Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2ArchitectureHard
A network engineer is troubleshooting a performance issue in a campus network where users are experiencing intermittent slowness and dropped connections, particularly when streaming video. The network assurance tools indicate high CPU utilization on some access switches and unexpected traffic patterns during peak hours. Which network assurance technique would provide the most granular, real-time visibility into the packet-level behavior and sequence of events leading to these issues?
- ASNMP polling for interface statistics
- BPacket capture and analysis
- CNetFlow/IPFIX for flow data analysis
- DStreaming telemetry for real-time data
Show answer & explanationAnswer & explanation
Correct answer: B. Packet capture and analysis
Packet capture and analysis provides the most granular, real-time view of network traffic, allowing the engineer to inspect individual packets, reconstruct conversations, and understand the exact sequence of events, errors, or delays at the lowest layer. While other methods provide aggregated data, only packet capture shows the raw data needed for deep-dive troubleshooting of intermittent, specific issues.
Why the other options are wrong
- A. SNMP polling provides aggregated interface statistics, not granular packet-level details or the sequence of events leading to intermittent issues.
- C. NetFlow/IPFIX provides flow-level summaries (who, what, where, when), but not the actual packet contents or the detailed sequence of events within a flow.
- D. Streaming telemetry provides high-frequency, real-time operational data, but it's typically configuration and operational state, not raw packet data for deep analysis of specific intermittent issues.
Packet Capture and Analysis
A network assurance technique involving the interception and examination of individual data packets to understand network behavior, diagnose issues, and analyze traffic at the lowest level.
- Provides granular, real-time insight into traffic.
- Essential for deep-dive troubleshooting of intermittent or complex issues.
- Reveals protocol errors, latency, and application-level problems.
Memory trick: Packet capture is the 'microscope' for network problems.