Cabling and physical-layer faults

Why this matters

Layer 1 faults are the ones that waste the most time, because they rarely announce themselves. A completely dead cable is easy. The expensive faults are the ones where the link comes up, the light is on, and the network is quietly corrupting or dropping a percentage of frames — which presents as "the application is slow" and sends people to look at servers.

The skill this objective tests is reading interface counters, because they are where a physical problem becomes visible before anyone thinks to suspect a cable.

The lesson

Interface issues and increasing interface counters

Every interface keeps counters, and the crucial word in the objective is increasing. A counter with a non-zero value tells you something happened once, possibly years ago. A counter that is climbing while you watch tells you the fault is happening now. Always check twice and compare.

The counters that matter:

CRC / FCS errors. The frame arrived and its checksum did not match, so it was corrupted in transit. This is the headline indicator of a physical problem — bad cable, bad connector, interference, or a failing transceiver. Rising CRC errors means layer 1, almost always.

Runts are frames below the 64-byte minimum. Giants exceed the maximum. Both suggest corruption or a duplex problem.

Collisions should be zero on a modern full-duplex link. Any collisions mean something is running half duplex.

Late collisions are the specific giveaway of a duplex mismatch, as the VLAN lesson set out. A normal collision occurs early in a frame; a late one means the far end was already transmitting, which cannot happen on a correctly negotiated full-duplex link.

Input/output drops mean the interface discarded frames, usually because a buffer or queue was full — a congestion signal rather than a corruption one.

Flapping. The interface repeatedly goes up and down. Causes are a marginal cable, a failing transceiver, a duplex or speed negotiation problem, or a power issue on a PoE device. Flapping is disproportionately disruptive because each transition can trigger spanning-tree recalculation.

The diagnostic habit: clear the counters, generate traffic, and watch. That turns a historical record into a live measurement.

Incorrect cable

Using the wrong cable is common, and the exam names the specific ways.

Single mode vs. multimode. Mismatching the fibre and the optic — or joining single-mode to multimode fibre — produces either no link or a link that works over a patch lead and fails over distance. Colour is a useful field cue: yellow jacket for single-mode, orange or aqua for multimode, though never rely on it alone.

Category 5/6/7/8. Running gigabit over Cat 5 rather than Cat 5e, or 10 Gb over Cat 6 beyond 55 m rather than Cat 6a, produces a link that negotiates and then performs badly with rising errors. The category is printed along the cable's jacket, which is the fastest way to check.

Shielded twisted pair (STP) vs. unshielded twisted pair (UTP). UTP is the default: cheaper, thinner, easier to terminate. STP adds shielding for environments with significant electromagnetic interference — factory floors, runs parallel to power cables, near motors or fluorescent lighting.

The trap with STP is that shielding must be grounded, and grounded at one end only. Ungrounded shielding does nothing. Grounded at both ends it can form a ground loop, which introduces the very noise it was installed to prevent — an installation that is worse than plain UTP would have been.

Signal degradation

Three named causes, and they produce similar symptoms with different remedies.

Attenuation is the loss of signal strength with distance. Every metre costs something, and past the limit the receiver can no longer reliably distinguish the signal. This is what the 100-metre copper limit protects against.

Symptoms: works at short distance, intermittent or failed at length, rising CRC errors. Remedies: stay within the limit, use a repeater or switch mid-run, or move to fibre.

Crosstalk is signal from one pair bleeding into an adjacent pair. It is what the twisting in twisted pair exists to cancel — the tighter and more precise the twist, the better the cancellation, which is what higher categories are really buying.

The most common cause is untwisting too much wire at termination. The standard allows only about half an inch of untwist at an RJ45 plug; a hurried termination that untwists two inches creates a crosstalk source that no tester will pass. NEXT (near-end crosstalk) and alien crosstalk are the measured forms.

Interference is external electromagnetic noise coupling into the cable — power cables, motors, lighting ballasts, lift machinery, radio transmitters.

Symptoms are intermittent errors that correlate with something else happening, which is the diagnostic clue: errors that spike when the lift moves or a machine starts are interference, and no amount of replacing the cable will fix them. Remedies are rerouting away from the source, separating from power runs, using shielded cable, or using fibre, which is immune.

Improper termination

The cable is fine; the connector on the end is not. The failure modes:

• Wrong pinout. T568A at one end and T568B at the other creates an unintended crossover. Modern auto-MDI-X usually masks this, which makes it worse: it works here and fails there.
• Excessive untwist, as above.
• Poor crimp, where a conductor does not make solid contact. This is the classic intermittent fault — it works until someone moves the cable.
• Damaged conductors from over-stripping.
• Split pairs, where all eight conductors are in the right positions but the pairing is wrong. Continuity testers pass this happily because every pin maps correctly end to end; only a tester that measures crosstalk detects it. It is the most deceptive termination fault there is, and it produces a link that works at 100 Mbps and fails at gigabit.

For fibre, improper termination means a poor polish, a scratch, or — most commonly — a dirty end face. A fingerprint attenuates enough to cause errors while the link still shows up. Clean before replacing.

TX/RX transposed

Transmitter (TX)/Receiver (RX) transposed means the transmit and receive paths are crossed, so both ends transmit into each other's transmitters and neither hears anything.

On fibre this is routine and easily fixed — a duplex LC connector inserted the wrong way round gives exactly this. The symptom is clean: no link at all, with both sides showing the port down, and no errors, because nothing is being received to be counted. The fix is to swap the two strands at one end only.

On copper it appears as a crossover/straight-through mismatch, usually masked by auto-MDI-X on modern equipment and visible on older or cheaper hardware.

The diagnostic that identifies it: an optical power meter shows light arriving at neither end, whereas a broken fibre shows light leaving one end and not arriving at the other.

Hardware issues

When the cable and its terminations are sound, the remaining possibilities are the devices:

• Failing transceiver. Optics degrade — a light level slowly falling is a transceiver reaching end of life, and most equipment can report optical transmit and receive power, which is the fastest way to confirm it.
• Failing port. Test by moving the cable to a known-good port. If the fault follows the cable it is the cable; if it stays with the port, it is the port. That substitution test is the core technique of this whole objective.
• Failing NIC at the host end, testable the same way.
• Power problems, including a PoE device drawing more than the switch budget, which produces devices that boot, run briefly, and reset.
• Overheating, from the airflow mistakes in the physical installations lesson. A device that fails predictably in the afternoon is a thermal fault.

The general method for all of these is substitution: swap one variable at a time — cable, port, transceiver, device — and observe whether the fault moves. It is slower than theorising and it converges reliably, which under pressure is worth more.