A user calls and says "the network is down". What do you ask before you touch anything?
Show the answer
Say this first
I narrow the scope. What exactly fails: one app, one site, everything? Who else is affected? Since when? All the time or on and off? Wired, wireless or VPN? What changed, on their side and ours? Then I get one concrete example I can reproduce: source host, destination, time and the exact error. Those answers usually point to a layer and a location before I log in to anything.
Go deeper
The questions and what each answer points to
- What fails exactly? "Down" often means one website, email, Wi-Fi or the VPN.
- Who is affected? One user points at the host, cable or port. A floor points at a switch, an uplink or a VLAN. A whole site points at the WAN, the edge, or a shared service like DNS or DHCP.
- Since when? Line it up against the change log, monitoring and syslog.
- Constant or intermittent? Intermittent points at errors, flapping, congestion or a duplicate IP.
- What changed? A new laptop, a desk move, a patch, our own change window.
- The exact error text. "Name not resolved" and "connection timed out" send you to different layers.
Then pin one example
Source IP, destination name and IP, port, time. Every later test uses the same example, so results can be compared and handed over.
They will ask next
The user cannot give you details. What next?
Get the facts from the host and the network directly: IP, gateway and DNS from the endpoint tool or
ipconfig /all, then the switch port from the MAC address, then logs and monitoring for that port and VLAN.
Traps
- Taking "the network is down" literally. Most of those tickets are one app, DNS, or a single host.