Network Operations, Monitoring, and Troubleshooting
This domain tests whether you can operate a network with baselines, backups, time sync, and monitoring, then isolate faults methodically. Expect SNMP, syslog, flow data, packet capture, interface counters, DNS/DHCP checks, and change control.
Core rules
- SNMP polling reads counters from agents on UDP 161; traps and informs are sent to managers on UDP 162. SNMPv3 adds authentication and privacy; v2c communities are cleartext.
- Syslog severity runs 0 emergency through 7 debug. Syslog over UDP 514 is fire-and-forget, so lost messages are possible.
- NTP uses UDP 123. Clock skew breaks certificate validation, log correlation, and Kerberos-style authentication.
- NetFlow and IPFIX summarize flows; packet capture shows payload and headers. Use the least invasive tool that answers the question.
- A baseline distinguishes normal utilization from a fault. Change management and configuration backups limit recovery time.
Worked example
Users report intermittent VoIP quality on a switched link. Check interface input errors, CRC errors, late collisions, and output drops. Late collisions and increasing output errors suggest duplex mismatch; verify both sides are auto-negotiated or both hard-coded. CRC errors suggest cabling or interference. Then check utilization, QoS marking, jitter, and traceroute for asymmetric paths. If ping is clean but voice is poor, latency and jitter under load are more likely than reachability.
Traps
A successful ping does not prove DNS, MTU, or application health. SNMP traps are not polls. Syslog over UDP can lose messages. Duplex mismatch often appears as late collisions, not early collisions. High CPU on a router can be caused by process switching or control-plane policing, not just traffic volume.