Your floor plan and your port database disagree about which socket feeds the visitor lounge — how do you get ground truth, and what does it cost?

## Two records, no joint owner The facilities space plan and the network port database describe overlapping reality from opposite ends and are maintained by teams with different incentives, different change processes and no shared identifier. Facilities knows rooms and moves walls; the network team knows ports and moves patch leads. Neither is notified when the other acts. That is why a socket ends up described as "spare" in one system and as a lounge outlet in the other — and why the disagreement is normal rather than a sign of neglect. The operative point for an interview: **neither record is evidence.** Both are assertions typed by a person, and the port description field is the record already known to be wrong. A candidate who resolves the conflict by trusting one of them has not resolved anything. ## What the switch can and cannot prove The switch is the only witness that is generated rather than typed, and its testimony has a hard limit. | Signal | What it proves | What it does not prove | | --- | --- | --- | | Link state | Something was electrically connected when you looked | That the socket is unused, or where it is | | Interface counters and last-input time | Traffic passed, and roughly when | Which room, or whether the traffic was legitimate | | Address table entries | How many endpoints are speaking on the port | Their identity — addresses are asserted | | Neighbour discovery data | The attached device announced a name and type, if it announces at all | Anything about a device that stays quiet, or about the wall plate | | Address-assignment and authentication logs | An endpoint asked for and received service | The physical location it asked from | Every row stops short of the same thing: geography. The mapping from switchport to wall plate exists only as copper between a patch panel and a plate, so it can only be established physically — a tone injected at one end and traced at the other, plate by plate, with the panel re-labelled as you go. ## The direction-of-claim trap The most common error is concluding that a port with no link and no recent counters is unused. It proves only that nothing was transmitting at the moment you looked. Real counter-examples are everywhere: an AV cart wheeled in monthly, an auditor's desk occupied one week a quarter, a floor box under a carpet tile whose lead is coiled in a drawer. Any "unused ports" list built from a single snapshot will contain live business services, and the first outage from shutting one is what discredits the whole exercise. Evidence has to be a window — weeks of link and counter history — not a reading. ## What the walk actually costs - **Engineer time**, in days per floor, two people where rooms cannot be entered alone. - **Access**: escorts for secured areas and the comms cage, bookings for meeting rooms, out-of-hours slots for spaces you cannot disturb. - **Disruption risk**: tracing means unplugging things, and something always turns out to matter. - **A re-labelling pass**, which is the part that makes the result reusable and the part most likely to be cut. - **A recurring survey**, because the map is true on a date. Without a hook into the facilities change process, it is stale within a quarter. ## What the walk finds that no database has This is the value that justifies the cost, and it is worth naming in an interview because it is always the same list: desk-side unmanaged switches fanning one port into five; docking stations chained behind phones; floor boxes and under-desk plates that appear on no plan; ports labelled "spare" carrying traffic right now; and rooms whose designation changed without a single record being updated — the training room that became the visitor lounge with its staff-VLAN sockets intact. ## Turning the walk into something that survives A one-off audit produces a document; what you need is a control. Three things make the result durable: one identifier shared by both systems so a plate can be named the same way in each; a rule that no patching happens without the record being updated, enforced by whoever holds the closet key; and a cheap recurring diff — compare live link and counter evidence against the database and investigate anything that lights up on a port the database calls spare. That last check is also a detection: a "spare" port that starts passing traffic in a public room is exactly the event this whole topic exists to catch. ## What an interviewer is listening for That you refuse to treat either record as truth, that you know precisely where the switch's evidence stops, that you cost the walk honestly including access and escorts, and that you say out loud that the answer decays. Candidates who describe only the tracing have done the audit; candidates who describe the hook into the change process have kept it.