CompTIA Network+ Preparation · lesson 30 of 30 · 25 min
Troubleshooting Methodology Review
Network+ Domain 5 is heavily scenario-based. You must apply the seven-step troubleshooting methodology and know which tool or action addresses each symptom.
Steps: 1. Identify the problem. 2. Establish a theory. 3. Test the theory. 4. Establish an action plan. 5. Implement the solution. 6. Verify functionality. 7. Document findings.
OSI model troubleshooting: Work bottom-up (Physical → Data Link → Network → Transport → Session → Presentation → Application) or top-down depending on symptoms. Physical issues cause everything to fail; application issues affect only specific services.
Common Scenarios and Solutions
Scenario: PC cannot reach the internet but can ping the default gateway.
Layer 3 (IP) is working locally. Issue is likely: DNS failure (can’t resolve names), routing issue beyond the gateway, or firewall blocking outbound traffic. Test: ping 8.8.8.8 (bypasses DNS). If that works, DNS is the problem.
Scenario: PC has 169.254.x.x address.
APIPA address = DHCP failure. Check: Is the DHCP server running? Is the DHCP scope full? Is there a relay agent configured for this subnet? Is the PC’s NIC working?
Scenario: Intermittent connectivity on a switch port.
Physical layer issue. Check: cable (bent, damaged), connector (dirty, not fully seated), duplex/speed mismatch (half-duplex causes collisions), STP port state changes.
Scenario: Users in VLAN 10 cannot reach users in VLAN 20.
VLANs require Layer 3 routing. Check: Is inter-VLAN routing configured (router-on-a-stick or L3 switch SVI)? Are the SVIs up? Is the trunk port configured correctly?
Scenario: Slow network performance, high CPU on switches.
Possible broadcast storm or switching loop. Check: STP topology (is a port stuck in forwarding that should be blocked?). Look for duplicate MAC addresses in the MAC table.
Scenario: Cannot connect to a web server on port 443.
Check: Is the service running on the server? Is port 443 open in the firewall? Is DNS resolving correctly? Use telnet/nc to test port connectivity: telnet server 443.
Exam Strategy
Read each scenario carefully — identify the OSI layer of the symptom first. Physical symptoms (no link light, cable issues) = Layer 1. MAC/VLAN issues = Layer 2. IP/routing = Layer 3. Port/service issues = Layer 4+. This narrows your tool and solution choices immediately.
Key Troubleshooting Commands
ipconfig /all — shows IP, mask, gateway, DNS, DHCP server, MAC address on Windows.
ipconfig /release + /renew — releases and renews DHCP lease.
ping — tests Layer 3 connectivity. Ping loopback (127.0.0.1) → ping default gateway → ping remote host.
traceroute / tracert — shows path to destination, identifies where packets stop.
nslookup / dig — queries DNS. Tests name resolution and identifies DNS server issues.
netstat — shows active connections, listening ports, and routing table.
arp -a — shows ARP cache (IP to MAC mappings). Useful for Layer 2 troubleshooting.
show interfaces (Cisco) — shows interface status, errors, duplex, speed.
show ip route (Cisco) — shows routing table.
show vlan brief (Cisco) — shows VLAN assignments.
Key Terms
Key Terms
Knowledge Check — 12 Questions
Network+ — Troubleshooting Scenarios
A PC has a 169.254.x.x address. What is the most likely cause?
- Static IP conflict
- DHCP server unreachable or scope exhausted
- DNS failure
- Default gateway misconfiguration
Answer: DHCP server unreachable or scope exhausted
APIPA (169.254.x.x) is assigned when DHCP fails. Check: DHCP server running, scope not full, relay agent configured.
A user can ping 8.8.8.8 but cannot browse websites by name. The issue is:
- Default gateway
- DNS resolution
- Physical layer
- DHCP
- Answer: DNS resolution
Pinging an IP works (Layer 3 OK) but name resolution fails = DNS problem. Check DNS server settings with nslookup.
Which tool identifies where packets stop on the path to a destination?
- ping
- nslookup
- traceroute
- arp
Answer: traceroute
traceroute (tracert on Windows) shows each hop to the destination — identifies the router where packets stop.
Users in VLAN 10 cannot reach VLAN 20. The first thing to check is:
- Cable connections
- Inter-VLAN routing configuration (SVI or router-on-a-stick)
- DHCP scope
- DNS server
- Answer: Inter-VLAN routing configuration (SVI or router-on-a-stick)
VLANs are separate Layer 2 networks — they require Layer 3 routing to communicate. Check SVIs or router-on-a-stick config. A switch port shows many CRC errors. This indicates:
- DNS failure
- Physical layer issue — bad cable or NIC
- VLAN misconfiguration
- Routing loop
- Answer: Physical layer issue — bad cable or NIC
CRC errors indicate corrupted frames — caused by bad cables, damaged connectors, EMI interference, or a failing NIC. ipconfig /release followed by /renew is used to:
- Reset the DNS cache
- Release and renew a DHCP lease
- Reset the ARP cache
- Flush the routing table
- Answer: Release and renew a DHCP lease
ipconfig /release drops the current DHCP lease; /renew requests a new one. Used when a PC has an incorrect or expired IP. A duplex mismatch between a PC and switch causes:
- No connectivity at all
- Collisions and poor performance — late collisions on the full-duplex side
- VLAN issues
- DNS failures
- Answer: Collisions and poor performance — late collisions on the full-duplex side
Duplex mismatch: full-duplex side does not detect collisions; half-duplex side sees late collisions. Results in poor throughput. The arp -a command shows:
- Active TCP connections
- IP to MAC address mappings in the ARP cache
- DNS cache entries
- Routing table
- Answer: IP to MAC address mappings in the ARP cache
arp -a displays the ARP cache — useful for verifying Layer 2 reachability and detecting ARP spoofing. show ip route on a Cisco router displays:
- VLAN assignments
- Interface error counters
- The routing table
- MAC address table
- Answer: The routing table
show ip route displays all routes — connected (C), static (S), OSPF (O), EIGRP (D), etc. Used to verify routing. Bottom-up troubleshooting starts at:
- The application layer
- The physical layer
- The network layer
- The transport layer
- Answer: The physical layer
Bottom-up: start at Layer 1 (Physical — cables, connectors, link lights) and work up. Used when the problem layer is unknown. A broadcast storm is most likely caused by:
- DNS misconfiguration
- A switching loop — STP not blocking a redundant path
- Too many VLANs
- DHCP scope exhaustion
- Answer: A switching loop — STP not blocking a redundant path
Broadcast storms occur when frames loop endlessly. STP should block redundant paths — if STP fails, a loop forms.
The Cisco command _____ shows VLAN membership for all switch ports.
Answer: show vlan brief
show vlan brief displays all VLANs and which ports are assigned to each — essential for VLAN troubleshooting.
Previous lesson: Troubleshooting wireless: signal strength, interference, channel overlap, authentication failures
Back to CompTIA Network+ Preparation