Reading a packet capture without drowning
A capture with two million frames is not evidence until you have reduced it. Here is the order that works.
Platform
Any platform
Vendor-neutral. The ideas here hold whatever equipment or operating system you run.
The difference between a slow network and a busy one
Both feel identical to users. They have different causes and different fixes.
Spanning tree: what it protects you from
A layer 2 loop does not degrade a network. It stops it, completely, in seconds.
ARP, and the day two devices claimed one address
Intermittent, symmetrical, affects everyone on the subnet. Duplicate addresses have a signature.
Duplex mismatch: the fault that hides in plain sight
The link is up, the speed is right, and throughput is terrible. Check the counters, not the status.
Asymmetric routing and the return path that betrays you
Traffic goes out one way and comes back another. Everything works until a stateful device is involved.
MTU and the packets that vanish
Small things work, large things hang, and nothing is logged. That pattern has one usual cause.
Why ping succeeds and the application still fails
A successful ping proves less than people think. Here is exactly what it proves, and what it does not.
Reading a routing table you did not build
Somebody else built it, nobody documented it, and it is now yours. Here is the order to read it in.
Reading a network you did not build
The audit is the step everyone wants to skip and the one that decides whether the migration works. How to find the load-bearing accidents before they find you.