How to troubleshoot low-volume packet loss in GCP networks?

PCNE By islever Editorial Last updated Aug 29, 2026

Short answer

A Create a packet mirroring policy that is configured with your VM as the source and destined to a collector. Analyze the packet captures.

Question

You are troubleshooting an application in your organization's Google Cloud network that is not functioning as expected. You suspect that packets are getting lost somewhere. The application sends packets intermittently at a low volume from a Compute Engine VM to a destination on your on-premises network through a pair of Cloud Interconnect VLAN attachments. You validated that the Cloud Next Generation Firewall (Cloud NGFW) rules do not have any deny statements blocking egress traffic, and you do not have any explicit allow rules. Following Google-recommended practices, you need to analyze the flow to see if packets are being sent correctly out of the VM to isolate the issue. What should you do?

Create a packet mirroring policy that is configured with your VM as the source and destined to a collector. Analyze the packet captures. Correct Answer
Enable VPC Flow Logs on the subnet that the VM is deployed in with SAMPLE_RATE = 1.0, and run a query in Logs Explorer to analyze the packet flow.
Verify the network/attachment/egress_dropped_packets_count Cloud Interconnect VLAN attachment metric.
Enable Firewall Rules Logging on your firewall rules and review the logs.

Key Takeaways

Tests troubleshooting methodology for low-volume traffic, with the common trap being the assumption that VPC Flow Logs with a 1.0 sample rate guarantees complete packet capture.

This question evaluates the optimal method for capturing and analyzing intermittent, low-volume network traffic in Google Cloud. Community consensus strongly favors packet mirroring over VPC Flow Logs to guarantee complete visibility and isolate connectivity issues.

Common mistake: Option B is frequently selected due to its simplicity, but VPC Flow Logs rely on aggregation and sampling mechanisms that can still drop rare or bursty packets, making them unreliable for precise low-volume troubleshooting.

Expert Analysis

Why the Answer Is Correct

Packet mirroring duplicates all traffic from the source VM to a dedicated collector appliance, guaranteeing complete visibility regardless of volume or frequency. It bypasses sampling limitations inherent in log-based solutions and aligns with Google’s recommendation for deep packet inspection when exact packet-level analysis is required. This approach directly isolates whether egress packets leave the VM correctly before hitting potential network boundaries.

Why the Other Options Are Wrong

VPC Flow Logs aggregate metadata and apply sampling even at 1.0, which can miss intermittent flows entirely. The Cloud Interconnect metric only shows dropped packets at the attachment layer, not end-to-end VM egress behavior. Firewall logging is unnecessary here since NGFW rules lack deny statements and adding it creates overhead without verifying actual transmission.

Community Comment Notes

Candidates frequently debate Options A and B, but experienced test-takers note that VPC Flow Logs inherently sample flows despite the 1.0 setting, potentially dropping rare data. Comment [3] correctly emphasizes that packet mirroring ensures every single packet is captured, making it the superior choice for this scenario. Multiple users reference Google’s official documentation on flow log sampling limits to justify selecting mirroring over logging.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always match the troubleshooting tool to the traffic profile; use packet mirroring for low-volume or high-fidelity packet analysis, and reserve VPC Flow Logs for broader traffic pattern monitoring. Carefully scan for keywords like "intermittent," "low volume," and "isolate the issue," as they signal a need for complete packet capture rather than aggregated logs.

Community Votes

75%

25%

75% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

1f01b87 👍 2 Answered A

Correct answer is either A or B. I'm leaning towards A.
mohitms1996 👍 1 Answered B

(A) Create a packet mirroring policy and analyze captures. ✅ Packet Mirroring is useful for deep packet inspection. ❌ Not ideal for low-volume, intermittent traffic—it captures all packets but requires additional setup and a collector. ❌ High overhead—not Google's first recommended step for troubleshooting basic connectivity. 🔴 Not the best first step. (B) Enable VPC Flow Logs with SAMPLE_RATE = 1.0 and analyze in Logs Explorer. ✅ VPC Flow Logs provide packet-level visibility, showing if packets leave the VM. ✅ Setting SAMPLE_RATE = 1.0 ensures all packets are logged (which is important for low-volume traffic). ✅ Recommended Google Cloud practice for network troubleshooting. ✅ Can quickly confirm if packets are sent to the VLAN attachment. 🟢 Best option!
Gwendal 👍 1 Answered A

With VPC Flow Logs, logs are sampled. Some packets in very low volume flows might be missed even with SAMPLE_RATE = 1.0 per my understanding. Here the volume is low, so I would go for packet mirroring because it captures all packets. https://cloud.google.com/vpc/docs/access-flow-logs#some_flows_are_missing https://cloud.google.com/vpc/docs/flow-logs#log-sampling

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All PCNE Questions

Access 80 questions with complete answers and detailed explanations.

View Full PCNE Practice Test →

← Back to PCNE Study Guide