Diagnostic tools and troubleshooting
Lesson 3 of 6
3Diagnostic tools and troubleshooting
The big pictureThe difference between a beginner and a pro in networking is not how many commands they know, but the order. The beginner restarts the router and tries ten random things. The pro asks five questions in order, and every answer removes half the possibilities.
What the picture shows: traceroute sends packets whose lifetime grows by one each time. Every router where one dies sends a message back, revealing the path hop by hop.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
When the internet is down, act like an electrician: do not open the wall before checking the plug is in. Ask in order: am I connected? do I have an address? can I reach the router? can I reach the internet by number? do names work? The first "no" is where the problem is. Each question has one command, and most of the time you need nothing more.
The bottom-up method follows the OSI model; the alternatives are top-down or divide-and-conquer from layer 3. ping uses ICMP Echo, and traceroute raises the TTL and receives ICMP Time Exceeded (tracert on Windows; mtr adds statistics). The tools: ip addr, ip route, ip neigh, ss -tulpn, dig and curl -v. On Cisco: show ip interface brief, show ip route, show mac address-table, show vlan brief and show interfaces for errors. Wireshark captures packets and unpacks them layer by layer, with display filters such as dns, tcp.port == 443 and tcp.flags.syn == 1.
Before You Start
🧅Layers
Troubleshooting walks the layers.
🚀Opening a site
You know the stops that can fail.
The Core Idea
1The troubleshooting ladder
Start at the bottom, and move up only when the current rung passes. Each rung has its command ready.
The same ladder written as a function. The first check that fails is the diagnosis.
def diagnose(link_up, ip, gw_ok, ping_ip_ok, dns_ok, port_open):
if not link_up:
return "L1: cable or Wi-Fi is not connected"
if ip.startswith("169.254"):
return "L3: DHCP did not answer - check the router"
if not gw_ok:
return "L2/L3: cannot reach the gateway - wrong network or VLAN?"
if not ping_ip_ok:
return "L3: the gateway works, the internet does not - provider or route"
if not dns_ok:
return "L7: numbers work, names do not - it's DNS"
if not port_open:
return "L4: the server is up, the port is blocked or closed"
return "network is fine - look at the application itself"
print(diagnose(True, "169.254.3.9", False, False, False, False))
print(diagnose(True, "192.168.1.20", True, True, False, False))
print(diagnose(True, "192.168.1.20", True, True, True, True))2The commands on each system
The commands differ a little between systems, but the question is the same. Learn the question and the command follows.
| The question | Windows | Linux | macOS |
|---|---|---|---|
| My address and gateway? | ipconfig /all | ip addr; ip route | ifconfig; netstat -rn |
| Can I reach this host? | ping 1.1.1.1 | ping -c 4 1.1.1.1 | ping -c 4 1.1.1.1 |
| Where does the path stop? | tracert example.com | traceroute example.com | traceroute example.com |
| Does the name resolve? | nslookup example.com | dig example.com | dig example.com |
| Who listens on which port? | netstat -ano | ss -tulpn | lsof -i -P |
| The ARP table | arp -a | ip neigh | arp -a |
| Is a remote port open? | Test-NetConnection host -Port 443 | nc -zv host 443 | nc -zv host 443 |
This is what the fix looks like in a terminal: three commands and you know the problem.
$ ping -c 3 1.1.1.1 64 bytes from 1.1.1.1: icmp_seq=1 ttl=57 time=11.8 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=57 time=12.1 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=57 time=11.6 ms 3 packets transmitted, 3 received, 0% packet loss $ ping -c 1 example.com ping: example.com: Name or service not known # numbers work, names do not: DNS $ dig +short example.com @1.1.1.1 203.0.113.10 # another resolver answers: fix your DNS setting
3Wireshark: look inside the packets
Wireshark captures every packet on your network card and shows it as layers, just like the layers lesson: an Ethernet frame, then IP, then TCP, then HTTP. It is the best networking teacher there is, because it shows you the truth, not an explanation.
| Filter | What it shows |
|---|---|
dns | Only DNS questions and answers |
ip.addr == 192.168.1.20 | Everything about one device |
tcp.port == 443 | HTTPS traffic |
tcp.flags.syn == 1 && tcp.flags.ack == 0 | Only connection starts |
arp || dhcp | ARP and DHCP messages: how every device joins |
tcp.analysis.retransmission | Retransmissions: a sign of packet loss |
dns || tcp.flags.syn == 1. You will see the DNS question and then the three-way handshake for yourself, just like the drawings.4The essential Cisco commands
In Packet Tracer and on Cisco gear, show commands read and change nothing, so try them freely. These are the main ones and what to look for in each.
"administratively down" means someone shut the port with a command; the fix is no shutdown.
R1# show ip interface brief
Interface IP-Address OK? Method Status Protocol
Gi0/0 10.1.1.1 YES manual up up
Gi0/1 203.0.113.2 YES manual up up
Gi0/2 unassigned YES unset administratively down down <- "shutdown" is still on
R1# show interfaces gi0/1 | include errors|CRC
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored <- CRC errors mean a bad cableWorked example
The task: an employee cannot reach anything. ipconfig gives 192.168.1.57 with gateway 192.168.1.1. ping 192.168.1.1 works, ping 1.1.1.1 fails, and tracert 1.1.1.1 stops after the first hop. Where is the problem? The answer: layers 1, 2 and local 3 work because the gateway answers. The path stops right after the gateway, so the problem is in the router itself or its link to the provider. Check the router's WAN port and the provider's line. There is no point checking DNS yet.
Myth vs Reality
| Myth | Reality |
|---|---|
| If ping fails, the machine is off. | Many servers and firewalls block ICMP on purpose; test the actual port. |
| Stars in traceroute mean the path is cut. | Some routers do not answer traceroute but still forward traffic; what matters is whether later hops answer. |
| Restarting the router fixes everything. | It may hide the problem for a while, but without a diagnosis it comes back. |
Where you meet it at work
🎧IT support
The ladder is the daily support call script.
☁️Cloud engineer
curl -v and dig reveal most deployment problems.
🔍Security analyst
Wireshark to read exactly what a suspicious device did.
Test your understanding
ping 1.1.1.1 works and ping example.com fails. Where is the problem?
Reaching by number works, so the problem is turning the name into one.
How does traceroute find the hops?
Each router where the packet dies reveals itself.
Which Wireshark filter shows only TCP connection starts?
The first handshake message is a SYN without an ACK.
A router port shows "administratively down". What is the fix?
The port was shut by a command, not by a fault.
Ping to an IP works but to the site name fails. Where is the problem?
The path is fine; turning the name into an address fails.
Which command shows the hops to a destination on Windows?
On Linux it is traceroute.
Quick review cards
Check Your Understanding
Why start troubleshooting at layer 1?
Every layer rests on the one below; checking DNS with the cable out is pointless.
Ping to a server fails but the site opens. How?
The server or its firewall blocks ICMP and allows 443.
What do rising CRC errors on a port mean?
Frames arrive damaged, usually a bad cable or electrical interference.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.