Network Software Tools and Commands
Network Software Tools and Commands
A troubleshooting method tells you how to reason; tools supply the evidence. This chapter connects common symptoms to packet captures, performance tests, host commands, device show commands, and physical diagnostic instruments.
Tools Turn Symptoms into Evidence
No single utility proves every layer. Begin with the narrowest question that reduces uncertainty: Is the local TCP/IP stack working? Does the host have a valid address? Can it reach the gateway? Does DNS return the correct record? Is the service listening? Where does the path stop? What do the packets actually show?
Observe
Packet analyzers, logs, interface counters, NetFlow, and Wi-Fi analyzers reveal existing behaviour.
Generate a test
ping, traceroute, DNS queries, port scans, and iPerf create controlled traffic.
Inspect physically
Cable testers, toner probes, taps, and visual fault locators investigate media and signal paths.
Protocol Analyzers and Packet Capture
A protocol analyzer—also called a packet sniffer or network monitor—captures frames and packets for decoding. Wireshark provides a graphical view; tcpdump provides command-line capture. Promiscuous mode allows a NIC to accept frames it can see beyond those addressed directly to it, but a switched network still requires a mirror/SPAN port, network tap, or capture at the correct endpoint to observe other flows.
A capture of the DHCP DORA exchange can show whether the client broadcasts Discover, a server offers an address, the client requests it, and the server acknowledges it. Missing stages narrow the fault far more precisely than “DHCP is broken.”
Bandwidth Testers, iPerf, and NetFlow
iPerf
Measures achievable throughput between a controlled client and server. It supports TCP and UDP tests, helping evaluate bandwidth, jitter, and loss. Compare results with a baseline and run disruptive tests during an approved window.
iperf3 -s starts the test server; iperf3 -c 192.0.2.10 runs a client test to that authorized server.
NetFlow and related flow data
Summarize traffic conversations using attributes such as source, destination, ports, protocol, interfaces, byte counts, and timestamps. Exporters send records to collectors for analysis and trends.
Flow records explain who talked to whom and how much; packet capture reveals the packet-level conversation and payload metadata.
| Evidence | Best question answered | Important limitation |
|---|---|---|
| Speed test | What throughput does a user experience to a test service? | Internet path and server capacity affect the result |
| iPerf | What can this controlled path carry? | Requires endpoints and intentionally generates load |
| NetFlow | Which conversations consume capacity? | Usually lacks full packet payloads |
| Packet capture | What exactly happened at protocol level? | Placement, volume, privacy, and storage matter |
Port Scanners, TFTP, and Connectivity Software
Port scanner
Identifies reachable hosts, open ports, and exposed services. Administrators use scanning for inventory and security validation; attackers use the same capability for reconnaissance.
TFTP
Uses UDP port 69 to begin simple file transfers, often for network-device firmware or configuration. It provides no authentication or encryption, so restrict it to a controlled management network.
Remote access
RDP provides Windows graphical control on TCP/UDP 3389. SSH securely provides terminal access, normally on TCP 22. Telnet sends data in plaintext and should be avoided.
PuTTY and SecureCRT are examples of terminal-emulation clients. Remote Desktop allows a technician to observe or control a remote Windows session. FTP provides authenticated file transfer but does not protect credentials or data unless a secure alternative such as SFTP or FTPS is used.
ping, traceroute, and tracert
| Command | Purpose | Example | Interpret carefully |
|---|---|---|---|
| ping | Sends ICMP Echo Requests to test reachability and round-trip time | ping 127.0.0.1ping 192.0.2.1 | No reply may mean filtering, rate limiting, path failure, or host failure |
| tracert | Windows path discovery using increasing TTL values | tracert example.com | An intermediate hop may ignore probes while forwarding later traffic |
| traceroute | Linux/macOS path discovery | traceroute example.com | Paths can be asymmetric or change dynamically |
A sensible progression is loopback → local address → default gateway → remote IP → remote hostname. Each successful test proves only part of the path. ping localhost or ping 127.0.0.1 checks the local TCP/IP stack; it does not prove the NIC, cable, switch, gateway, or Internet connection.
ipconfig, ifconfig, ip, arp, and Route Tables
| Platform/tool | Useful examples | What it reveals or changes |
|---|---|---|
| Windows ipconfig | ipconfig /allipconfig /releaseipconfig /renewipconfig /flushdns | Addresses, masks, gateways, DNS, DHCP details, leases, and resolver cache control |
| Linux ip | ip addressip linkip route | Modern interface, address, link-state, and routing information |
| Legacy ifconfig | ifconfig | UNIX/Linux interface addressing and state; often replaced by ip |
| ARP/neighbor cache | arp -aip neigh | IPv4-to-MAC mappings for local-link neighbors |
| Routes | route print (Windows)ip route (Linux) | Destination prefixes, next hops, interfaces, and metrics |
An APIPA address in 169.254.0.0/16 often indicates that a Windows client could not obtain a DHCP lease. The ARP cache is local-link evidence: it can help reveal duplicate-address behaviour or an unexpected MAC address, but it does not list every host on remote networks.
nslookup, dig, and netstat
nslookup
Queries DNS interactively or directly. Example: nslookup example.com. It is common on Windows and available on many other platforms.
dig
Provides detailed DNS query output on Linux/UNIX-like systems. Example: dig example.com A or dig example.com MX.
netstat
Displays connections, listening sockets, protocol statistics, and routes. netstat -a shows all connections and listening ports; -n keeps addresses and ports numeric.
If a remote IP works but its hostname fails, query DNS before changing routing. If the path works but an application fails, check whether the expected service is listening and whether the connection reaches it. Modern Linux systems often use ss instead of legacy netstat.
tcpdump, Nmap, and Firewall Utilities
tcpdump
Captures packets on Linux/UNIX systems. Examples: tcpdump -i any for all interfaces or tcpdump -i eth0 host 192.0.2.25 for an authorized host filter.
Nmap
Performs host discovery and port/service scanning. Use only with explicit authorization. A focused lab scan is safer than an uncontrolled scan of production ranges.
iptables / nftables
Linux firewall frameworks evaluate traffic against ordered rules and chain policies. Traditional iptables chains include INPUT, OUTPUT, and FORWARD; many modern distributions use nftables underneath or directly.
For packet capture, specify the correct interface and a narrow filter, record timestamps, and save the capture when deeper analysis is needed. For firewall diagnosis, inspect the applicable direction and chain, rule order, counters, state tracking, and default policy before making changes.
Basic Network-Device Show Commands
| Command family | Evidence | Typical question |
|---|---|---|
show running-config | Active configuration in memory | What is the device using now? |
show startup-config | Saved boot configuration | Will the current changes survive a reboot? |
show mac address-table | MAC-to-switch-port learning | On which port was this endpoint learned? |
show ip route / show route | Routing table and next hops | How will this destination be forwarded? |
show interfaces | State, speed, duplex, errors, drops, traffic | Is the link healthy and are counters increasing? |
show arp | IPv4-to-MAC neighbor mappings | Which local MAC owns this IP? |
show vlan | VLAN existence and port membership | Is this access port in the correct VLAN? |
show power | PoE allocation and power budget | Why is an AP or phone not receiving power? |
Exact syntax varies by vendor and platform. Prefer read-only show or equivalent inspection commands during diagnosis, compare the live state with documentation or a golden configuration, and capture evidence before changing configuration.
Hardware Troubleshooting Tools
Toner and probe
A tone generator places a signal on copper; the inductive probe follows it through bundles, racks, and wall paths. Disconnect from sensitive active equipment as required by the tool instructions.
Cable tester
Checks continuity, pinout, opens, shorts, reversals, split pairs, and sometimes cable length or distance to fault. Certification testers also measure performance against a cable standard.
Network tap
A purpose-built device that provides monitoring copies of traffic. Passive optical or copper taps can offer visibility without relying on switch mirroring.
Wi-Fi analyzer
Measures signal strength, noise, channels, utilization, neighbouring networks, and coverage to guide channel planning and AP placement.
Visual fault locator
Injects visible red light into fiber to help locate breaks, severe bends, continuity problems, and polarity. Never look into a fiber or active optical connector.
Protocol analyzer
Software capture still depends on physical placement. A tap, SPAN session, endpoint capture, or wireless monitor mode supplies the traffic to analyze.
Choose the Best First Tool
Select a troubleshooting question to reveal a focused first command or tool and what its result would prove.
The recommended tool, example, and interpretation will appear here.