Scope
At a district office, 52 staff use a 48-port access switch. VLAN 20 (data) uses 192.168.20.0/26; VLAN 30 (voice) uses 192.168.30.0/28. From 10:05, users on the second floor report intermittent disconnects and choppy VoIP calls. The switch log shows late collisions and FCS/CRC errors increasing only on Gi1/0/24, which connects to a daisy chain of three unmanaged 8-port switches serving 14 devices. The ISP link is stable at 100 Mbps with no errors, and the router CPU is 18%. A ping test from the core to a PC on Gi1/0/24 shows 0-9% loss with latency spikes to 180 ms. The DHCP server reports the data scope is 93% leased. No cabling or switch configuration changes were made in the past week. Staff have asked whether to add a second access point and upgrade the ISP circuit.
1. Rank the three most likely fault domains and state the single measurement or test that would confirm or eliminate each.
Read the worked answer
Physical/duplex on Gi1/0/24 is most likely. Late collisions are a Layer-1/2 symptom: they occur when a full-duplex port talks to a half-duplex or mismatched peer, or when a segment is over-extended. Confirm with
show interface Gi1/0/24: compare speed and duplex on both ends and watch collision/FCS counters while traffic runs.The unmanaged daisy chain is second. Fourteen devices behind three cascaded 8-port switches share one uplink and one collision domain; a loop or failing switch would produce the same errors. Confirm by isolating the chain and testing one device directly at the port.
DHCP exhaustion is third and does not explain existing sessions dropping. A /26 has 62 usable addresses; 93% means about 58 leased, leaving 4. Confirm by comparing lease count with active MAC addresses and checking for APIPA addresses. The ping loss localizes the fault to the Gi1/0/24 path, not the ISP.
2. The office head wants to approve the ISP upgrade today. Give your recommendation for the next two hours and for the next two weeks, with justification.
Read the worked answer
Next two hours: do not approve the ISP upgrade. The ISP link has no errors and router CPU is 18%, so spending there would not address a fault localized to one access port. Replace the patch cord from Gi1/0/24, hard-set speed and duplex on both ends (or confirm autonegotiation on both), and remove the unmanaged daisy chain by moving the 14 devices to free managed ports. Watch the error counters for 30 minutes; if errors stop, the cause was the segment.
Next two weeks: replace the unmanaged switches with a managed access switch, enable storm control and port security, and expand or re-scope the data VLAN before lease exhaustion. A /26 is nearly full at 52 staff plus printers and APs; plan a /25 or a second VLAN. Add monitoring for CRC and late-collision counters. Revisit the ISP only if a wired test from the core shows clean throughput and latency still fails.
3. Why does the link work most of the time if there is a duplex mismatch or a noisy segment?
Read the worked answer
A duplex mismatch does not fail every packet. The full-duplex side sends whenever it wants; the half-duplex side treats incoming frames as collisions, and its own transmissions collide with incoming traffic. At low load, retransmissions hide the problem. VoIP and report downloads create bursts, so loss and jitter appear. This explains intermittent symptoms and why ping shows 0-9% loss rather than a complete outage. A noisy or over-extended segment behaves similarly: CRC errors rise under load, frames are dropped, and TCP recovery masks the fault until latency-sensitive traffic is present.