Network Service Troubleshooting (continued

Question 1

Expired IP addresses

Answer 1

Expired IP addresses
• A DHCP address should renew well before the lease expires
• The DHCP server(s) could be down
• Look for an APIPA assigned address
• 169.254.

Question 2

Rogue DHCP server

Answer 2

Rogue DHCP server
• IP addresses assigned by a non-authorized server
• There’s no inherent security in DHCP
Disable the rogue
• Renew the IP leases
Enable DHCP snooping on your switch

Question 3

Untrusted SSL certificate

Answer 3

Untrusted SSL certificate
• Browsers trust signatures from certain CAs
• A certificate was signed by a CA that’s not in our list
Compare to the CA list on your computer

Question 4

Incorrect time

Answer 4

Configure NTP on all devices

• Automate the clock setting

Question 5

Exhausted DHCP scope

Answer 5

Exhausted DHCP scope
• Client received an APIPA address
• Local subnet communication only
• Check the DHCP server
• Add more IP addresses if possible
• IP address management (IPAM) may help
• Monitor and report on IP address shortages
• Lower the lease time
• Especially if there are a lot of transient users

Question 6

Blocked TCP/UDP ports

Answer 6

Blocked TCP/UDP ports
• Applications not working
• Slowdowns with other applications
• Firewall or ACL configuration
• Security choke points
• Confirm with a packet capture
• No response to requests
• Run a TCP- or UDP-based traceroute tool
• See how far your packet can go

Question 7

Incorrect host-based firewall setting

Answer 7

Incorrect host-based firewall setting
• Applications not working
• Based on the application in use and 
not necessarily the protocol and port
• Check the host-based firewall settings
• Accessibility may be limited to an administrator
• Managed from a central console
• Take a packet capture
• The traffic may never make it to the network
• Dropped by the operating system

Question 8

Incorrect ACL setting

Answer 8

Incorrect ACL setting
• Only certain IP addresses accessible
• Or none
• Access Control Lists
• IP address, port numbers, and other parameters
• Can allow or deny traffic by filtering packets
• Confirm with packet captures and 
TCP/UDP traceroutes
• Identify the point of no return

Question 9

Unresponsive service

Answer 9

Unresponsive service
• No response to an application request
• No answer
• Do you have the right port number?
• And protocol (TCP/UDP)?
• Confirm connectivity
• Ping, traceroute
• Is the application still working?
• Telnet to the port number and see if it responds

Question 10

Hardware failure

Answer 10

Hardware failure
• No response
• Application doesn’t respond
• Confirm connectivity
• Without a ping, you’re not going to connect
• Run a traceroute
• See if you’re being filtered
• Should make it to the other side
• Check the server
• Lights? Fire?