Take a baseline you can actually compare against

short · 45 min · Objective 3.2

Task

Measure your lab's normal behaviour across four dimensions, record it, then create an abnormality and confirm the baseline detects it. A baseline nobody compares against is a file, not a control.

Steps

  1. Latency baseline. From Host A, ping -c 100 192.168.20.10 and record the min, average, max and standard deviation. The deviation is the number that matters: it is your jitter.
  2. Throughput baseline. iperf3 -c 192.168.20.10 -t 30 and record the sustained rate. Run it three times at different moments and record the spread, not just one number.
  3. Error baseline. On the router, ip -s link show eth0 and record the RX and TX error, drop and overrun counters. Almost all should be zero; note any that are not, because a rising counter only means something against a recorded starting point.
  4. Utilisation baseline. Sample the interface byte counters twice a minute apart and compute the rate. Record what idle looks like.
  5. Now create an abnormality: run a sustained iperf3 in the background while you re-measure latency. Compare against the baseline and state, in numbers, what changed.

Verify

ping -c 100 -q 192.168.20.10 | tail -2
ip -s link show eth0 | sed -n '3,6p'
python3 -c "
import subprocess, time
def rx():
    return int(open('/sys/class/net/eth0/statistics/rx_bytes').read())
a = rx(); time.sleep(10); b = rx()
print('receive rate', round((b-a)*8/10/1000, 1), 'kbps over 10 s')
"

The ping summary gives min/avg/max/mdev in one line — that is your latency baseline. The rate calculation gives utilisation. Re-run both under load and the difference is the finding; without the first run there is no finding at all.

Notes

The point the exam draws out is that a baseline is a comparison, not a measurement. "Latency is 40 ms" means nothing. "Latency is 40 ms against a baseline of 3 ms" is a diagnosis.

Take baselines at several times of day if you can. A network that is fine at 09:00 and unusable at 14:00 has a congestion pattern, and the pattern is the evidence — one measurement at one time cannot show it.

The three metric families to keep recording are availability (is it up), performance (latency, throughput, jitter, loss) and errors (the interface counters). Domain 5 diagnoses all three, and every diagnosis starts by comparing against what you wrote down here.