01 BGP, OSPF, IS-IS and BFD
Track routing adjacencies, peer state, prefixes, uptime, flaps and relevant route changes. Connect each event to its interface and neighboring devices so a protocol cascade becomes a traceable sequence with an identifiable starting point.
02 MPLS, VRFs and service paths
Bring VRFs, PE–CE relationships, LSPs and site reachability into a common view. Compare route health, latency, utilization and traffic in the appropriate routing context to isolate a service-specific problem inside a shared transport network.
03 VXLAN and EVPN overlays
Follow VTEPs, VNIs, EVPN peers and MAC/IP relationships across the overlay and its underlay. Correlate an unreachable workload with fabric links, peer changes and endpoint movement to understand which layer needs attention.
04 Switching and adjacency context
Use VLAN, STP/RSTP/MSTP, LACP, ARP, MAC/FDB and LLDP/CDP evidence to explain how devices and endpoints connect. Stable interface identity preserves useful history across rediscovery and changing interface indexes.
05 Resilience and tunnel health
Monitor HSRP/VRRP roles, BFD state, VPN/IPsec tunnels and the interfaces that support them. Distinguish a component fault from lost redundancy or failed service reachability, and verify the remaining path before deciding the business impact.
06 QoS, multicast and network assurance
Connect QoS/CBQoS class traffic, drops and queue pressure with utilization and IP SLA results. Use multicast/PIM evidence where exposed by the device to investigate service degradation that a device-level average would conceal.
07 DNS, DHCP and address context
Compare DNS responses and record validation with DHCP scope, lease and address inventory evidence. Relate failures to the affected subnet, site and service so teams can separate name resolution, address assignment and transport problems.
08 Time and certificate dependencies
Bring NTP offset, stratum and synchronization together with TLS certificate expiry, chain and hostname checks. Connect these shared dependencies to authentication and application availability before their symptoms spread across unrelated systems.
09 Path Intelligence through the incident
Compare current and historical paths, fingerprints and independently observed latency, loss and jitter. Link hops to routing and interface evidence where available, keeping hidden or unresponsive intermediate hops visible without assuming the destination failed.
10 Changes with operational context
Place route, adjacency, topology and configuration changes on the same timeline as service symptoms. Review expected effects, unaffected paths and post-change behavior to focus the next diagnostic or controlled correction.