Troubleshoot Network Issues

🎯 Exam Objectives

🎯

Exam Objective: Given a scenario, troubleshoot network issues.

Track your learning progress! Click each objective as you master it:

Use standard tools (ping, traceroute) to isolate connectivity vs. name resolution issues
Troubleshoot DNS, DHCP (scope exhaustion, overlap), and NTP service availability
Diagnose HTTP status codes, latency, bandwidth, and throughput issues
Resolve routing, NAT, switching (VLAN/trunk), and protocol incompatibility issues
Utilize packet capture (Wireshark) and network scanning (Nmap) utilities

🔧 7.31 Standard Network Troubleshooting Tools

Begin troubleshooting with basic connectivity checks. The ping command operates at the Network layer (Layer 3) and confirms basic connectivity without relying on Application layer configurations.

Interactive Ping Diagnostic

Click a scenario to see what the ping response indicates about your network:

Success: A ping REPLY is received. The connection is up, and both nodes can send and receive traffic to each other. Basic Layer 3 connectivity is confirmed.

Network Path Tracing

If ping fails, use route tracing to identify exactly which router is down or filtering traffic. This narrows the scope of the problem by showing every "hop" along the path.

C:\> tracert www.comptia.org

$ traceroute www.comptia.org

🌐 7.32 & 7.33 DNS and IP Address Availability

If connectivity fails, verify that DNS resource records are accurate and that IP configurations are correct. A missing or typoed default gateway, subnet mask, or DNS server will break communications.

OS Command Reference

ipconfig: Basic IP, subnet mask, default gateway.
ipconfig /all: Detailed info including DHCP, DNS, MAC.
ipconfig /release & /renew: Manage DHCP leases.
ipconfig /displaydns & /flushdns: Manage DNS cache.
nslookup server42: Test name resolution.

ip addr: Display IP configurations for all NICs.
ip route: Display the routing table.
ip link: Display NIC hardware information.
dig server42 or host server42: Test name resolution.

💡 Key IP Addresses to Remember:
• APIPA: 169.254.x.x (Indicates DHCP failure)
• Loopback: 127.0.0.1 (Tests local TCP/IP stack)

Use the route print (Windows) or ip route (Linux) command to verify the system’s routing table is correct.

📡 7.34 DHCP Service Availability

DHCP servers must have enough available IP addresses and must not assign overlapping ranges. Consider implementing DHCP failover (active-active or active-standby) for high availability.

Occurs when a DHCP server's pool (scope) has no more available IP addresses to lease to new clients.

Troubleshooting Steps:

View DHCP log files regularly.
Maintain documentation relating DHCP clients to available IP addresses.
Watch for duplicate IP address errors on network nodes.

Occurs when two DHCP servers host scopes with the same overlapping IP address ranges, causing duplicate IP conflicts.

Troubleshooting Steps:

Watch for VM server errors indicating duplicate IPs.
Maintain documentation of IP ranges hosted by every DHCP server.
Ensure unique scopes across on-premises, VPC, and multi-cloud environments.

⏱️ 7.35 Network Time Protocol (NTP)

Time drift between systems causes authentication failures and application errors. VMs typically get time from their hardware host, which syncs with external Stratum 1 servers.

Verify host time config files Check NTS certificate info Ensure guest extensions are installed Sync on-prem and cloud to same source

🌍 7.36 Hypertext Transfer Protocol (HTTP)

If HTTP connections fail, ensure port 80/tcp is open on the firewall and the web service is running. HTTP status codes provide critical troubleshooting clues.

HTTP Status Code Explorer

Click a status code to reveal its meaning:

403

Forbidden

Client-side authorization problem accessing the requested resource.

404

Not Found

The requested resource cannot be found on the server.

500

Internal Server Error

Nonspecific server-side error indicating web service issues.

502

Bad Gateway

Server received an invalid response while acting as a gateway/proxy.

📉 7.38 & 7.39 Latency, Bandwidth, and Throughput

Latency is the time delay between request and service. Bandwidth is the max data transfer rate, while Throughput is the actual successful data volume (accounting for packet loss).

Distance/Hops: Reduce physical distance or number of routers between client and service.
Data Volume: Check the quantity of data being transported.
Server Performance: Ensure sufficient CPU, memory, and disk I/O.
QoS: Verify Quality of Service settings are correctly prioritizing traffic (e.g., VoIP).

Check for bandwidth-hogging applications or overwhelmed routers/proxies.
Verify Load Balancer type and configuration.
MTU Size: If network efficiency is reduced, check Maximum Transmission Unit settings. Packets that are too large for a receiver cause retransmissions, hurting throughput.

⚙️ 7.40 & 7.41 Device Misconfiguration & Protocol Issues

Network problems often affect multiple nodes. Identify what they have in common: same VPC, VLAN, subnet, or behind the same firewall?

Protocol Incompatibilities

VLAN Protocols: VXLAN, NVGRE, and STT are incompatible. Use GENEVE to bridge multi-cloud incompatibilities.
HTTP vs HTTPS: Ensure clients accept HTTPS certificates and servers have valid, unexpired certs from a trusted CA.
Routing Protocols: Avoid deprecated RIP. Use modern OSPF or BGP.
Encryption: Use HTTPS, SSH, SFTP, and encrypted RDP. Avoid deprecated, non-encrypted protocols like Telnet.

🔍 Connection Monitoring: Use the Linux ss command (or deprecated netstat on older systems) to display current TCP connections, helping monitor workload and prepare for server reboots.

🗺️ 7.42 & 7.43 Routing and NAT Issues

Routing Troubleshooting Flow

When connectivity fails across multiple segments, work backward from the destination:

Ping the remote destination.
If it fails, ping the next router in from that device.
Continue until you get a successful reply, identifying the last point of success.
(Use traceroute to automate this process).

Verify static routes for typos. Ensure dynamic routing protocols (OSPF, BGP) are compatible and exchanging tables correctly. Check that the default route (gateway) is accurate.

If VPCs cannot communicate, verify that VPC Peering is configured, routes are added to both VPC routing tables, security group memberships are updated, and name resolution is functioning.

VPN protocols prevent packet changes for security, but NAT changes IP address fields. If internal IPs are mishandled over a VPN, implement a specific NAT for VPN solution that translates IPs before applying tunneling configurations.

🔀 7.44 Switching Issues

While basic switching is self-configuring, complex environments require careful VLAN and trunking management.

🏷️ Misconfigured Tags

If VLAN members unexpectedly communicate outside their VLAN, confirm tag settings on each switch, verify switch port membership, and check trunking configurations between switches.

🔗 Access vs. Trunk Ports

Access ports: Connect to end devices (workstations, servers).
Trunk ports: Connect switch to switch. Ensure client devices are not accidentally plugged into trunk ports.

Remember: Traditional VLANs are limited to 4,094 identifiers. If you run out, migrate to VXLANs (up to 16 million).

🕵️ 7.45 Packet Capture and Scanning Utilities

When configuration checks fail, inspect the actual traffic on the wire to identify anomalies, rogue devices, or unencrypted data leaks.

Deep Packet Inspection

Intercepts and displays addressing information and data payloads (unless encrypted). Available on Linux, macOS, and Windows with a user-friendly GUI.

tcpdump / Wireshark CLI

$ sudo tcpdump -i eth0 port 80

Listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes...

Network Discovery & Auditing

Scans subnets to connect to devices and identify advertised services (email, web, DNS, DHCP). Crucial for mitigating rogue or misconfigured devices.

Nmap Scan

$ nmap -sV 192.168.1.0/24

Starting Nmap 7.94... Discovered open port 80/tcp on 192.168.1.10