When traceroute lies
Asterisks are not failures and high latency at hop four is usually nothing. Read it correctly.
Writing
Networking
Switching, addressing, packets and the faults that live between the cable and the application: how to find them, and how to design so they are rarer.
TTL as a diagnostic instrument
The time-to-live field quietly tells you how many hops a packet took. That is more useful than it sounds.
Reading a packet capture without drowning
A capture with two million frames is not evidence until you have reduced it. Here is the order that works.
The difference between a slow network and a busy one
Both feel identical to users. They have different causes and different fixes.
Spanning tree: what it protects you from
A layer 2 loop does not degrade a network. It stops it, completely, in seconds.
ARP, and the day two devices claimed one address
Intermittent, symmetrical, affects everyone on the subnet. Duplicate addresses have a signature.
Duplex mismatch: the fault that hides in plain sight
The link is up, the speed is right, and throughput is terrible. Check the counters, not the status.
Asymmetric routing and the return path that betrays you
Traffic goes out one way and comes back another. Everything works until a stateful device is involved.
MTU and the packets that vanish
Small things work, large things hang, and nothing is logged. That pattern has one usual cause.
Why ping succeeds and the application still fails
A successful ping proves less than people think. Here is exactly what it proves, and what it does not.