5.5.2. Network Diagnostic Commands and Tools
💡 First Principle: Every network diagnostic command serves a specific diagnostic purpose. Using the wrong command for the question you're asking wastes time and produces misleading results. Know what each command tests and what its output tells you.
Diagnostic Command Reference
| Command | Platform | What It Tests | Key Use |
|---|---|---|---|
ipconfig | Windows | IP configuration | Show current IP, mask, gateway, DNS |
ip addr | Linux | IP configuration | Show interfaces and addresses |
ip route | Linux | Routing table | Show routes; confirm default gateway |
route print | Windows | Routing table | Show routing table |
ping | Both | Layer 3 connectivity | Tests IP reachability and latency |
tracert | Windows | Route tracing | Shows path and each hop's latency |
traceroute | Linux | Route tracing | Same as tracert; identifies where packets stop |
nslookup | Both | DNS resolution | Resolves names to IPs; tests DNS server |
dig | Linux | DNS resolution | More detailed DNS query output than nslookup |
netstat | Both | Active connections | Shows listening ports, active sessions, routing table |
nbtstat | Windows | NetBIOS | Resolves NetBIOS names, shows NetBIOS cache |
telnet | Both | Port connectivity | Tests TCP connection to specific port (e.g., telnet server 443) |
nc (netcat) | Linux | Port connectivity | Versatile; test TCP/UDP connections, banner grab |
Systematic Diagnostic Sequence
Physical Checks
- Check link lights: No link light = physical problem. Don't proceed to logical until physical is confirmed.
- Confirm power supply: If the server isn't on, it can't communicate.
- Verify cable integrity: Check for damage; try a known-good cable.
- Check appropriate cable selection: Straight-through vs. crossover; correct fiber type (single vs. multimode).
⚠️ Exam Trap: ping success does not prove a service is working — it only proves Layer 3 reachability. A web server that responds to ping but returns errors may have a service failure, a firewall blocking port 80/443, or a misconfigured virtual host. Use telnet server 80 or nc -zv server 80 to test the specific port.
Reflection Question: A user reports that a web application is unreachable. You ping the web server's IP address and get a response. You then try telnet webserver 80 and get "Connection refused." What does this tell you about the problem?
