1. Network Troubleshooting
Chapter 15

2. Objectives
Describe appropriate troubleshooting tools and their functions
Analyze and discuss the troubleshooting process
Tackle a variety of troubleshooting scenarios

3. Overview

4. Introduction to Network Troubleshooting

5. Three Parts to Chapter 15 Troubleshooting Tools
The Troubleshooting Process
Troubleshooting Scenarios

6. Troubleshooting Tools
Teaching Tip
Point out that, while other chapters introduced many of the troubleshooting tools in this section earlier in the book, this chapter ties them all together. Also emphasize the point made by Mike in the introduction to this section: “different networking jobs require wildly different tools,” so the student should not expect to put together an all-purpose toolkit. You can generally do that for PC support, but not for network troubleshooting, until you know exactly what your role is. Further, he points out that he has done a great deal of successful network troubleshooting with free software tools.

7. Hardware Tools Cable Tester, TDR, and OTDR Certifiers
Voltage Event Recorder/Temperature Monitor
Protocol Analyzer
Cable Stripper/Snips
Multimeter
Tone Probe and Tone Generator
Butt Set
Punchdown Tool
Note: This slide is a simple overview of the Hardware Tools described in this section.

8. Hardware Tools Cable Testers, TDRs, and OTDRs Cable testers
Devices to test for broken cables
Cable testers
Continuity problems and wire map
TDRs time domain reflectometer
Locates copper cable breaks
OTDRs
Locates fiber-optic cable breaks
Teaching Tip
Emphasize that things other than broken cables can cause the inability to connect. Therefore, before using one of the testers described here, first eliminate common problems that can look like a broken cable. They include: loss of permissions, an unplugged cable, or a server shut off. Better to eliminate these things before you run around with these cool hardware devices and fail to find a broken cable.

9. Figure 15.1 Typical cable tester
Teaching Tip
Point out the Tip at the top of Page 404 in which Mike states that it appears that a comma is missing in a CompTIA Network+ objective. Specifically, “open impedance mismatch (echo)” is missing a comma between “open” and “impedance.”
Figure Typical cable tester

10. Figure 15.2 An EXFO AXS-100 OTDR (photo courtesy of EXFO)

11. Certifiers Only use for slowdowns, not disconnects
Require a loopback on the far end
Ensure a cable can handle its rated capacity
Problems that reduce cable capacity
Cross talk
Attenuation
Interference

12. Voltage Event Recorder/Temperature Monitor
Detect power and heat problems
Cause intermittent problems
Heat problems in server rooms
Monitor power with voltage event recorder
Monitor temperature with temperature monitor

13. Protocol Analyzers Monitor protocols at different layers
Application, Session, Network, Data Link
Both hardware and software tools
Teaching Tip
The CompTIA Network+ exam objectives place protocol analyzers in the hardware category. Therefore, for the exam consider it to be so. However, there are also excellent software protocol analyzers.

14. When to Use a Protocol Analyzer
You need to see data to analyze the problem
A session fails to start
A DNS server fails to respond
Confusing information appears on the network
You suspect a rogue DHCP server exists
Excess traffic is slowing down the network

15. Cable Stripper or Snip Enable you to make UTP cables
Also need crimpers
Often combined in one tool

16. Figure 15.3 A cable stripping and crimping tool

17. Multimeters Test AC and DC voltage Test resistance Test Continuity
A great fallback when you do not have a cable tester

18. Tone Probes and Tone Generators
Work together to identify opposite ends of unlabeled cable runs
Tone generator puts a signal (tone) on wire
Tone probe on opposite end detects the signal
Teaching Tip
Per the tip on the bottom of Page 405, the CompTIA Network+ objectives use the term “toner probe” for “tone probe.”

19. Butt Sets
Hand set
Use to tap into a 66- or 100-block to test a line

20. Punchdown Tools Put UTP wires into 66- and 100-blocks
Repunch a connection to make sure contacts are set

21. Figure 15.4 A punchdown tool in action

22. Software Tools TRACERT/TRACEROUTE IPCONFIG/IFCONFIG PING and ARP PING
NSLOOKUP/DIG
HOSTNAME
MTR
ROUTE
NBTSTAT
NETSTAT
Packet Sniffer
Port Scanners
Note: This slide is a simple overview of the Software Tools described in this section.
Teaching Tip
Per the Tip on Page 406, be sure to have the students memorize the output of all the software tools, because the CompTIA Network+ exam tests your ability to identify the command that produced the output.

23. TRACERT/TRACEROUTE Traces all routers between two points
Use to discover where a problem lies
Problem is just beyond the last router displayed before error
Some routers block TRACEROUTE packets
If TRACEROUTE is blocked, try PATHPING

24. Listing 15-1 Sample TRACEROUTE output
Tracing route to adsl dsl.hstntx.swbell.net
[ ] over a maximum of 30 hops:
ms <1 ms ms Router.totalhome
[ ]
ms ms ms adsl dsl.hstntx.swbell.net [ ]
Listing Sample TRACEROUTE output 24

25. IPCONFIG/IFCONFIG Displays IP settings IPCONFIG without parameters
Basic information only
Ipconfig /all gives configuration details

26. Listing 15-2 Sample IPCONFIG output
Ethernet adapter Main:
Connection-specific DNS Suffix . :
IPv6 Address : 2001:470:bf88:1:fc2d:aeb2:99d2:e2b4
Temporary IPv6 Address : 2001:470:bf88:1:5e4:c1ef:7b30:ddd6
Link-local IPv6 Address : fe80::fc2d:aeb2:99d2:e2b4%8
IPv4 Address :
Subnet Mask :
Default Gateway : fe80::223:4ff:fe8c:b720%8
Tunnel adapter Local Area Connection* 6:
Media State : Media disconnected
Listing Sample IPCONFIG output

27. Listing 15-3 Sample IFCONFIG output
eth0 Link encap:Ethernet HWaddr 00:02:b3:8a:7d:ae
inet addr: Bcast: Mask:
inet6 addr: 2001:470:bf88:1:202:b3ff:fe8a:7dae/64 Scope:Global
inet6 addr: fe80::202:b3ff:fe8a:7dae/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets: errors:0 dropped:0 overruns:0 frame:0
TX packets: errors:0 dropped:0 overruns:0 carriers:0
collisions:0 txqueuelen:1000
RX bytes: (292.5 MB) TX bytes: (132.9 MB)
lo Link encap:Local Loopback
inet addr: Mask:
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU: Metric:1
RX packets: errors:0 dropped:0 overruns:0 frame:0
TX packets: errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes: (1.0 MB) TX bytes: (1.0 MB)
Listing Sample IFCONFIG output

28. PING Queries by name or IP address Uses ICMP packets
Works across routers
Problem: devices can block ICMP

29. Listing 15-4 Sample PING output
Pinging with 32 bytes of data:
Reply from : bytes=32 time<1ms TTL=64
Ping statistics for :
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
Listing Sample PING output

30. ARP PING Queries by IP address Uses ARP packets
Problem: does not cross routers
Only on UNIX and UNIX-like systems

31. Listing 15-5 Sample ARPING output
ARPING from eth0
Unicast reply from [00:1D:60:DD:92:C6] 0.875ms
Unicast reply from [00:1D:60:DD:92:C6] 0.897ms
Unicast reply from [00:1D:60:DD:92:C6] 0.924ms
Unicast reply from [00:1D:60:DD:92:C6] 0.977ms
Listing Sample ARPING output

32. NSLOOKUP/DIG Both diagnose DNS problems
NSLOOKUP (all operating systems)
Poor tool – considered obsolete
Without switches, provides name and IP address of default DNS server
DIG – more powerful
Everyone but Windows

33. Listing 15-6 The DIG command
dig mx totalsem.com
Listing The DIG command
; <<>> DIG P2 <<>> mx totalsem.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6070
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; QUESTION SECTION:
;totalsem.com IN MX
;; ANSWER SECTION:
totalsem.com IN MX 10
mx1c1.megamailservers.com.
totalsem.com IN MX 100
mx2c1.megamailservers.com.
totalsem.com IN MX 110
mx3c1.megamailservers.com.
Listing Output for the DIG command

34. HOSTNAME Simplest of all utilities
Returns name of host from which it runs
HOSTNAME sample output
c:\>
c:\>hostname
Mike-win7beta

35. My Traceroute (MTR) Dynamic (keeps running) Equivalent to TRACEROUTE
Not available in Windows

36. Listing 15-9 Sample MTR output
My traceroute [v0.73]
totaltest ( )
Keys: Help Display mode Restart statistics Order of fields quit Packets Pings
Host Loss% Snt Last Avg Best Wrst StDev
1. Router.totalhome %
2. adsl dsl.hstntx.s %
Listing Sample MTR output

37. ROUTE
Display and edit local routing table
Type route print

38. Listing 15-10 Sample ROUTE PRINT output
===========================================================================
Interface List
d 60 dd 92 c Marvell 88E8056 PCI-E Ethernet Controller
Software Loopback Interface 1
IPv4 Route Table
Active Routes:
Network Destination Netmask Gateway Interface Metric
On-link
On-link
On-link
On-link
On-link
On-link
On-link
On-link
On-link
On-link
On-link
On-link
On-link
On-link
On-link
Persistent Routes:
None
Listing Sample ROUTE PRINT output

39. NBTSTAT Windows only Command-line equivalent of My Network Places
Must use a switch
nbtstat –n shows local NetBIOS names

40. NetBIOS Local Name Table
Main:
Node IpAddress: [ ] Scope Id: []
NetBIOS Local Name Table
Name Type Status
MIKESPC <00> UNIQUE Registered
TOTALHOME <00> GROUP Registered
MIKESPC <20> UNIQUE Registered
TOTALHOME <1E> GROUP Registered
Listing Sample NBTSTAT output

41. NETSTAT Shows current state of running IP processes
Shows what sessions are active
Provides statistics based on ports or protocols
Type netstat to show only current sessions
Type netstat –r to show routing table (like route print)

42. Listing 15-12 Sample NETSTAT output
Active Connections
Proto Local Address Foreign Address State
TCP : MikesPC: ESTABLISHED
TCP : MikesPC: ESTABLISHED
TCP : MikesPC: ESTABLISHED
TCP : : CLOSE_WAIT
TCP : :http CLOSE_WAIT
TCP : acd :https ESTABLISHED
TCP : TOTALTEST:ssh ESTABLISHED
TCP : :https TIME_WAIT
TCP : :http ESTABLISHED
Listing Sample NETSTAT output

43. Packet Sniffer A.k.a. protocol analyzer or packet analyzer
Intercepts and logs network packets
Many choices
Software example: Wireshark
Dedicated hardware devices

44. Figure 15.5 Wireshark in action

45. Port Scanners Probes remotes system’s ports
Logs state of scanned ports
Good use: find unintentionally opened ports in order to close
Bad use: find open ports and use to break in
NMAP runs on UNIX
Angry IP Scanner for Windows

46. Figure 15.6 Angry IP Scanner

47. The Troubleshooting Process

48. Memorize these problem analysis steps:
Information gathering—identify symptoms and problems
Identify the affected areas of the network
Establish if anything has changed
Establish the most probable cause
Determine if escalation is necessary
Create an action plan and solution, identifying potential effects
Implement and test the solution
Identify the results and effects of the solution
Document the solution and the entire process

49. Troubleshooting Scenarios

50. Troubleshooting Scenario One
“I can’t log in!”
Biggest and most complex scenario
Log in from other machines
Attempt to log in yourself and try to PING
Use IPCONFIG or IFCONFIG

51. Troubleshooting Scenario Two
“I can’t get to this Web site!”
Have user try to reach another Web site
Try to ping the site by name and IP address
Determine whether DNS is functioning
Ping the gateway or proxy server
Ping other sites
If other sites reachable, notify problem site owner
If no sites available, notify your ISP

52. Troubleshooting Scenario Three
“Our Web server is sluggish!”
Connect from another location
If connection is also slow, problem with server
Check server logs for changes
Run Performance Monitor and compare new logs with previously established baseline logs
If connection from other location OK, run TRACERT command from user’s computer to reveal slow hop

53. Troubleshooting Scenario Four
“I can’t see anything on the network!”
Check connectivity
Ping a remote system
Ping loopback address
If error, run ipconfig /all and fix settings
If no error, check hardware
Run utility on NIC
Test cable

54. It’s Time to Escalate! Broadcast storms Switching loops Route problems
Routing loops
Proxy ARP

55. Troubleshooting is fun!
Apply good troubleshooting methodology
Constantly increase your knowledge
Become a troubleshooting artist