When the network problem is electrical
Teams escalate “the network” because the symptom showed up in a ping or a PLC timeout. The mechanism may be a dirty copper pair, a switch fault, or an electrical event that the network is faithfully reporting as errors. The studio’s cross-domain habit is to keep two timelines: packet counters and electrical quantities, same clocks if you can. If they move together, stop buying patch cords. Read EMI / SNR, power quality, and active diagnostics as one file.
How the investigation is actually run
Start with two timelines on one page: interface errors and electrical events. If you cannot get a current or voltage trace, say the electrical side of the file is empty instead of filling it with folklore. Stand at the tray during the known trigger. A CRC that tracks a motor start is not a mystery protocol. A reboot that tracks a sag is not a bad NIC. A laptop that browses while a PLC times out is not proof the LAN is healthy; it is proof the protocols differ.
Bonding mistakes show up as shield current and as voltage between “grounds.” UPS transfers show up as IT tickets that never mention bypass. Harmonic-rich trays show up as errors that follow a process, not a firmware date. Hand the file to the discipline that owns the mechanism. Keeping it in the NOC out of habit wastes months.
The conclusion names an electrical mechanism with a network presentation, a genuine data-path defect, or an incomplete file. It does not pick a team to blame. The next measurement should kill one of the remaining explanations.
Symptoms that pretend to be IT
Errors at motor start. Overnight “fine,” daytime “bad” with process. Cameras reboot on elevator banks. A radio that works until a welder strikes. OT that fails while a laptop on the same VLAN browses the web — different protocols, different immunity. See EMI, SNR and communications and intermittent network faults.
Causes
Voltage sags that reset endpoints (the network is a victim). Shield current from a bonding mistake — grounding investigation. Harmonic-rich trays. PoE browning out. A UPS transfer that the IT log never named: UPS under real load.
Investigation
Do not start with a protocol analyser if the error counter tracks a current spike. Log both. Inspect the tray. Measure between grounds. Interpret voltage captures as in interpreting power-quality data. Interface thinking: engineering at system interfaces.
A conclusion either names an electrical mechanism with a network presentation, a genuine data-path defect, or an incomplete file. It does not pick a team to blame.