CompTIA Network+ Preparation · lesson 27 of 30 · 25 min
Command-Line Diagnostic Tools
ping — tests Layer 3 connectivity using ICMP Echo Request/Reply. A successful ping confirms IP connectivity between source and destination. Options: -t (continuous on Windows), -c N (N packets on Linux), -s (packet size). If ping fails, check: IP config, default gateway, routing, firewall (ICMP may be blocked).
traceroute / tracert — maps the path packets take to a destination, showing each hop’s IP and round-trip time. Uses TTL manipulation (ICMP TTL Exceeded messages). Windows: tracert. Linux/Mac: traceroute. Useful for identifying where packets are being dropped or delayed.
pathping (Windows) — combines ping and traceroute, showing packet loss at each hop over multiple rounds. More detailed than tracert alone.
ipconfig / ifconfig / ip addr — displays IP configuration. Windows: ipconfig /all (shows IP, mask, gateway, DNS, MAC). Linux: ip addr show or ifconfig.
ipconfig /release and /renew — releases and renews DHCP lease. Useful when a device has an incorrect IP or APIPA address (169.254.x.x).
DNS and Name Resolution Tools
nslookup — queries DNS servers. nslookup hostname resolves a name. nslookup -type=MX domain queries MX records. Can specify a DNS server: nslookup hostname 8.8.8.8.
dig (Linux/Mac) — more powerful DNS query tool. dig hostname, dig @8.8.8.8 hostname A, dig -x IP (reverse lookup). Shows full DNS response including TTL and authoritative server.
host (Linux) — simple DNS lookup. host hostname.
If nslookup works but browsing fails, the issue is above DNS (application layer). If nslookup fails, DNS is the problem — check DNS server config and connectivity.
Network Analysis Tools
Wireshark — graphical packet capture and analysis tool. Captures all traffic on an interface (or via SPAN/mirror port). Key features: display filters (ip.addr == 10.1.1.1, tcp.port == 80, http), follow TCP stream, protocol statistics. Essential for deep troubleshooting.
tcpdump — command-line packet capture (Linux/Mac). tcpdump -i eth0 host 10.1.1.1. Saves to .pcap files for Wireshark analysis.
netstat — displays active connections, listening ports, and routing table. netstat -an (all connections with port numbers), netstat -r (routing table). Linux equivalent: ss.
arp — displays and manages the ARP cache. arp -a (show all entries). Useful for diagnosing ARP poisoning and duplicate IP issues.
route — displays and modifies the routing table. route print (Windows), ip route show (Linux).
Physical Layer Tools
Cable tester — verifies cable continuity, wiring order, and detects opens, shorts, and crossed pairs. Basic testers show pass/fail; advanced testers show TDR results.
TDR (Time Domain Reflectometer) — sends a signal down a cable and measures reflections to locate faults (breaks, shorts) and measure cable length.
OTDR (Optical TDR) — same principle for fiber optic cables. Locates breaks, splices, and bends.
Loopback plug — connects TX to RX on a port to test the port’s transmit and receive circuits without a cable.
Toner/probe (fox and hound) — injects a tone on one end of a cable; a probe detects the tone to identify the cable at the other end (useful in patch panels).
Light meter / power meter — measures optical signal strength on fiber. Compares to expected loss budget.
Multimeter — measures voltage, resistance, and continuity. Used for basic electrical troubleshooting.
Wi-Fi analyzer — shows wireless networks, signal strength (RSSI), channel utilization, and interference. Used to optimize AP placement and channel selection.
Tool Selection on the Exam
Match the tool to the layer: Physical layer → cable tester, TDR, loopback plug | Layer 3 → ping, traceroute, route | DNS → nslookup, dig | Traffic analysis → Wireshark, tcpdump | Port/connection status → netstat, ss
Key Terms
Key Terms
Knowledge Check — 12 Questions
Network Troubleshooting — Tools
Which tool maps the hop-by-hop path packets take to a destination?
- ping
- traceroute
- netstat
- nslookup
Answer: traceroute
traceroute (tracert on Windows) uses TTL manipulation to reveal each router hop between source and destination.
A device has an IP address of 169.254.x.x. What does this indicate?
- Static IP assigned correctly
- DHCP lease obtained successfully
- DHCP failed — APIPA address assigned
- IPv6 link-local address
Answer: DHCP failed — APIPA address assigned
169.254.x.x is an APIPA (Automatic Private IP Addressing) address — assigned when DHCP fails. Run ipconfig /release and /renew.
Which tool captures and analyzes network packets at the frame level?
- ping
- netstat
- Wireshark
- nslookup
Answer: Wireshark
Wireshark captures raw packets and decodes them — essential for deep protocol analysis and troubleshooting.
nslookup is used to:
- Test Layer 3 connectivity
- Query DNS servers for name resolution
- Display active TCP connections
- Capture network packets
- Answer: Query DNS servers for name resolution
nslookup queries DNS servers to resolve hostnames to IPs (and vice versa) — essential for DNS troubleshooting.
Which physical layer tool locates a cable break by measuring signal reflections?
- Cable tester
- TDR
- Loopback plug
- Toner/probe
Answer: TDR
A TDR (Time Domain Reflectometer) sends a signal and measures reflections to locate faults and measure cable length.
netstat -an displays:
- DNS cache entries
- All active connections and listening ports with numeric addresses
- Routing table
- ARP cache
- Answer: All active connections and listening ports with numeric addresses
netstat -an shows all TCP/UDP connections and listening ports using numeric IP addresses and port numbers. A toner/probe (fox and hound) is used to:
- Test cable continuity
- Identify which cable in a bundle corresponds to a specific port
- Measure optical signal strength
- Capture wireless traffic
- Answer: Identify which cable in a bundle corresponds to a specific port
A toner injects a signal; the probe detects it — used to trace cables through walls, ceilings, and patch panels.
Which command-line tool on Linux is the modern replacement for netstat?
- ifconfig
- ip addr
- ss
- dig
Answer: ss
ss (socket statistics) is the modern replacement for netstat on Linux — faster and more detailed.
An OTDR is used for:
- Copper cable testing
- Fiber optic cable fault location
- Wireless signal analysis
- IP address scanning
- Answer: Fiber optic cable fault location
OTDR (Optical TDR) uses reflected light pulses to locate breaks, splices, and bends in fiber optic cables. A Wi-Fi analyzer tool is used to:
- Capture wired network packets
- Show wireless networks, signal strength, and channel utilization
- Test cable continuity
- Query DNS records
- Answer: Show wireless networks, signal strength, and channel utilization
Wi-Fi analyzers display nearby SSIDs, RSSI (signal strength), channel usage, and interference — used to optimize wireless deployments. tcpdump differs from Wireshark in that:
- tcpdump cannot capture packets
- tcpdump is command-line only; Wireshark is graphical
- Wireshark only works on Windows
- tcpdump requires a SPAN port
- Answer: tcpdump is command-line only; Wireshark is graphical
tcpdump is a CLI packet capture tool (Linux/Mac); Wireshark provides a graphical interface. Both save .pcap files. pathping (Windows) combines the functionality of:
- ping and nslookup
- ping and tracert
- tracert and Wireshark
- netstat and arp
- Answer: ping and tracert
pathping sends packets to each hop (like tracert) and measures packet loss at each hop over time (like extended ping).
Try it: Pick the tool
Previous lesson: Troubleshooting methodology: identify, establish theory, test, implement, verify, document
Back to CompTIA Network+ Preparation
Next lesson: Troubleshooting wired connectivity: cable faults, duplex mismatch, VLAN issues, STP problems