Network Troubleshooting Flashcards
traceroute/tracert
used to trace the route from client to server, etc.
netstat
shows all active connections
-n lists numerically
-b shows executable file
-o shows process id
-a shows all active ports
-r shows routing table
Troubleshooting Methodology Step 1
Identify the Problem
1. Gather information
2. Question users
3. Identify symptoms
4. Determine if anything has changed
5. Duplicate problems if possible
Troubleshooting Methodology Step 2
Establish a Theory of Probable Cause
1. Question the obvious
2. Consider multiple approaches (top to bottom/bottom to top/divide and conquer)
Troubleshooting Methodology Step 3
Test the Theory to Determine the Cause
1. If theory is confirmed, determine next steps
2. If theory is not confirmed, reestablish new theory or escalate
Troubleshooting Methodology Step 4
Establish a plan of action
Troubleshooting Methodology Step 5
Impmlement the solution or escalate as necessary
Troubleshooting Methodology Step 6
Verify full system functionality and if applicable, implement preventative measures
Troubleshooting Methodology Step 7
Document findings, actions, outcomes, and lessons learned
Speed/Bandwidth of cable
Theoretical maximum data rate (size of the pipe)
Throughput
Amount of data transferred in a given timeframe (how much water is flowing through the pipe)
Protocol Analyzer
Gathers frames on the network (or in the air)
Can view traffic patterns, identify unknown traffic, etc.
iperf
used to measure speed and performance - requires server and client
Port Scanners
Used to identify IP addresses and open ports (OS, services, et.c)
NetFlow
Gathers traffic statistics from all traffic flows. Uses probes and collectors to create reports.
TFTP Server
Good for firmware upgrades: your device is the server and the network device is the client.
Terminal Emulator
SSH - used for encrypted remote access to command prompt.
ping
tests reachability using ICMP
ipconfig/ifconfig/ip
determines IP address, subnet mask, and default gateway
/all gives you more details
nslookup / dig
used to look up canonical names, IP addresses, cache timers, etc. dig is more advanced
arp
arp -a : view local arp table
hostname
view the FQDN and IP address of a device
route
View device’s routing table
route print
(netstat -r does the same thing)
telnet
remote console access (unencrypted)
tcpdump
Captures packets from the command line
nmap
Network mapper
Finds devices and identify open ports
Can discover the OS as well
show interface
views the interfaces on a device
show config
views the device configuration
show route
shows routing table
RSSI
Received Signal Strength Indication (measured in dBm, closer to zero is better) the amount of signal received
EIRP
Effective Isotropic Radiated Power - the radiated signal strength (the actual amount of power being produced)
EIRP
Effective Isotropic Radiated Power - the radiated signal strength
Antenna Polarization
its position relative to the ground
AP association time
Client Disassociation
A type of attack that drops clients from the network. Older 802.11 standards are vulnerable.
