One of the most useful pieces of information for me when troubleshooting is network activity. Both network monitors and traffic flows can often tell you exactly what the problem is so you don't have to spend five minutes collecting data samples.
A ring bufferred dumpcap is a huge time saver. Narrows the scope of troubleshooting quickly and reliably. Start with looking at what actually happened on the wire for X problem. Then use the rest of the tools/logs etc... to determine why it happened that way.
Comments
One of the most useful pieces of information for me when troubleshooting is network activity. Both network monitors and traffic flows can often tell you exactly what the problem is so you don't have to spend five minutes collecting data samples.
A ring bufferred dumpcap is a huge time saver. Narrows the scope of troubleshooting quickly and reliably. Start with looking at what actually happened on the wire for X problem. Then use the rest of the tools/logs etc... to determine why it happened that way.