Migrations stall at 21%: frame sizes and half-configured bonding Start this lab

Why this matters

Networks fail convincingly when two ends disagree. Both faults here are half-finished work: a frame size set on one host, a bond configured on one side. Each produces symptoms that point away from the cause.

Concepts

Objectives graded

• Read the refusal the migration returns instead of retrying it.
• Compare frame size on every host and on the path between them.
• Find the port group whose teaming policy the physical switch was never told about.
• Choose one consistent answer at each end rather than half-configuring the other.
• Prove the repair by migrating a guest and reading the score again.

MITRE ATT&CK coverage

Two ends of a network that disagree produce intermittent, deniable failures — the same signature as traffic being interfered with — so proving the mismatch and closing it is how you rule the interesting explanation in or out.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A reversible action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The platform was worked in the console rather than described from the ticket.

  investigation · weight 15

• The platform was measured before it was touched.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• The stalled migration was traced to a named host rather than blamed on the network.

  investigation · weight 10 · T1016 System Network Configuration Discovery (Discovery)

• The mismatch was recorded as a figure both ends can be checked against.

  investigation · weight 10 · T1016 System Network Configuration Discovery (Discovery)

• The second, quieter mismatch was found rather than stopping at the first.

  investigation · weight 10 · T1046 Network Service Discovery (Discovery)

• Both ends were brought back into agreement and the result measured.

  configuration · weight 15 · T1016 System Network Configuration Discovery (Discovery)

Common mistakes

• Retrying a refused migration rather than reading what it says.
• Fixing the frame size and stopping before finding the second mismatch.
• Changing the host end without confirming the physical switch.
• Calling it fixed without migrating a guest to prove it.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.