A wastewater-plant WLAN drops only during rare overnight chemical-delivery windows, but the overnight capture buffer wrapped and lost the incident. What configuration lesson applies?
Select an answer to reveal the explanation.
Short Explanation
Rare overnight glitches laugh at tiny RAM rings that eat their own tail. Give the capture a big enough buffer—or write to disk—so the chemical-truck moment is still there in the morning.
Full Explanation
Intermittent faults demand capture persistence across the rare window when they appear. At a wastewater plant where WLAN drops only during overnight chemical-delivery windows, a buffer that wrapped and lost the incident teaches that capture buffers must be sized—and/or save-to-disk or rolling files enabled—so long observation windows do not overwrite the event before it is preserved. Expert analysis cannot reconstruct frames the ring discarded.
Always limiting captures to 1 MB so files stay emailable fails by concept: tiny caps guarantee gaps for rare overnight events. Disabling save-to-disk because RAM rings never lose intermittent faults fails by concept: RAM rings wrap by design and are exactly how rare incidents disappear. Stopping capture whenever utilization exceeds 10% fails by concept: that abandons monitoring during busy or anomalous periods when evidence is most needed.
Exam caveat: CWNE capture planning for intermittent municipal OT/ICS-adjacent WLAN faults emphasizes duration and storage strategy, not only filter cleverness.
Operational check: Before the next chemical-delivery window, configure rolling PCAP files or adequately large disk capture on a plant-side sniffer, verify free storage, and confirm the overnight window is fully retained after the shift.