Apple Network Engineer (Mid-Level) Interview Preparation Guide

Direct answer
Difficult feedback to a mentee works best delivered privately, tied to a specific, observed behavior and its concrete impact, not to the person's character, and followed up on to confirm the message landed and something changed. The delivery mechanics matter less than getting three things right: timing (soon after the behavior, not saved up), specificity (a real example, not a vague pattern), and follow-through (checking back in, not treating the conversation itself as the fix).

Structured elaboration

Before the conversation

• Get the facts straight: what exactly happened, what was the impact, and is this a one-off or a pattern. Vague feedback ("you need to be more careful") is unusable; a mentee can't act on a mood, only on a specific instance.
• Decide the stakes. Not all critical feedback carries the same weight:
  • A routine performance gap (missed a deadline, sloppy code style) can wait for the next scheduled 1:1.
  • An ethical or safety concern (something in the person's work poses real risk if it ships) changes the calculus: it needs to happen immediately, privately, and is often paired with a concrete containment step (pause the change, get a second reviewer), not just a conversation.
• Decide the medium: a private 1:1, not written feedback and not in front of the team, unless the finding also needs to be logged for safety or compliance reasons.

Delivering it

• Lead with the specific behavior and its impact, not a label: "this change would have introduced X" is usable; "this was careless" is not.
• Ask before you assert. The mentee may know something you don't (a constraint you weren't aware of); asking "walk me through the reasoning" often surfaces that before you've over-committed to a judgment.
• Separate the person from the work. The message is "this output has a problem," not "you are the problem."

When the power dynamic is reversed

Feedback isn't always flowing to someone junior. Giving critical feedback to a mentee who is more senior, more tenured, or simply more confident than you requires the same content but a different frame: lead with genuine respect for their experience, be more explicit that you're not questioning their general competence, and expect (and plan for) more pushback. Defensiveness here is a normal reaction to a status threat, not necessarily a sign the feedback was wrong; the skill is staying anchored to the specific evidence instead of either escalating or backing down.

After the conversation

• Confirm shared understanding before ending: ask them to restate what they heard.
• Agree on a concrete next step and a checkpoint to revisit it, not just "let's see how it goes."
• Follow up. Feedback that isn't revisited quietly signals it wasn't actually important.

Worked example

Situation

During a code review, I found a race condition in an interrupt service routine (an ISR, the block of code that runs automatically when a hardware event interrupts normal execution) a mentee had written: a shared buffer was being written from the ISR without disabling interrupts around the critical section (the stretch of code that touches shared data and must not be interrupted mid-update), so a preemption (the interrupt firing and pausing the main code at an unpredictable moment) at the wrong moment could corrupt data intermittently and unpredictably.

Why this wasn't routine feedback

This wasn't a style nitpick. Left unaddressed it was a latent, hard-to-reproduce bug that could surface in the field. That pushed it from "note it for next time" to "we talk today, and the change doesn't merge until it's fixed."

The conversation

I asked the mentee to walk me through what happens if the interrupt fires mid-write, rather than telling them the bug outright. They found the failure mode themselves partway through the explanation, so the fix landed as their own understanding rather than my correction. We then talked through the general pattern (anything touching state shared between an ISR and main-line code needs an explicit critical section) so it would generalize past this one bug.

Follow-through

I asked them to check two other places in the codebase where similar shared state existed, as a way to prove the concept had stuck rather than just fixing the one instance. Both had the same latent issue.

Result

The immediate bug was fixed before merge, and the mentee started flagging similar patterns unprompted in their own future changes, which was the real signal the feedback had generalized rather than just been complied with once.

Trade-offs & pitfalls

• The feedback sandwich dilutes the message. Padding critical feedback between two compliments is a common junior instinct; it often causes the actual point to get lost. Genuine positive feedback is worth giving, but on its own merits, not as camouflage for the critical part.
• Waiting to "collect examples" delays too long. A senior mentor gives feedback close to the event; batching several issues into one big conversation later makes it feel like an ambush and makes each point harder to act on.
• Not distinguishing skill gap from something more serious. A performance gap and an ethical or safety issue call for different urgency and different documentation; treating a safety issue as routine coaching is itself a failure mode worth naming.
• Confusing "they got defensive" with "I was wrong." Especially with a more senior or tenured mentee, defensiveness is a predictable reaction to a status threat. A junior mentor backs off; a senior one stays anchored to the specific evidence while still leaving room for the other person to be right about something they missed.

Direct answer

In the first week, stop the bleeding and claim the system as yours in writing; over the following weeks and months, work through a small number of phases, understand failure patterns, fix the worst recurring one, then build back tests, monitoring, and documentation, each with a milestone you can show and a number that proves things are actually improving.

Structured elaboration

• First week, stabilize and establish ownership: pull the history of recent incidents or failures to find the actual pattern, not the loudest anecdote, put even crude monitoring or alerting in place if none exists, and write a short doc stating what the system does, that you now own it, and what the plan is; send that to stakeholders so "who owns this" stops being a question.
• The following weeks, phased remediation with milestones: a first phase of roughly the next 3 weeks fixes the single highest-frequency failure mode, the quick win that buys you credibility and breathing room for the rest of the plan; a second phase of roughly the next 4 weeks adds test coverage and documentation for the core paths people actually depend on daily, not full coverage everywhere; a third phase covering the remaining weeks up to about 3 months hardens the rest, removes workarounds people have built to route around the system's flakiness, and puts a real runbook in place.
• Measuring progress: track a simple, visible leading indicator, most naturally failures or incidents per week, from a clear baseline, so stakeholders see a trend line rather than taking your word for "it's better now."

Worked example

I inherit a system with a baseline of about 6 disruptive failures a week and no documentation of why. Week 1: reviewing the last 2 months of incident history shows over half of them trace back to one specific recurring cause; I add a basic alert on that specific failure mode so at least we're notified instead of surprised, and send a short ownership note to stakeholders. By week 4, end of phase 1, the highest-frequency failure mode is fixed, and the weekly failure count drops from about 6 to about 3. By week 8, end of phase 2, core-path tests and basic documentation are in place, and the count drops further to about 1 a week. By week 12, end of the roughly 3-month plan, the remaining workarounds are removed and a runbook is in place, and the system is stable at close to 0 failures a week, down from the original baseline of 6.

Trade-offs and pitfalls

A common mistake is spending the first week building the perfect long-term architecture instead of just stopping the most disruptive recurring failure and telling people you own it; credibility comes from visible short-term progress, not a beautiful plan no one has seen work yet. Another failure is skipping the ownership communication step, leaving stakeholders unsure whether problems are still being routed to the previous owner or a whole team. Watch also for declaring success once the failure count drops without also removing the manual workarounds people built around the old flakiness; those workarounds often hide the next failure mode until you take them away.

Direct answer

Capacity planning for a fixed target load is a four-step exercise: measure how much load one instance can safely handle, add a burst/growth buffer to the raw peak, convert that into an instance count, then validate the fleet still meets the target after you lose a zone. The safety margin exists to absorb burstiness, retries, and the cost of running hot for a bounded period, not to compensate for skipping the measurement step.

Structured elaboration

Data to collect

From data to a per-instance capacity number

Run a load test against a single instance (or a fixed-size shard) and raise load until the p99 latency SLO (service level objective: the latency target you've committed to, e.g. p99 under 300ms) breaches, not until CPU hits 100%. That breach point, not the theoretical ceiling, is the instance's safe capacity.

From per-instance capacity to fleet size

1. Planning target = raw peak times a growth/burst buffer.
2. Divide by (safe per-instance capacity times target operating utilization).
3. Round up to whole instances, then round up again to a multiple of the availability-zone count so load balances evenly.

Validate the zone-loss case

After removing one zone's worth of instances, confirm the remaining fleet still covers the raw peak, not the buffered planning target. Running hot for the duration of a single zone outage is an acceptable, bounded trade; running hot while also absorbing organic growth beyond the raw peak is not.

Worked example

A load test on one 4-vCPU instance shows it sustains 1,000 requests/sec at 60% CPU before p99 latency crosses the SLO. That 60% point, not 100%, is the safe ceiling.

Target steady-state operating point: 50% CPU, leaving headroom for GC pauses, noisy neighbors, and the zone-loss case.

Per-instance safe capacity at the 50% target:

Add a 30% burst/growth buffer to the stated 10,000 req/s peak:

Instances needed for the planning target:

Round up to a multiple of 3 availability zones for even spread: 18 instances, 6 per zone.

Validate the zone-loss case. Losing one zone removes 6 instances, leaving 12:

That equals the raw peak exactly: during a single-zone outage the fleet runs at its safe ceiling with zero spare margin, an acceptable, bounded degradation for a rare event but not a state to run in day to day.

Trade-offs & pitfalls

• Over-provisioning for the zone-loss case permanently (running at reduced utilization at all times to cover a rare event) wastes money; treat zone-loss headroom as a temporary, monitored state, not the steady-state target.
• Linear scaling from a single instance's load test breaks down when a bottleneck is shared across the fleet (database connection pool limits, a shared NAT gateway, a shared cache); load-test a small cluster against the real shared dependency, not one box in isolation.
• Retries during partial degradation can multiply effective load two to three times right when capacity is tightest; a plan that ignores retry amplification underestimates the real peak.
• CPU utilization is a proxy, not the constraint. An I/O-bound service can sit at 20% CPU while thread-pool exhaustion still causes timeouts, so the load test's stopping condition should always be the SLO breach, never a resource metric alone.

Approach

• Use a small reusable Jinja2 template that renders a standard Cisco IOS interface block.
• Invoke it in an Ansible task using ios_config with the template lookup so the module receives the rendered lines directly (keeps playbook idempotent and avoids temp files).
• Ensure idempotency by using ios_config (it only pushes diffs), using state=merged, enabling backup and check-mode/diff for safe reviews.

Jinja2 template (interface.j2)

! interface block template
interface {{ interface }}
{% if description is defined and description|length > 0 %}
 description {{ description }}
{% endif %}
{% if ip_address is defined and ip_mask is defined %}
 ip address {{ ip_address }} {{ ip_mask }}
{% endif %}
{% if mtu is defined %}
 mtu {{ mtu }}
{% endif %}
 no shutdown

Ansible task snippet

- name: Render and apply interface config to IOS device
  cisco.ios.ios_config:
    lines: "{{ lookup('template', 'interface.j2') | splitlines() }}"
    backup: yes
    replace: no           # merge with existing config
    force: no             # don't force re-apply identical lines
  vars:
    interface: "GigabitEthernet1/0/1"
    description: "Office uplink"
    ip_address: "10.0.1.1"
    ip_mask: "255.255.255.0"
    mtu: 1500
  check_mode: "{{ check_mode | default(false) }}"

Why this is idempotent and safe

• ios_config compares device config and only sends changes; using replace: no prevents wiping unrelated config.
• lookup('template') produces deterministic lines so repeated runs produce identical input; ios_config then skips no-op changes.
• backup: yes captures pre-change config; run with check_mode or --diff for review before committing.
• Additional safety: use version control for templates, test in lab, and limit tasks to specific interfaces to avoid accidental broad changes.

Requirements & constraints

• IPv6-only internal clients must reach IPv4-only legacy servers.
• Preserve logging/forensics, handle DNSSEC, and support apps that embed IPv4 literals.

High-level design

• Deploy DNS64 resolver in the IPv6-only network (or in cloud VPC) to synthesize AAAA records for IPv4-only hostnames.
• Deploy NAT64 translator (stateless for scaling? Use stateful NAT64 /64:96 or RFC 6052 mapping) at the network edge where IPv6 traffic leaves to IPv4 space (DMZ or egress VPC gateway).

Synthesized prefix

• Use an IPv6 prefix from RFC 6052 for IPv4-embedded addresses, e.g. 64:ff9b::/96 for global translation or pick an owned /96 like 2001:db8:cafe:64::/96 for private translation. Ensure consistent prefix in DNS64 and NAT64.

How mapping works

• DNS64: when AAAA absent, synthesize AAAA = <prefix>::[IPv4 in hex], return to client.
• Client connects to synthesized IPv6 → hits NAT64: translator extracts embedded IPv4, creates/uses mapping and forwards to IPv4 server, translating headers and ports (stateful NAT64 maintains state for return traffic).

Placement & scaling

• DNS64 near clients (reduces latency); NAT64 at egress with load-balancers and autoscaling translators. Use anycast for DNS64; scale NAT64 horizontally with consistent prefix assignment.

Logging & observability

• Log DNS64 syntheses (queries, synthesized AAAA, client). Log NAT64 translations (src/dst IPv6, mapped IPv4, timestamps, ports). Correlate DNS and NAT logs via query IDs, timestamps, client IPs for forensics.

DNSSEC considerations

• DNSSEC-signed zones: DNS64 cannot re-sign responses. Options:
  • Use DNS64 only for unsigned zones.
  • Implement DNS64 that fetches DNSKEY and returns synthesized AAAA while signaling AD bit cleared; better: use a proxy that performs validation and use DNS64-aware stubs or application-layer fallback.
• Document limitations and prefer application-level test.

Apps embedding IPv4 literals

• IPv4 literals won’t be resolved by DNS64; clients must hit NAT64 via IPv6 literal mapping:
  • Provide DNS64-synthesized AAAA for special DNS name that maps to IPv4 literal.
  • Configure DNS64 prefix and advertise to apps; use a proxy (HTTP/HTTPS) or dual-stack gateway to handle literal IPs.
  • For hard-coded IPv4 addresses, implement outbound proxy or use SIIT-DC / stateless translation with routing of 64:ff9b::/96 into NAT64.

Tradeoffs & security

• Stateful NAT64 preserves ports but requires scaling and tracking. Stateless (SIIT) simplifies logs but requires globally routable prefix plan.
• Firewall rules must translate and inspect; consider ALGs and TLS implications.
• Test with DNSSEC, IPv6-only clients, and applications that embed IPs; document known failure modes.

Clarify requirements & assumptions

• Remote users need access to SaaS (O365, Salesforce) and internal web apps (HA web tiers behind app servers).
• Support corporate devices + BYOD, MFA mandatory, 99.9% uptime SLA, centralized logging for audits.

High-level architecture

• Deploy cloud-hosted ZTNA gateway (or SASE vendor) that brokers all web/SaaS/internal app access.
• Integrate existing IdP (Azure AD/Okta) via SAML/OIDC for authentication and SCIM for provisioning.
• Device Posture Service (agent + agentless posture via MDM/MDM APIs) feeds posture to ZTNA.
• Enforcement plane (micro-segmentation policies) sits at gateway and enforces least-privilege access to specific app URLs/ports.

Access flow

1. User authenticates to IdP + MFA.
2. IdP returns identity token to ZTNA gateway.
3. ZTNA queries device posture service (device health, patch level, disk encryption).
4. Policy engine evaluates identity, device posture, time, location, risk score → issues short-lived access token.
5. Gateway creates per-session ephemeral connection (reverse-proxy or connector to internal apps). No inbound VPN tunnels.

Policy & least-privilege

• Role-based + attribute-based policies: user role, group, device posture, sensitivity label of app.
• Enforce allow-list of specific FQDNs, HTTP methods, source port/egress controls; time-limited sessions.
• Just-in-time elevation for sensitive apps with step-up MFA and approval workflow.

Logging & visibility

• Centralized logs: IdP logs, ZTNA gateway session logs, device posture events, NAC/MDM events forwarded to SIEM (Splunk/Chronicle).
• Capture: user, device ID, posture snapshot, accessed URL, bytes, session duration, syscall-level telemetry if available.
• Correlate for real-time detections and automated response (block, revoke token).

Reduced lateral movement vs VPN

• No flat network access: users get application-level access only (proxy), not network-level subnets.
• Micro-segmentation + per-session credentials prevent reuse of network connections to pivot.
• Short-lived access tokens and continuous posture checks revoke access when risk changes, closing lateral paths typical in persistent VPN tunnels.

Scalability & operations

• Use global ZTNA gateways with regional connectors for internal app connectivity; autoscale gateways behind LB.
• CI/CD for policy changes, roll out posture checks gradually, and implement canary pilot groups.
• Trade-offs: initial agent deployment and SSO integration effort; ensure high availability of connectors for internal apps.

This design gives secure, least-privileged, observable access for remote users while limiting lateral movement compared to traditional VPNs—aligning with network engineering constraints of availability, performance, and manageability.

I would treat this as both a routing problem and a data-sovereignty problem.

Design approach

• Keep the entire user path inside EU: EU edge, EU ingress, EU compute, EU storage, and EU backups.
• Use two or more EU regions for high availability, but never fail over to a non-EU region.
• Make the routing policy region-aware and compliance-aware, so the control plane cannot choose an out-of-EU destination.

Network and routing model

• Advertise EU service prefixes only from EU PoPs or EU regional load balancers.
• Use a global traffic manager that is constrained to EU targets only.
• Prefer active-active across EU regions for stateless tiers, with synchronized config and data replication limited to EU.
• For stateful components, use regional primaries with EU-only standby replicas and tested failover runbooks.

Dependency model

• Audit every upstream dependency: identity, logging, KMS, DNS, queues, and observability.
• Replace any non-EU dependency with an EU-hosted or EU-terminated equivalent.
• Block accidental egress with firewall policy, route filters, and policy-as-code.

Why this works
This gives resilience during a regional outage while preserving the compliance boundary. The key is that failover is allowed only within an approved EU failure domain, and every dependency that could leak traffic or data is either regionalized or explicitly controlled.

Clarify goals & constraints

• RTO < 15 min, minimal manual steps, automated validation, cross-region primary ↔ DR.

High-level approach

• Active–passive with hot DR (pre-provisioned infra & tunnels), BGP for network-level failover, DNS low-TTL as application-level fallback. Automate runbook via orchestration (Terraform + Ansible + IaC pipelines).

Routing failover: BGP vs DNS

• Primary: advertise prefixes from primary AS via BGP to cloud/on‑prem peers. DR: keep BGP sessions established but withdraw primary routes on failover and advertise DR prefixes. BGP gives sub-15min cutover and preserves TCP continuity where possible.
• DNS: set low TTL (30–60s) and health-checked records (Route53 health checks / external monitor) as secondary. Use DNS only for global load balancing and as fallback for clients without BGP reachability.

Tunnel pre-provisioning

• Pre-establish IPsec/DMVPN/CloudTransit tunnels between sites and peers; keep them up but idle. Use BGP over tunnels with next-hop tracking. Automate tunnel rekeying and monitoring; store keys in vault and automate rotation.

Data replication

• Synchronous for critical DBs within latency bounds; otherwise asynchronous with write-ahead logs and point-in-time recovery. Use replication lag monitoring and automatic promotion scripts ensuring consistent application state. Ensure storage snapshots replicate to DR region regularly.

Automation & orchestration

• Failover playbook that: validates DR health, withdraws primary BGP adverts, enables DR adverts, promotes DB, updates DNS if needed, and runs smoke tests. All steps executable via CI/CD.

Testing plan

• Weekly automated DR drills in a staging window: simulate BGP withdraw, test tunnel failover, promote DB, run full integration tests (API, auth, data integrity). Metrics: total RTO measured, replication lag, packet loss, session interruption. Quarterly full failover with rollback validation.

Trade-offs

• BGP complexity and coordination with providers vs faster network-level switch; DNS simpler but higher client dependency. Choose BGP primary + DNS as controlled fallback for fastest, reliable cutover.

Clarify goal & constraints

• Steer ~10 Gbps for a single high-volume /24 (or aggregated prefix) onto a preferred path built across multiple IXPs + one or more transit providers.
• Requirements: influence inbound, control outbound, automate diurnal shifts, monitor path & throughput, and fast failover if capacity falls.

High-level approach

• Use selective announcements at IXPs + BGP communities to influence inbound; control outbound via local‑pref and next-hop selection; automate schedules with Ansible/Netconf + controller; monitor via flow telemetry and BGP/active probes; failover by dynamic policy changes and prefix withdrawal if needed.

Inbound traffic engineering (influencing how others send to you)

• Selective announcement: advertise the prefix at preferred IXPs where the target transit/peer has good reachability; withdraw announcements at non-preferred IXPs to bias inbound toward preferred path.
• BGP communities: tag announcements toward transit providers to set upstream local preference, prepending, or selective de‑aggregation. Example patterns:
  • Ask transit A to set a high local‑pref for your prefix via a “accept-as‑preferred” community.
  • Request upstreams to prepend your AS on non-preferred peers (longer AS‑path -> less attractive).
• IX peering: advertise the prefix via an IXP fabric where preferred transit peers are present; use selective more‑specifics (/25 split) only at preferred IXPs if acceptable for routing policy and RPKI constraints.
• Use AS‑path prepending + NO_EXPORT/NO_ADVERTISE where supported to prevent unwanted propagation.

Outbound path control (how you send)

• Per-prefix route‑maps to set local‑pref towards preferred transit for the target prefix.
• Next‑hop self + IGP metrics: adjust IGP link weights so egress chooses the intended IXP/transit.
• ECMP steering via hashing tweaks or per‑flow deterministic load‑balancers if multiple equal-cost egresses needed.
• Use BGP communities to request downstream prepends or MED from peers when symmetry matters.

Automation & diurnal shifts

• Maintain a schedule (CRON or orchestration service) in a controller (Ansible Tower, Nornir, or custom app) that:
  • Runs safety checks (current throughput, error rates).
  • Pushes BGP policy changes (route-maps, communities) via Netconf/RESTCONF or SSH templates.
  • Supports quick rollback and dry-run validation.
• Integrate with a capacity planner that uses historical telemetry to shift more than 10 Gbps to preferred path during peak windows and relax outside peak.
• Use feature flags and staged rollouts: change one IXP’s announcements first, observe, then continue.

Monitoring & validation

• Flow telemetry: sFlow/IPFIX on edge routers to measure per‑prefix throughput and confirm ~10 Gbps is on preferred egress/ingress.
• BGP monitoring: route analytics (BGPStream/ExaBGP + collector) to confirm active AS‑path and communities; BGP RIB diffs to confirm announcements/withdrawals.
• Active path validation: traceroute/tcping/TWAMP from probes placed in major upstreams/IXPs to verify path.
• Packet loss/latency: SNMP/Telemetry (gNMI) + IP SLA; set alerts on >1% loss or latency >X ms.
• SLAs: synthetic flows and throughput tests (iperf or HTTP streams) to validate end‑to‑end capacity.
• Dashboards/alerts: thresholded alerts if preferred path throughput drops below 90% of target or if latency/loss exceeds limits.

Failover strategies

• Automatic tiered failover:
  1. Detection: telemetry detects sustained throughput drop or increased loss on preferred path.
  2. Fast local changes: controller increases local‑pref toward alternative transit(s) and withdraws selective announcements at affected IXP(s). These are small, automated BGP policy pushes (under 30s).
  3. Progressive withdrawal: if issue persists, withdraw more specific announcements or shift more egress to backups.
  4. Traffic damping: if an upstream has limited capacity, gracefully shift using weighted announcements rather than full flips to avoid congestion.
• Graceful degradation: advertise wider aggregates at all IXPs if preferred path fails, letting global shortest‑path routing distribute load.
• Safety: rate‑limit / validate changes to avoid route churn; maintain manual override and an incident runbook.

Operational practices & trade-offs

• Use as‑specifics for fine control but beware routing table growth and filtering policies of some peers.
• Pre-coordinate communities and selective announcements with transit providers/IXPs to ensure support and avoid filtering.
• Test failover periodically (game days) to verify automation and rollback paths.
• Keep route and config change logs for audit; use incremental canary changes.

Example minimal automation flow (pseudo)

• Monitor reports preferred_path_util < 9Gbps for 2 min -> Ansible runs playbook:
  • apply route‑map change: increase local-pref to backup transit
  • withdraw /25 at preferred IXPs
  • emit alert and run validation flows

This design balances active inbound influence (communities, selective announce), deterministic outbound egress (local‑pref/IGP), automated scheduled shifts, robust telemetry to confirm 10 Gbps placement, and fast, safe failover with staged policy changes.

Answer (Network Engineer — minimum interface-level metrics)

1) Interface Utilization

• Metric: bytes/sec (bps) and packets/sec (pps) per direction
• Polling: 30s–1m for bps; 30s–1m for pps (higher for realtime troubleshooting)
• Detects: saturation, oversubscription, and sustained high-utilization causing latency and drops

2) Input / Output Error Counts

• Metric: cumulative error counters (counts) — e.g., input errors, output errors
• Polling: 1–5m (capture trends)
• Detects: framing/FCS, alignment, duplex mismatches, physical layer faults

3) CRC / FCS Errors

• Metric: CRC/FCS error counts (counts)
• Polling: 1–5m
• Detects: cabling, transceiver, or signal-quality issues causing corrupted frames

4) Interface Discards / Drops

• Metric: rx/tx discards (counts) and queue drops (counts)
• Polling: 30s–1m
• Detects: congestion, policing/shaping mismatches, buffer exhaustion, ACL or policer drops

5) Collisions (for half-duplex/legacy links)

• Metric: collision counts (counts)
• Polling: 1–5m
• Detects: duplex mismatch or legacy Ethernet issues

6) Packets/sec and Average Packet Size

• Metric: pps and average bytes/packet
• Polling: 30s–1m
• Detects: microbursts (high pps with low avg size) that cause queue drops without high bps

7) Interface Up/Down and Flap Count

• Metric: operational state (up/down) and flap counters (counts)
• Polling: immediate alerts + 1m polling
• Detects: link failures, unstable transceivers, intermittent physical faults

Notes:

• Use SNMP (ifInOctets/ifOutOctets, ifInErrors, ifOutErrors, ifInDiscards, ifOutDiscards, ifInUcastPkts) or gNMI/Telemetry where available for finer granularity.
• Alerting: combine absolute thresholds (e.g., >85% utilization sustained 5m) with relative changes (spike in CRCs or sudden discards) to reduce noise.