Here's how you can creatively tackle network troubleshooting.

Information gathering will help you build a dynamic overview of the issue at hand. However it does not necessarily assist in resolving the issues if it’s applied incorrectly. From my experience troubleshooting is a process of elimination. Do not search for the fault, rather focus on eliminating all viable possible causes. This is where utilising the OSI model and structurally eliminating all possible issues bottom-up is key. As you exhaust the elimination process during troubleshooting, you will often find the root cause of the fault will present it self to you.

Visualization: Create a network map to visualize topology and traffic flows. Proactive Monitoring: Use tools for early issue detection and alerts. Packet Analysis: Use traceroute and packet sniffers (e.g., Wireshark) for diagnostics. Physical Inspection: Check cables and connections for physical issues. Documentation and Collaboration: Maintain detailed records and collaborate for effective problem-solving.

Always gather as much information as you can. Once you have the information, try to narrow down the issue and determine if it is actually a network issue. Many times, issues reported as network problems are just a single user having some sort of issue due to other factors like revoked access, wrong passwords, etc. So, the key is to gather information and narrow down the problem.

Troubleshooting is an art. Depending how the issue has come about and your tooling maturity you may or may not have alerts to rely on. I fully advocate returning to the OSI model and building up from there.

Context is king. Knowing your network and understanding the nuances of your network will lead to faster troubleshooting than just playing it by the book.

I love creating diagrams. Whether I have a holistic network diagram or not when I get in to troubleshooting I draw the connection flow down on paper to revert to. I can later turn this in to a visio and document based on findings. My diagrams for troubleshooting always show IPs, pt2pts, routing, interfaces, and device types eg PC to Server through switches and routers.

A high altitude footprint of your network is a great tool. Do not forget that these icons on a diagram are real places with real people. Knowing your network is as important as knowing your end user and their geographic location.

Having accurate as-built network and application dependency diagrams is critical. However, when you start troubleshooting with a group, for instance on a Zoom call, if no one has a diagram up, take a screenshot of some white space on your screen, bring it up in screen share and start fleshing out a simple diagram. Having a common visual guide to troubleshooting, especially with a group where some are more technical than others, is soooo very helpful. I can almost guarantee you this will speed up finding the issue. I have been doing this for a dozen years or more, trust me. I use CleanShotX on my Mac, but Snipping Tool in Windows, or SnagIT, or something similar will work, even MS Paint. Humans are visual creatures, leverage that!

The key, test one at a time. Keep documentation, visually represent the situation, and areas eliminated. For example, if your scenario involves the Load-balancer possibly being involved. Include it in the diagram screenshot, then test it, if you eliminate it as a cause, draw a green check mark on the screenshot. Doing things like this visually, and keeping them shared in the sharing of a Zoom call helps eliminate the constant resharing of all previous steps anytime someone new joins the call. Don't forget to test things you are "sure" cannot be the problem... A failure of imagination with regards to possible causes often adds much time to the resolution timeline.

Depending on the type of your network be it cloud based, data centre, big or small tooling is only going to help. No network is really small enough not to have tooling supporting it, maybe your home network :) I would prioritise ensuring your logs are tuned on your network, all devices are timesync'd and are all sent centrally to a syslog server. The timestammped log messages can truly help you pinpoint the first action that occured at the time of event.

There are 2 parts to major incidents. 1.) Restoring service 2.) Solving the problem or improving the situation. Focus on a workaround initially that gets the user/customer functioning again quickly. Secondly, do a more thorough problem analysis to determine the permanent solution. If that involves a redesign, or additional purchases--you can then tie it back directly to a service impacting situation which makes resource investment more justifiable. Never let a crisis go to waste as Rahm Emanuel famously used to say.

Effective communication is just as important as developing and testing hypotheses. Being able to clearly explain the issue, your thought process, and the steps you’ve taken to your team or stakeholders can make a big difference. It ensures everyone is on the same page and can work together more effectively. Good communication helps gather additional insights, delegate tasks efficiently, and speed up the resolution process. Plus, keeping a detailed log of all communications can be incredibly useful for future reference and for spotting any recurring issues that might need a more comprehensive fix.