Network Operations and Troubleshooting
Network Operations and Troubleshooting
This domain tests monitoring, change control, and structured fault isolation. Questions reward evidence-based reasoning over guessing.
Core rules
- Use a layered method: define the problem, gather symptoms, isolate to a layer or segment, form a hypothesis, test, then document. Change the least intrusive variable first.
- Syslog severity runs 0–7; lower numbers are more severe (0 emergency, 7 debug). SNMP polls MIB objects; traps are unsolicited alerts. NetFlow/IPFIX summarizes flows, not packet payloads.
- Interface counters reveal physical issues: CRC and input errors suggest cabling or duplex; late collisions suggest duplex mismatch; drops suggest congestion or policy.
- Baseline normal latency, jitter, loss, and utilization. Compare against the baseline rather than an absolute threshold.
- MTU mismatch can allow ping but break large payloads or TLS handshakes.
Worked example Users report an application is slow only when transferring large files, while small pings succeed. Check interface errors, then test with larger packets and DF set. If a 1500-byte packet fails but 1400-byte succeeds, suspect an MTU or fragmentation issue along the path. Adjust MSS clamping or MTU consistently, then verify with a large transfer and latency check.
Traps A successful ping does not prove the application works; it tests reachability, not port, DNS, TLS, or MTU. Syslog level 7 is debug, not critical. Traceroute may use UDP, ICMP, or TCP depending on the tool, so a timeout is not always a dead router. Do not assume speed/duplex auto-negotiation is always correct; hard-code both ends or leave both auto.