Allied Telesis AT-8900 Series Troubleshooting page 4

All the way through the capture, type (just at the CLI prompt) what you are thinking, and
what you are doing. Just write it as stream-of-consciousness, things like:
"Hmmm.. that counter value looks strange, lets look at this a bit more"
"I have just pulled out blade 5, lets look the internal ports..."
"Right, the ping to the PC on port 5 just starting failing ".
Of course, your consciousness might not stream in English. If so, then write the comments in
your language; the important ones can always be translated later. The important thing is that
the writing of the comments does not get in the way of the job at hand.
Of course, writing comments at the CLI prompt will mean that you get error messages from
the unit like:
But that is quite OK, the person analysing the capture will be able to mentally filter out these
error messages.
When you see something really significant, you might want to highlight it, so it is easy to find
later. A string of !!!!!!!! or ###### are good ways to make sure something stands out when
you are browsing through the file.
What counters are changing?
Often, the investigation of a theory requires looking for what is changing—for example, are
the error counters on a particular port increasing? Is Port A now sending more multicast
packets than Port B is receiving? Are entries in the route ARP table being refreshed? This
brings us to concrete piece of advice #4.
Concrete piece of advice #4: Perform particular show commands a few
times in succession.
You might see certain values changing that give a vital clue to what is happening. Or, if you
don't notice them, the person analysing the capture after you might.
Rate of change can be important
More subtly, the rate at which certain things change can often be significant—for example,
how long did it take that unit to make the transition from VRRP master to slave? or how long
did that route take to age out? or other such questions. Unfortunately, the outputs of show
commands are not time-stamped, so sometimes it is necessary to do the "time stamping"
yourself:
Concrete piece of advice #5: If you are investigating matters that are
time-related, then enter a "show time" command before each of your
other commands.
4
Manager > Now I am going to send the IGMP report from the client,
and see if any PIM counters or states change
Error (3035256): Unknown command "Now".