Network Service Troubleshooting Flashcards
Names not resolving
- Web browsing doesn’t work
- The Internet is broken!
- Pinging the IP address works
- There isn’t a communication problem
- Applications aren’t communicating
- They often use names and not IP addresses
Troubleshooting DNS issues
- Check your IP configuration
- Is the DNS IP address correct?
• Use nslookup or dig to test - Does resolution work?
• Try a different DNS server - Google is 8.8.8.8 &
8.8.4.4
IP configuration issues
- Communicate to local IP addresses
- But not outside subnets
- No IP communication - Local or remote
- Communicate to some IP addresses - But not others
Troubleshooting IP configurations
- Check your documentation
- IP address, subnet mask, gateway
- Monitor the traffic
- Examine local broadcasts
- Difficult to determine subnet mask
- Check devices around you
- Confirm your subnet mask and gateway
- Traceroute and ping
- The issue might be your infrastructure
- Ping local IP, default gateway, and outside address
Duplicate IP addresses
• Static address assignments - Must be very organized
- DHCP isn’t a panacea
- Static IP addressing
- Multiple DHCP servers overlap
- Rogue DHCP servers
- Intermittent connectivity
- Two addresses “fight” with each other
• Blocked by the OS - Checks when it starts
Troubleshooting duplicate IP addresses
- Check your IP addressing - Did you misconfigure?
- Ping an IP address before static addressing
- Does it respond?
- Determine the IP addresses
- Ping the IP address, check your ARP table
- Find the MAC address in your switch MAC table
- Capture the DHCP process
- What DHCP servers are responding?
Duplicate MAC addresses
- Not a common occurrence
- MAC addresses are designed to be unique
- May be a man-in-the-middle attempt
- Mistakes can happen
- Locally administered MAC addresses
- Manufacturing error
• Intermittent connectivity
• Confirm with a packet capture, should see ARP
contention
- Use the ARP command from another computer
- Confirm the MAC matches the IP
Expired IP addresses
• A DHCP address should renew well before the lease
expires
• The DHCP server(s) could be down
- Client gives up the IP address at the end of the lease
- APIPA address is assigned
- Checks in occasionally for a DHCP server
- Look for an APIPA assigned address
- 169.254..
• Check the status of your DHCP server
Rogue DHCP server
- IP addresses assigned by a non-authorized server
- There’s no inherent security in DHCP
- Client is assigned an invalid or duplicate address
- Intermittent connectivity, no connectivity
- Disable rogue DHCP communication
- Enable DHCP snooping on your switch
- Authorized DHCP servers in Active Directory
- Disable the rogue
- Renew the IP leases
Untrusted SSL certificate
- Browsers trust signatures from certain CAs
- A certificate was signed by a CA that’s not in our list
- Error message on the browser
- Certificate Authority Invalid
- Check the certificate details
- Look for the issuing CA
- Compare to the CA list on your computer
- If it’s an internal server, it may be internally signed
- Add your internal CA certificate to the list
Incorrect time
• Some cryptography is very time sensitive
• Active Directory requires clocks set within
five minutes of each other
• Kerberos communication uses a time stamp
• If the ticket shown during authentication is too old,
it’s invalid
- Client can’t login
- Check the timestamp of the client and the server
- Configure NTP on all devices
- Automate the clock setting
Exhausted DHCP scope
- Client received an APIPA address
- Local subnet communication only
- Check the DHCP server
- Add more IP addresses if possible
- IP address management (IPAM) may help
- Monitor and report on IP address shortages
- Lower the lease time
- Especially if there are a lot of transient users
Blocked TCP/UDP ports
- Applications not working
- Slowdowns with other applications
- Firewall or ACL configuration
- Security choke points
- Confirm with a packet capture
- No response to requests
- Run a TCP- or UDP-based traceroute tool
- See how far your packet can go
Incorrect host-based firewall setting
• Applications not working
• Based on the application in use and not necessarily
the protocol and port
- Check the host-based firewall settings
- Accessibility may be limited to an administrator
- Managed from a central console
- Take a packet capture
- The traffic may never make it to the network
- Dropped by the operating system
Incorrect ACL setting
- Only certain IP addresses accessible
- Or none
- Access Control Lists
- IP address, port numbers, and other parameters
- Can allow or deny traffic by filtering packets
• Confirm with packet captures and TCP/UDP
traceroutes
• Identify the point of no return
