Essential Network Troubleshooting Guide
Essential Network Troubleshooting Guide
Firstthingsfirst:Ping
We open a Command Prompt window (or D.O.S., or console, or command line, or shell)
and we write:
ping <Destination_IP> -N 10
The ping command sends a request forecho ICMP(echo-Request) to the server we want
verify. By default, 4 requests are made, but I prefer using the -N parameter.
<number>, give it a multiple of 10. This has 2 quite simple reasons:
• If there are intermittent issues with the link (it has happened to me with links of
microwave), only 4 pings do not always detect this situation.
• If an amount that is a multiple of 10 is made, the percentage calculation is immediate.
packet loss ;)
The previous example corresponds to a client who was losing connection to the Desktop server.
Remote where the company's ERP was located. This was a microwave link that was 'bad'
pointed the antenna and thanks to this (and many other reports, with more packages) we were able to
identify the problem.
Another important piece of information that can be obtained from this ping is how fast or slow it is.
the network, seeing the round trip time. Clearly, there is no optimal time,
well, it depends on the characteristics of the network, congestion, and bandwidth. Even so, this
the value should not exceed 20 ms (in the example: a minimum of 80 and a maximum of 841 not
they were good numbers).
Finally, it can be determined how "far" the sender is from the recipient of the message,
comparing the values of theTTL.
IMPORTANT: In the previous example, a ping is made from the client machine at the location to a
web server of a very well-known and prestigious University ;) . Why? Because I know that
that server "YES responds to PING". It is possible that the "destination" of the Ping is not configured to
Ping response, or there is a firewall blocking echo requests, so if like
response to a ping 'no response' this does not necessarily indicate problems in the network or in
the server.
[Link]
In the previous example, we actually pulled a little trick: we assumed that theserver
DNSit was working ;)
The DNS server is responsible for translating <names> = <IP address>. In this
case: [Link] = [Link], because in reality, the echo request is made to the IP of
destination, not to <name>.
The most basic tool to check that the DNS server we are querying is
answering is nslookup, which in its simplest form can be invoked as follows:
nslookup <Destination_IP>
The first lines identify the server that is responding to my request: [Link] and
port 53 (standard for DNS)
The third line indicates that the server is neither the "owner" nor a "part" of the DNS zone, so its
the answer is not 'firsthand', but rather it responds 'what it knows'.
Finally, the last lines identify the name with its IP address. An answer different from
this would imply problems with the DNS server or with its ability to resolve (by itself or
asking other servers) the queries that are made to it. In this case (and as a rule
In general, it is better to run the commands with the IP address instead of the name.
[Link]
OK. We already know if we have packet loss or not, and we know how to find the IP address of
our destination. Another very useful tool in problem solving is Tracert (traceroute
in Unix-based systems), as it allows us to know where (through whichrouters) they pass the
packages while traveling between the origin and the destination.
tracert <Destination_IP>
The first line (first jump), if it has the number 0, is the home team, if it has the number 1 it is
The default gateway of the machine from which the Tracert is running.
The last line should be the Server or Destination Team. (it is not always reachable).
[Link]
One of my favorites, as it combines the previous 3 tools into just one :D.
pathping <Destination_IP>
• BORRADA corresponds to real public IPs, deleted to protect the identity of the
involved ;)
• Routers 7 and 8, highlighted in another color, showed packet loss.
• Pathping takes a while, about 5 minutes, to finish executing, due to the
number of packets (100) sent at each hop, but it's worth the wait.
Network problems can be complex and sometimes you will need to seek help outside.
The diagnosis and troubleshooting may be the most difficult task of the job of the
IT technicians. In addition to having to find the root of the problem that is affecting the
Red, the pressure to find him as quickly as possible adds up. The teams never fail in the
appropriate moment. Failures usually occur while working, or when there are deadlines, so
immediately the pressure to solve the problem appears.
Once the problem has been diagnosed, the localization of resources and the monitoring of the
the necessary resources to fix the problem are straightforward. But before giving the diagnosis,
fundamentally isolate the true cause of the problem from irrelevant factors.
Problem-solving is more of an art than an exact science. Therefore, it is necessary to tackle the
problem in an organized and methodical way. Remember that you are looking for the cause, not its
symptoms. Often problems are seen through their symptoms, but they are not the authentic cause. As
an expert in problem solving, needs to learn how to quickly eliminate the greatest
number of possible hypotheses. This will allow you to focus on the things that may be the cause
of the problem. To do this, you can take a systematic approach.
The process for solving a problem in a network can be divided into five steps:
The first step is the most important, although it is often overlooked. If you do not take a
complete problem analysis can take a large amount of time working on the
symptoms without getting to the cause. The only tools needed for this phase are a notebook,
a pen and pay attention.
Paying attention to the customer or user of the network is the best source of information. Remember
that although I know how the network works and am able to find the technical faults of the problem,
those who work daily with the network were there before and after it appeared
They will surely remember what events have led them to the problem.
Based on their experiences regarding the problem, they can start to get an idea of the
possible causes. To help you identify the problem, make a list with the sequence of
events, as they have occurred, before the ruling. You may want to create a form with these
questions (and others specific to another situation) to help him organize his notes.
As you keep asking questions, you will begin to narrow down the problem, as illustrated in the
next list:
• Are all users affected or just one? If only one user is affected,
the cause is probably at the user's station.
• Are the symptoms constant or are they intermittent? Intermittent symptoms are a
symptom of a hardware failure.
• Did the problem exist before the operating system update? A change in the
Operating system can cause problems.
• Does the problem occur with all applications or just one? If it only appears
problems with an application, focus on the application.
• Is this problem similar to a previous problem? Has a similar error occurred?
Previously, it may be an issue found in the documentation.
• Are there new users on the network? The increase in traffic can cause delays in the
connection and in the process.
• Are there new devices on the network? Check that the new devices on the network have
have been configured correctly.
• Was a new application installed before the error appeared? The processes of
installation can cause errors in applications.
• Has any device on the network moved recently? The component may
If it has moved, it may not be properly connected to the network.
• What products are involved? Some manufacturers offer a phone or in-store service.
line.
• Are there any known incompatibilities between some vendors and certain components?
like cards, hubs, disk drives, software, and the network operating system? Can you
to find a solution to the problem on the seller's website.
• Has anyone tried to solve this problem?
Check the documented repairs and ask whoever tried to carry them out.
repair.
The next step is to isolate the problem. Start by eliminating the most obvious issues and
continue with the most difficult problems. Your intention is to narrow down the problem to one or two.
categories.
Make sure to really see the problem. If possible, have someone show you the error.
it is a problem caused by the operator, it is important to understand how it occurs, as well as its
results.
The most difficult problems to isolate are those that are intermittent and that never tend to
occur when it is present. The only way to resolve these issues is to recreate the
circumstances that caused the error. Sometimes, the best thing to do is to eliminate the
causes that are not the problem. This process takes time and patience. The user also has
What to provide details of what you were doing before and at the moment the error occurred.
It may be helpful to ask the user not to try to do anything with the equipment when the ...
problem, unless I call it. This way, you will be able to see it in the 'tests'.
The collection of information involves exploring the network and searching for obvious causes.
of the problem. A quick exploration should include a review of the documented history of the
network to determine if the problem has occurred before, and if so, where the solution was noted.
Step 3: Repair Planning
Once you have narrowed down the search to several categories, the final process begins
removal.
Create a plan to isolate the problems based on current knowledge. Start with the
simpler and more obvious solutions to eliminate them and continue with the more difficult and complex ones. It is
It is important to note each step of the process; document every action and its result.
Once you have created your plan, it is important to follow it exactly as you designed it. If you go
Jumping from one side to the other randomly can lead to problems. If the first plan does not
It is successful (there is always a possibility), create a new plan based on what you have discovered.
in the previous plan. Make sure to consider, re-examine, and ensure anything
assumption made in the previous plan.
Once you have located the problem, you can repair the faulty component or replace it.
If the problem is software-related, make sure to record the changes between the "before" and the
after
No repair is complete without confirmation that the work has been successfully completed.
You need to make sure that the problem no longer exists. Ask the user to try the solution and
confirm the results. You should also ensure that the repair has not generated new
problems. Make sure that you have not only solved the problem but that your work has not
had a negative impact on the network.
Finally, document the problem and the repair. Remember that what you have learned can
provide you with valuable information. There is no substitute for experience in the
diagnosis and problem solving, and each problem presents an opportunity to
increase your experience. If you keep a copy of the repair procedure in your technical book,
it can be useful when you encounter the same problem again (or a similar one). The
documentation of the problem-solving process is a way to create, retain, and share the
experience.
Remember that any changes you make could affect the baseline. You may have to
update the network baseline to anticipate future problems and needs.
Problem Division
If the initial review of the network statistics and symptoms does not reveal an obvious problem, the
the next step in problem-solving is to divide the network into smaller parts to
isolate the cause. The first question is whether the problem originates from the hardware or from the
software. If the problem seems to be related to the hardware, start by observing another
network segment and focus only on one type of hardware.
• Network cards.
• Wiring and connectors.
• Client stations.
• Connectivity components such as repeaters, bridges, routers, brouters, and gateways.
• Hubs.
• Protocols.
• Servers.
• Users.
Sometimes, isolating or removing a part of the network can help you recover the
red to its operational state. If the removal of a part has resolved the problem for the rest of the
red, the search for the problem can focus on the part that has been removed.
Una vez que haya recopilado la información, cree una lista ordenada de las posibles causas,
starting with the most probable cause of the problem. Next, select the best
candidate from the list of possible causes, test it and check if it was the problem. Start with
the most obvious and continue with the most difficult. For example, if you suspect that a network card (NIC)
one of the teams is the cause of the problem, replace it with a NIC that you are sure of
works correctly.
Definition of priorities
Diagnostic tools
The problems of diagnosis and problem solving are usually resolved with the help of
hardware and software. To create an effective troubleshooting solution, you need to know how to
You can use these tools to solve network problems.
Hardware tools
Digital voltmeters
In a new place or in a new construction, it is advisable to check the voltage of the outlets.
of current before connecting any electronic device, in order to check if
are within the allowed range.
The use of a TDR requires special training, and not all departments
maintenance is included in their equipment. However, administrators must be aware
the characteristics of a TDR in the event of a network failure and it is necessary
locate a cut.
Advanced cable testers work beyond the physical level of the model of
OSI reference at the data link layer, network layer, and even transport layer. Also
They can show information about the status of the physical cable.
There are other hardware tools that can assist you in diagnosis and troubleshooting.
network problems.
Crossover cables (direct) are used to directly connect two devices with a cable.
simple connection. As the cables for sending and receiving are in the reverse order with respect to the
points that connect, the cable that sends from one device connects to the port to receive on the other
equipment. Crossover cables are useful in troubleshooting network connection issues. Two
devices can be connected directly, bypassing the network, which makes it possible to isolate and test the
communication capabilities of a team, instead of those of the entire network.
Hardware loop
A hardware loopback device is a serial port connector that allows you to test the
communication possibilities of the serial port of a device without having to connect it to another device
or another peripheral. Instead, if you use a hardware loop, the data is transmitted to a line and,
Then, they return as received data. If the transmitted data does not return, the hardware loop.
detect a hardware error.
These tools are suitable for measuring the continuity and polarity of a line.
they can be used for testing among others, twisted pairs, single conductors and coaxial cable. To this
a couple is commonly known as "the fox and the dog."
Oscilloscopes
Oscilloscopes are electronic instruments that measure the amount of voltage signal by.
time unit and display the result on a monitor. If used with a TDR, an oscilloscope
can show:
• Shorts.
• Slight curves in the cable.
• Cuts in the cable.
• Attenuation (signal power loss).
Software tools
Network monitors
Network monitors are very useful for establishing part of the network baseline. Once
once the baseline has been established, you will be able to solve network issues and monitor the
use of the network to determine when it is time to update. For example,
let's assume that after the installation of a new network, it is determined that the network traffic
is using 40 percent of the estimated capacity. Upon rechecking the network traffic
the following year, he observes that now it is being used at 80 percent. If he has been carrying out the
monitoring over that time, could be able to predict the rate of increase of
traffic and predict when to carry out an update before a failure occurs.
Protocol analyzers
Protocol analyzers look inside the packet to identify a problem. They also
they can generate statistics based on network traffic to help you create an image of
the network, including:
• Wiring.
• Software.
• File servers.
• Workstations.
• Network cards.
Once the network has been installed and is operational, the administrator has to
ensure that it works correctly. To do this, the administrator will have to manage
and control each of the aspects of network performance.
One way to ensure that the network does not fail is to observe certain aspects of behavior.
diary. A consistent monitoring of the network will allow to observe that there are certain areas in the
that starts to decrease performance.
Performance monitors
• Processors.
• Hard drives.
• Memory.
• Utilization of memory.
• The whole network.
Network monitors
Some servers include software for network monitoring. For example, Windows NT
Server includes a diagnostic tool called Network Monitor. This tool provides the
administrator the ability to capture and analyze network data sequences from and to the
server. This data is used to diagnose potential network issues.
The network management software follows the standards set by the manufacturers of the
network equipment. One of these standards is the Simple Network Management Protocol (SNMP).
• Hub.
• Servers.
• NIC.
• Routers and bridges.
• Other specialized network equipment.
If any of the data falls within the thresholds defined by the administrator, the program
the administration can notify the administrator through alerts on the equipment or by calling
automatically a number from a pager. Next, the organization can use
the management program to implement the modifications to the network.
Where to find help
If a network problem is beyond the administrator's knowledge, it is time to seek help.
help. You can find assistance among your peers, in information sources on CDs or in
line. If you know where to find the best information resources, you can speed up the process of
resolution of the problem.
It is important to know when and where to get support to solve network problems, as well as
when responding to others. With the proliferation of hardware, software, protocols and
standards, it is impossible for a network administrator to know everything. This is due to
fundamentally to the constant changes that manufacturers make to the products. The
resources on network support can be found in a wide variety of places (colleagues,
manufacturers and technical references in CD). Software products, support services in
line, printed material and telephone support services are other sources of information
additional. Gaining access to various resources is key to diagnosing and solving
satisfactory network problems.
TechNet
There are countless electronic bulletins (BBS) dedicated to technical topics such as the case of
the networks. You can access the knowledge of experienced professionals in the field of
networks sending them questions. They were very popular, but the use of BBS is
starting to be replaced by the Internet and the Web.
User groups
User groups are a source of information. In the meetings of the groups, there is a
large amount of knowledge. Some meetings are held online; in others, the groups are
They meet in person. User groups tend to organize around an operating system.
or to a hardware platform.
Publications
Network technology is in a state of continuous evolution. There are available in the network
many books, but they become outdated quickly. Industry periodicals
Social media often serves as a better source of information because it provides the information
currently available. Through the Internet, you can access many periodicals and
related resources.
The internet is a resource for selecting varied information and can help to find
useful information for network managers (network administrators or support engineers).
The internet gives users access to information ranging from the latest technologies to assistance.
about product information for troubleshooting.
The internet is a set of networks, gateways, servers, and devices connected using a
set of telecommunications protocols. The internet provides worldwide access to large
information resources that are easily accessible from universities, organizations
governmental, military libraries and other public and private organizations.
The Internet evolved from a project of the United States Department of Defense, the
Advanced Research Projects Agency Network (ARPANET), which was designed as a test for the
packet exchange networks. The protocol used for ARPANET was TCP/IP, which
is still used today on the Internet.
Internet Services
Nowadays, the Internet is growing by leaps and bounds through the services it provides. Some
Some of the most well-known services currently available on the web are:
World Wide Web (or the Web) contains a tremendous store of written hypertext documents
using Hypertext Markup Language (HTML), Extensible Markup Language (XML) and
The standardized general markup language (SGML), among others. Hypertext is a method
for the presentation of text, images, sound, and videos that are linked and related
with each other. The hypertext format allows the user to navigate through the topics in any order. The
tools and Internet protocols help you locate and transport resources between
teams.
Some of the best sites contain a complete knowledge base that allows for
search. Within this database, there is technical information about current products and
previous.
Familiarizing yourself with the websites of network manufacturers can increase your resources for
maintenance, updating, and troubleshooting of the network.
Since these chains of numbers are difficult to remember and difficult to write correctly,
the domain name system was created. Domain names allow for the assignment of
short names to IP addresses to describe where the equipment is. In the example,
[Link] the domain name is [Link]. A website with a
An easy-to-remember name will receive more calls than a site with a difficult name. Names of
the domains can represent the identity of the company, as is the case with [Link], or
to be part of it, as in the case of [Link].
In Microsoft Windows NT Server, the HOSTS and LMHOSTS files are configuration files.
responsible for name resolution. The HOSTS file resolves file names
corresponding to IP addresses, and the LMHOSTS file maps NetBIOS names
to the IP addresses. These are two ASCII files that can be edited with Notepad.
Microsoft or with any text editor.
The last three characters of the DNS or UNC address indicate the type of domain. Examples of
Common types of domains in the United States are:
• Spain: .es
• France: .fr
• United Kingdom: .uk
• United States: .us
Internet Names
On the Internet, each resource has its own locator identifier or Uniform Resource Locator.
resources (URL). The URLs specify the server as well as the access method and the location.
The address starts with two slashes. This use of slashes is very similar to
Agreement of the format for the universal denomination (UNC). The following address is the entry.
to access the Microsoft web server. 'http:' indicates the protocol that is used. The rest of the
entry, //[Link], is the address of the team.
[Link]
The following entry shows how to access Microsoft's FTP server. In this case, it is
using the FTP protocol.
[Link]
Microsoft Windows NT, Windows 95 and 98, and Windows 2000 include the traditional FTP client in
text mode. This is one of the utilities that are copied to the system when it is installed.
set of TCP/IP protocols. In addition, most Internet browsers like Opera,
Netscape and Microsoft Internet Explorer support FTP and use it for file transfer.
When you search to download files from manufacturers' websites, they often lead you to their sites.
FTP. The reason is that FTP is much faster and better for file transfer and
keeps its website open to other users.
Currently, email (e-mail) is the method for sending and receiving messages.
electronics is the most popular activity on the Internet. Email is the basis of many
online commercial services, and for many people, the main reason to get into
Internet or subscribe to an online service.
By accessing the Internet through a local service provider or one of the online services
commercials, you can exchange email without incurring a phone call cost
at long distance. Email has the advantage of allowing you to access messages that you
interest. You can also send an identical message to several recipients at the same time.
News
The Simple Network Management Protocol (SNMP) is a standard protocol on the Internet.
defined for the distribution, search, retrieval and sending of news. News (USENET)
they are a well-known example of TNP usage. It offers newsletters, chat, and news. The news is
a massive system with about 5,000 conferences, called news groups, 24 hours a day
day, the 365 days of the year. To access these news groups, download a special program
of the Internet that allows you to participate in any news group you wish. Most of the
commercial explorers, including Microsoft Internet Explorer, have this built-in
characteristic. You must "subscribe" to the news groups that interest you and communicate through
of a messaging system similar to email. The difference between news and email
Electronic news, conversations take place in a public forum called
news group.
You can observe a conversation without participating; this is called 'lurking' and it is recommended.
to the newcomers. To join a conversation, send an article to the news group and it already forms
part of the forum. Like email, news is often a method of
informal communication with little distilled content. News operates at a very fast pace.
high, so the shipments appear quickly and continuously.
The group administrators set the amount of time during which access is allowed to
the messages before being deleted from the system. Most are not more than a week.
Discussion groups and chats are excellent sources of information and assistance on
technical themes.
Telnet
Telnet was one of the first protocols developed for the Internet and can be
use to act as a remote terminal to an Internet host. When connecting to a host
on the Internet, your device acts as if your keyboard is connected to the remote device. You can
run programs on a machine located in another part of the world, just as if
were there.
This terminal/host system evolved from the text mode systems of UNIX from the
Internet principles. Microsoft Windows 95 and 98, Windows NT and Windows 2000 install a
Telnet program as part of TCP/IP utilities. This program allows you to act as a
VT-52 or VT-100 terminal of a system accessible through TCP/IP, including the equipment
accessible via the Internet.
Websites
Many companies offer various types of support through websites. For example,
Microsoft maintains an Internet server that recognizes FTP. The FTP server contains information
about products, controllers, and other features of interest to administrators or
network technicians.
An administrator can access these sites to find help when having issues.
with the network. These services include services that usually provide information that will help you
resolve your network issue. These support subscription services are available at
different companies, such as Microsoft.
Resource localization
The localization of resources on the Internet is possible because each Internet resource has
an address. Programs known as browsers use these resource addresses and
search tools to help find information on a specific topic.
Explorers
To explore the Web you need a graphical interface called a web browser. Some
Well-known web browsers are Mosaic, Netscape, and Microsoft Internet Explorer. Once that
have your browser and an Internet connection, internet access is almost immediate. Due to the
a large amount of information available on the sites, the sites have proliferated
search to help users access the vast amount of information that continues
appearing on the Internet. To access these sites, one must know their URL.
To access the Internet servers, your device must be connected to the WAN
Internet.
There are two basic ways to physically connect to the Internet. The first is through lines
telephony. This is the most commonly used method. The second method to connect to the Internet is
through an ISDN connection.
Call
There are several types of calling accounts that offer different possibilities, depending on the
protocols that are used. All these connections require the Internet Protocol, and therefore, are
IP accounts. There are three types of IP accounts: Point-to-Point Protocol (PPP), Internet Protocol for
line serial (SLIP) and CSLIP, which is a compressed version of SLIP. PPP is the alternative that is
It is being imposed because it is faster and more reliable than the other types of IP accounts.
But PPP is also more complex, so many teams only have built-in support.
for SLIP. Complementary programs are being developed to allow most of the
platforms allow PPP accounts. In addition to the greater flexibility of PPP, it also offers a
dynamic IP address allocation similar to the Dynamic Host Configuration Protocol (DHCP),
which facilitates the connection to a service by avoiding the need to specify a valid IP address. With
an SLIP account, an automated script is usually used to make the connection even more
automatic.
With SLIP and PPP, the provider gives you a temporary Internet IP address and can run
any WinSock program (a program written to follow the specifications of sockets
of Windows) on the Internet. This includes graphical web browsers like Mosaic, Netscape and
Microsoft Internet Explorer.
Commercial online services, such as Microsoft Network and American Online, sometimes offer
a WinSock/PPP access method available as part of its service or as a service
additional through a fee.
ISDN
The Integrated Services Digital Network (ISDN) is a telecommunications service that connects
networks through digital lines using a terminal adapter. ISDN provides a connection
faster and can be cheaper than conventional telephone service if available
in their area. ISDN cards designed to support ISDN connections are already being used.
personal equipment.
Considerations
Theoretically, both methods, conventional phone call and ISDN, can connect to
Internet one or several user accounts. Probably, the conventional phone accounts
are the most appropriate for individual users, but ISDN provides a more comprehensive solution
economic (where available) for LAN, where multiple users connect to the Internet.