The Issue That Only Appeared Under Load

Situation

Random latency spikes. Intermittent packet loss. Impossible to reproduce consistently. Everything looked fine under standard monitoring — until traffic levels increased. Then the symptoms reappeared: calls dropping, applications timing out, user complaints spiking.

The problem was real. The impact was measurable. But every time an investigation was initiated, the symptoms had subsided — and the infrastructure looked entirely healthy. This was the hardest case to diagnose precisely because the evidence was self-concealing.

Why Standard Monitoring Missed It

Standard monitoring tools showed nothing unusual. Average metrics are inherently deceptive — they conceal the brief, intense peaks where failures actually occur. The evidence only existed in the moments that standard tooling was never capturing.

A monitoring system that records average utilisation over one-minute intervals will show 40% average bandwidth usage on a link where microbursts are saturating the link for 200 milliseconds every few seconds. Those 200-millisecond saturations are real, they drop packets, they cause latency spikes — and they are invisible in one-minute averages.

This is not a failure of the monitoring tools. They were doing what they were designed to do. The problem was relying on average-based monitoring to detect peak-load failures — a mismatch between the measurement approach and the nature of the problem.

What Was Actually Happening

• Microbursts overwhelming interface buffers during peak periods — brief, intense bursts of traffic exceeding interface buffer capacity, causing packet drops that appeared random from the application layer
• Buffer limitations on network devices causing silent drops under sustained load — devices that had been specified for average traffic conditions were not sized for the actual traffic patterns
• Inefficient traffic distribution across available links — traffic was concentrated on specific paths rather than distributed across available capacity

The microbursts were a consequence of traffic patterns that were entirely normal for the organisation's workload — synchronised activity during certain periods of the day. When multiple users or systems generated traffic simultaneously, brief but intense peaks occurred that exceeded the buffering capacity of the network devices in the path.

What FM-NetSec Nordic Did

• Optimised traffic distribution across links to eliminate concentration points — ensuring that peak-load traffic was distributed across available paths rather than concentrated on specific interfaces
• Tuned interface and buffer behaviour for peak-load conditions — adjusting device configuration to handle the actual traffic patterns present, not the average conditions
• Improved load balancing to distribute traffic more effectively — implementing appropriate load balancing that accounted for real-time traffic conditions rather than static configuration

"If you only look at averages, you miss critical failures."

This case required both a different diagnostic approach — moving from average-based to peak-aware measurement — and a deep understanding of how traffic patterns interact with device buffer behaviour. The solution required no additional hardware. The existing infrastructure was capable of handling the load. It required configuration changes that aligned the traffic distribution and buffering behaviour with the actual patterns the network was experiencing.