Allied Telesis AT-8900 Series manual What counters are changing?, Rate of change can be important

All the way through the capture, type (just at the CLI prompt) what you are thinking, and what you are doing. Just write it as stream-of-consciousness, things like:

“Hmmm.. that counter value looks strange, lets look at this a bit more”

“I have just pulled out blade 5, lets look the internal ports…”

“Right, the ping to the PC on port 5 just starting failing “.

Of course, your consciousness might not stream in English. If so, then write the comments in your language; the important ones can always be translated later. The important thing is that the writing of the comments does not get in the way of the job at hand.

Of course, writing comments at the CLI prompt will mean that you get error messages from the unit like:

Manager > Now I am going to send the IGMP report from the client, and see if any PIM counters or states change

Error (3035256): Unknown command "Now".

But that is quite OK, the person analysing the capture will be able to mentally filter out these error messages.

When you see something really significant, you might want to highlight it, so it is easy to find later. A string of !!!!!!!! or ###### are good ways to make sure something stands out when you are browsing through the file.

What counters are changing?

Often, the investigation of a theory requires looking for what is changing—for example, are the error counters on a particular port increasing? Is Port A now sending more multicast packets than Port B is receiving? Are entries in the route ARP table being refreshed? This brings us to concrete piece of advice #4.

Concrete piece of advice #4: Perform particular show commands a few times in succession.

You might see certain values changing that give a vital clue to what is happening. Or, if you don't notice them, the person analysing the capture after you might.

Rate of change can be important

More subtly, the rate at which certain things change can often be significant—for example, how long did it take that unit to make the transition from VRRP master to slave? or how long did that route take to age out? or other such questions. Unfortunately, the outputs of show commands are not time-stamped, so sometimes it is necessary to do the “time stamping” yourself:

Concrete piece of advice #5: If you are investigating matters that are time-related, then enter a “show time” command before each of your other commands.

4