Chapter 49: Network Performance Troubleshooting
This chapter follows the topics shown in the Networking chapter menu. Work through each section in order, then use the review questions to check recall and troubleshooting reasoning.
49.1 Bandwidth
Bandwidth is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Bandwidth. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.2 Throughput
Throughput is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Throughput. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.3 Goodput
Goodput is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Goodput. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.4 Latency
Latency is the time required for traffic to travel between endpoints. Propagation, serialization, queueing, processing, and path choice can all contribute.
Scenario: a user reports a problem related to Latency. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.5 RTT
RTT is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to RTT. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.6 Sources of Latency
Latency is the time required for traffic to travel between endpoints. Propagation, serialization, queueing, processing, and path choice can all contribute.
Scenario: a user reports a problem related to Sources of Latency. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.7 Jitter
Jitter is variation in packet delay. Real-time voice and video are especially sensitive to excessive delay variation.
Scenario: a user reports a problem related to Jitter. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.8 Jitter Buffer
Jitter is variation in packet delay. Real-time voice and video are especially sensitive to excessive delay variation.
Scenario: a user reports a problem related to Jitter Buffer. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.9 Packet Loss
Packet loss means frames or packets fail to arrive at the destination. Causes include congestion, physical errors, faulty interfaces, wireless interference, policy, or overloaded devices.
Scenario: a user reports a problem related to Packet Loss. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.10 TCP Retransmissions
TCP is connection-oriented and provides sequencing, acknowledgments, retransmission, flow control, and congestion-control behavior for reliable byte streams.
Scenario: a user reports a problem related to TCP Retransmissions. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.11 UDP Loss
UDP is connectionless and has a small transport header. Applications that use UDP must tolerate or handle loss, ordering, and recovery according to their own needs.
Scenario: a user reports a problem related to UDP Loss. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.12 Utilization
Utilization is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Utilization. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.13 Congestion
Congestion is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Congestion. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.14 Queues
Queues is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Queues. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.15 Bottlenecks
Bottlenecks is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Bottlenecks. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.16 Oversubscription
Oversubscription is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Oversubscription. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.17 QoS
Quality of Service classifies and treats traffic differently so delay-sensitive or business-critical applications can receive suitable queueing, scheduling, marking, and congestion behavior.
Scenario: a user reports a problem related to QoS. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.18 Classification
Classification is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Classification. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.19 Marking
Marking is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Marking. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.20 DSCP
DSCP is a field in the IP header used to mark packets for differentiated treatment by QoS policies along the path.
Scenario: a user reports a problem related to DSCP. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.21 Priority Queuing
Priority Queuing is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Priority Queuing. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.22 Shaping
Ping is a basic reachability and round-trip-time test. A failed ping does not always prove the destination is down because policy may block ICMP.
Example: ping the local loopback, local interface, default gateway, remote IP, and finally a hostname. The first failed step helps narrow the fault domain, but remember that ICMP filtering can produce false negatives.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
Command or data example
ping 192.0.2.149.23 Policing
Policing is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Policing. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.24 Baselines
A performance baseline records normal operating behavior so later measurements can be compared against an established reference.
Scenario: a user reports a problem related to Baselines. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.25 SNMP Performance Monitoring
SNMP is used to monitor and manage network devices through structured objects. Managers query agents, and agents can send asynchronous notifications such as traps or informs.
Scenario: a user reports a problem related to SNMP Performance Monitoring. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.26 Flow Data
Flow Data is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Flow Data. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.27 NetFlow
NetFlow is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to NetFlow. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.28 sFlow
sFlow is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to sFlow. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.29 IPFIX
IPFIX is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to IPFIX. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.30 Top Talkers
Top Talkers is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Top Talkers. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.31 Interface Drops
Interface Drops is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Interface Drops. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.32 CRC vs Queue Drops
CRC vs Queue Drops is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to CRC vs Queue Drops. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.33 Slow DNS
DNS translates names into resource records such as IP addresses, aliases, mail-routing information, and service data. Client caching and TTL values affect how quickly changes become visible.
Example: a user can reach 203.0.113.20 but cannot reach server.example by name. That difference points toward name resolution, DNS reachability, record content, cache state, or search-suffix behavior rather than basic IP routing.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.34 Slow Applications
Slow Applications is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Slow Applications. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.35 Duplex Problems
Duplex Problems is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Duplex Problems. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.36 Wireless Performance
Wireless Performance is a wireless-networking concept where RF conditions, channel use, signal level, interference, client capability, and access-point placement all influence the user experience.
Example: two clients see the same SSID, but one has poor performance at the edge of coverage. Compare signal strength, noise, SNR, channel utilization, roaming behavior, and retry rate before assuming the internet circuit is slow.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.37 High CPU
High CPU is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to High CPU. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.38 High Memory
High Memory is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to High Memory. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.39 Scheduled Traffic
Scheduled Traffic is one of the core topics in Network Performance Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Scheduled Traffic. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
49.40 Performance Troubleshooting Workflow
Performance Troubleshooting Workflow is a troubleshooting condition. The useful approach is to confirm symptoms, determine scope, identify the relevant layer, compare actual values with the intended design, test one theory at a time, and verify service after the fix.
Scenario: a user reports a problem related to Performance Troubleshooting Workflow. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.