The central problem
Turn symptoms into evidence.
Good network reasoning separates the mechanism from the symptom. Start with the boundary, identify the evidence, and test the explanation that accounts for the observation.
Anchor the investigation
Compare the failure with a known-good baseline.
A symptom becomes more useful when it is tied to a time and a comparison. Record when the failure started, what changed nearby, and how the same path behaved when it was healthy.
A baseline does not need to be perfect or identical. It gives the investigation a reference so that a probe can distinguish a new network condition from normal variation.
Build the model
Four useful signals
Scope
Identify who, what, and when is affected.
Layer
Separate link, network, transport, and application evidence.
Probe
Run a focused check that can distinguish causes.
Change
Apply one controlled fix and observe the result.
Mini investigation
Inspect the evidence
Select the observation and identify the most direct next check.
This observation narrows the mechanism but does not prove every downstream layer.
Compare it with one nearby-layer check.
Knowledge check
Test your model
Answer five questions.