Monitoring, Troubleshooting, and Performance Analysis
Telemetry sources
SNMP polling gives counters and interface state; v3 adds authentication and privacy, so v2c community strings should be treated as legacy. Traps are unsolicited UDP notifications and can be lost - do not treat silence as health. Syslog severity runs 0 (emergency) to 7 (debug); forwarding debug level everywhere floods collectors and buries real events. Flow export (NetFlow, IPFIX, sFlow) reveals who talks to whom and how much, which interface counters alone cannot answer.
Metrics that matter
Latency, jitter, loss and available bandwidth determine user experience. The bandwidth-delay product sets the in-flight data needed to fill a path; a long-fat pipe with a small TCP window looks slow despite idle capacity. Polling intervals shorter than the counter wrap period prevent aliasing, and 64-bit counters avoid rollover on fast links.
A repeatable method
Define the fault precisely, then choose a path: bottom-up from physical, top-down from the application, or divide-and-conquer starting at a layer where you can test both directions. Change one variable at a time and record results. For connectivity use ping and traceroute - traceroute relies on incrementing TTL and ICMP replies, so a hop showing stars may simply be filtering rather than broken.
Worked example
Users report slow file transfers. Ping returns 80 ms and 0% loss with default 56-byte payloads, yet 1500-byte pings fail. This is an MTU problem, not latency: a tunnel or filtered ICMP Type 3 Code 4 is blocking PMTUD. Confirm with a DF-set ping sweep, then clamp MSS or raise the tunnel MTU.
Traps that cost marks
Reading late collisions and CRC errors as normal, blaming an application before checking loss and jitter, assuming missing traps mean the device is fine, and chasing bandwidth when the real limit is TCP windowing.