A student reported yesterday that a laptop connected and then had very poor throughput for an hour. Nothing was tracing the client at the time. Where should the engineer look first for that past hour?
Select an answer to reveal the explanation.
Short Explanation
You cannot start a trace yesterday. Assurance already kept the laptop's health for that hour, so your first look is the client history in Catalyst Center. A reload does not play the afternoon back.
Full Explanation
Catalyst Center client assurance retains health, onboarding, and RF context for clients over time. For a complaint about a specific laptop during an hour that has already ended, and with no trace running then, that history is the first place that can still contain the event. A radioactive trace started now captures the next attempt. It does not reconstruct an hour that was not being traced. A controller reload drops clients and does not print yesterday's throughput. There is no reload output that replays one laptop's afternoon. Sniffer mode captures live 802.11 frames going forward. It does not store yesterday's frames, and enabling it on every access point would also take them out of service. Exam caveat: assurance history depends on the laptop having been seen by the telemetry path. If the site was not reporting to Catalyst Center, the history will be empty and you are left with whatever the controller still has. Operational check: open the laptop in client assurance, set the window to yesterday's hour, and read onboarding, RSSI, and throughput before you change the WLAN.