Networking Basics ยท 13

๐Ÿ”ง Network Troubleshooting

The commands every tech person uses to diagnose network problemsโฑ ~3 min

๐ŸฉบTroubleshooting is like a doctor's diagnosis

A doctor doesn't guess randomly โ€” they follow a sequence: take vitals โ†’ check symptoms โ†’ run tests โ†’ narrow it down. Network troubleshooting follows the same logic: start from the bottom of the network stack (physical) and work up. Is the cable plugged in? Can you reach the router? Can you reach the internet? Can you reach the specific site? Each step narrows the problem.

The Standard Troubleshooting Sequence

  1. 1.ping 127.0.0.1 โ€” test the loopback. If this fails, your network stack is broken (reinstall drivers)
  2. 2.ping [default gateway] โ€” e.g., ping 192.168.1.1. If this fails, you can't reach your router (cable? WiFi?)
  3. 3.ping 8.8.8.8 โ€” ping Google's DNS by IP. If this fails, your router can't reach the internet (ISP issue)
  4. 4.ping google.com โ€” ping by name. If this succeeds after step 3, DNS is working normally
  5. 5.If step 3 works but step 4 fails โ€” DNS is the problem (try setting DNS to 8.8.8.8 manually)

Essential Commands

CommandWhat It DoesExample Output Tells You
ipconfig (Windows) ifconfig (Linux/Mac)Shows your IP, subnet mask, default gateway, DNSWhether you have a valid IP (169.254.x.x = DHCP failed)
ipconfig /release ipconfig /renewReleases and gets a fresh DHCP leaseFixes IP conflicts or expired leases
ping [IP or hostname]Sends 4 ICMP packets and waits for repliesRTT (round-trip time) and packet loss percentage
tracert (Windows) traceroute (Linux)Shows every router hop to the destinationWhere in the path the connection is dying
netstat -anLists all active connections and open portsWhich ports are listening; detect unexpected connections
nslookup [domain]Queries DNS manually for a domain nameWhich IP a name resolves to; which DNS server answered

Reading a ping result

  • โ€ขReply from 8.8.8.8: bytes=32 time=14ms TTL=118 โ€” success. 14ms is excellent.
  • โ€ขRequest timed out โ€” no reply. Host unreachable, firewall blocking ICMP, or no route.
  • โ€ขDestination host unreachable โ€” your local router doesn't know how to reach that IP.
  • โ€ขTTL expired in transit โ€” packet bounced too many hops and was discarded (routing loop?).
  • โ€ข0% packet loss โ€” perfect. >5% packet loss โ€” bad connection (WiFi interference, failing cable).

Reading a traceroute

Each line is one router hop. The number on the left is the hop count. Three time values are three test packets. '* * *' means that router blocks ICMP (common for security). A sudden jump from 5ms to 150ms tells you exactly which hop โ€” and which ISP or country โ€” is causing the delay.

โ˜… FactThe TTL (Time to Live) field in every IP packet counts down by 1 at each router hop. When it reaches 0, the packet is discarded and an error is sent back. traceroute exploits this: it sends packets with TTL=1 (gets an error from hop 1), then TTL=2 (gets an error from hop 2), and so on โ€” building a map of every router between you and the destination.
๐Ÿ”’ Securitynetstat -an is one of the first commands run during incident response. Open ports you didn't expect โ€” like a process listening on port 4444 (common malware port) or 1337 โ€” are a red flag. Attackers often leave backdoors that listen on non-standard ports. In CyberPatriot, running netstat and identifying unexpected listening services is a key forensic technique.
๐Ÿง Quick Checkfirst try = +5 XP

You run these commands in order: (1) ping 127.0.0.1 โ€” success. (2) ping 192.168.1.1 โ€” success. (3) ping 8.8.8.8 โ€” Request timed out. (4) ping google.com โ€” Request timed out. Where is the problem?

โญ 0 XP๐Ÿ”ฅ 0 days