Troubleshooting Scenario Questions

Layer 4 - Transport

Why wrong: Transport layer provides end-to-end communication and segmentation.

Layer 1 - Physical

Why wrong: Physical layer deals with bits and transmission media.

Layer 2 - Data Link

Why wrong: Data Link layer handles frames and MAC addresses within a single network segment.

The Git repository is private and cannot be accessed.

Why wrong: Repository access is not related to Kubernetes cluster connectivity.

The Docker image was not built successfully.

Why wrong: An image build failure would be caught in the build stage, not the deploy stage.

The Kubernetes cluster has insufficient resources to schedule the pod.

Why wrong: Insufficient resources would cause a different error (e.g., 'pod pending' or 'unschedulable').

The MTU is misconfigured on the outgoing interface.

Why wrong: MTU issues cause packet drops but not ARP incompleteness.

The routing protocol has not converged yet.

Why wrong: Routing convergence affects the route table, not ARP.

An ACL is blocking traffic on the outgoing interface.

Why wrong: ACLs drop packets after routing, they don't prevent ARP resolution.

HTTPS is not enabled on the device.

Why wrong: The 'ip http secure-server' command enables HTTPS.

The HTTP server is not enabled.

Why wrong: The configuration includes 'ip http server', so HTTP is enabled.

Authentication is not configured as local.

Why wrong: Authentication is set to local with 'ip http authentication local'.

show interfaces trunk

Why wrong: Shows trunking status, not routing.

show vlan

Why wrong: Shows VLAN membership, not routing table.

show mac address-table

Why wrong: Shows MAC address table, not routing.

Request a higher rate limit from the Webex API support team.

Why wrong: This is external and not guaranteed; programmatic handling is required.

Catch HTTP 429 (Too Many Requests) errors and immediately retry the request.

Why wrong: Immediate retry may continue to hit the rate limit; exponential backoff is needed.

Reduce the bot's overall request rate to 5 per second to stay well within the limit.

Why wrong: This reduces responsiveness and may still have spikes that exceed the limit.

kubectl get events

Why wrong: get events shows cluster events but not detailed rollout status.

kubectl describe deployment

Why wrong: describe shows current state but not rollout status specifically.

kubectl logs deployment

Why wrong: logs shows logs from pods, not rollout status.

The server is unavailable due to maintenance

Why wrong: That would typically result in a 503 Service Unavailable.

The server encountered an internal error

Why wrong: Internal errors generate 500 status.

The client lacks proper authentication

Why wrong: Authentication issues produce 401 Unauthorized.

Layer 4

Why wrong: Layer 4 deals with transport protocols like TCP and UDP.

Layer 1

Why wrong: Physical layer deals with bits, cables, and signals, not logical segmentation.

Layer 3

Why wrong: Layer 3 deals with routing and IP addressing, not VLANs.

The database server is not listening on the expected port

Why wrong: Since other services can reach the database, the listener is working.

The mutual TLS certificates are expired or not trusted

Why wrong: If mTLS were the issue, other services attempting to connect would also likely fail.

The Istio sidecar proxy is misconfigured and rejecting traffic due to a missing ServiceEntry

Why wrong: Without a ServiceEntry, traffic might be blocked by mutual TLS, but the symptom is unreachability, and other services work.

Ping the server's IP address from the switch management interface.

Why wrong: The switch management interface may be in a different VLAN, so this does not test the specific VLAN 100 path.

Ping the default gateway from a host in VLAN 100.

Why wrong: This checks Layer 3 connectivity but does not directly address the missing ARP entry for the server.

Check the MAC address table on the switch for the server's MAC.

Why wrong: The MAC address table shows Layer 2 paths, but the issue is ARP resolution which is Layer 3.

docker inspect web

Why wrong: docker inspect shows detailed configuration but not necessarily the logs of why the container exited.

docker exec -it web bash

Why wrong: docker exec cannot be used on a stopped container.

Transport layer (Layer 4)

Why wrong: Layer 4 deals with TCP/UDP segments and ports.

Physical layer (Layer 1)

Why wrong: Layer 1 deals with bits, cables, and hubs, not MAC addresses.

Network layer (Layer 3)

Why wrong: Layer 3 uses IP addresses, not MAC addresses.

Check the length of the JSON payload sent to the API.

Why wrong: Payload size limits cause 413 errors, not 500.

Ensure the switch is running NX-OS version 9.3(1) or later.

Why wrong: Version is less likely to cause intermittent 500 errors.

Use HTTP instead of HTTPS for the API requests.

Why wrong: Using HTTP does not fix the issue and introduces security risks.

The device has an invalid username and password

Why wrong: Invalid credentials would produce an authentication error.

The Ansible user does not have privilege level 15 on the device

Why wrong: Privilege level affects configuration, not connection establishment.

The ios_config module requires NETCONF instead of SSH

Why wrong: ios_config uses SSH by default, not NETCONF.