Have you ever had a problem with your internet connection and didn't know where to start? You're not alone. Network troubleshooting is the process of identifying, diagnosing, and solving problems on computer networks. Think of it as being a detective or a doctor for your network, you look for symptoms, run tests, and find the root cause of the issue.

In this room, you'll learn the essential tools used by IT professionals to fix network problems. These tools help you see what's happening "under the hood" of your network, from checking if a device is reachable to analyzing the raw data traveling between computers. This skill is crucial for anyone in IT support, cybersecurity, or anyone who wants to understand how networks really work.

Why Network Troubleshooting Matters

In the real world, networks are complex and problems are inevitable. A slow connection could mean lost productivity for a business. A complete outage could stop all work. Knowing how to systematically find and fix these problems saves time, money, and a lot of frustration. The tools you'll learn here are the foundation of effective network management and security analysis.

What You Will Learn

• What network troubleshooting is and why we use a step-by-step methodology.
• How to use basic tools like Ping and IPConfig to check connectivity and settings.
• How to use tools like Traceroute and Netstat to map paths and view connections.
• An introduction to powerful tools like Wireshark for deep analysis.
• How to put all these tools together into a logical troubleshooting process.

Prerequisites

• Basic understanding of networks, IP addresses, and protocols (from previous rooms).
• No prior experience with command-line tools is needed—we'll explain everything.

Common Network Problems & What They Look Like

Problem	Common Symptoms	Possible Tool to Start With
No Internet Access	Can't load websites, online apps fail.	ping (to test basic connectivity)
Slow Connection	Web pages load slowly, videos buffer.	traceroute (to find where delays occur)
Can't Reach a Specific Website	One site is down but others work.	nslookup (to check DNS)
"IP Address Conflict" Message	Error pop-up on computer.	ipconfig (to check your IP settings)
Unknown Network Activity	High network usage from an unknown process.	netstat (to see active connections)

Your First Troubleshooting Scenario

Imagine this: You're at home, and your video call keeps freezing and dropping. Your family says the internet is "laggy." Where do you start?

1. Identify: The symptom is "laggy internet" and dropped calls.
2. Gather: Is it affecting all devices? Just video calls? Did it start recently?
3. Test: You might first ping your router to check the local connection, then ping an outside site like google.com. You could run a traceroute to see if the delay is inside your house or out on the internet.
4. Analyze: The ping results show high response times. The traceroute shows a big jump in delay at your Internet Service Provider's network.
5. Fix: The problem is likely not in your home. You might restart your modem or contact your ISP.

This logical approach works for almost any network problem!

Optional Video

This optional video covers the fundamental concepts of network troubleshooting tools. It's helpful but not required to complete the room.

When a network problem occurs, the first questions are often: "Is anything reachable?" and "What are my own settings?" The tools ping and ipconfig (Windows) / ifconfig (Linux/macOS) answer these questions. They are the Swiss Army knife and ID card of network troubleshooting.

Ping: The Network Echo Test

The ping command is the simplest way to test if you can reach another device on a network (like a website, server, or your router). It works by sending small data packets called ICMP Echo Requests to a target and waiting for ICMP Echo Replies.

Real-World Analogy: Think of ping like shouting "Hello!" in a tunnel and listening for an echo. If you hear the echo, you know the tunnel is clear and you can estimate how long it took. If you hear nothing, something is blocking the sound.

How to Use Ping (Examples)

Windows/Linux/macOS Command Prompt:

ping google.com

This pings the Google website.

You might see:

Reply from 172.217.16.206: bytes=32 time=24ms TTL=57
Reply from 172.217.16.206: bytes=32 time=26ms TTL=57

This means you got a reply! The time=24ms is the latency (delay) in milliseconds. Lower is faster.

Common Ping Results & What They Mean

Result	What It Means	Likely Cause
Reply from [IP]...	Success! The target is reachable and responding.	Network path is good.
Request timed out.	No reply was received before the time limit.	Target is offline, blocking ping, or a network block exists.
Destination host unreachable.	Your computer doesn't know how to reach the target network.	Local network or router issue.
Ping request could not find host...	The website name could not be translated to an IP address.	DNS problem.

IPConfig / IfConfig: Know Thyself

Before you can troubleshoot others, you must know your own network identity. ipconfig (Windows) and ifconfig (Linux/macOS) display the current network configuration of your computer.

Real-World Analogy: This is like looking at your car's dashboard to see your speed, fuel level, and engine status before trying to figure out why traffic is slow.

Key Information from IPConfig:

• IPv4 Address: Your computer's unique IP address on the local network (e.g., 192.168.1.15).
• Subnet Mask: Defines your local network segment (e.g., 255.255.255.0).
• Default Gateway: The IP address of your router, the "door" to the outside internet (e.g., 192.168.1.1).
• DNS Servers: The addresses of the servers that translate google.com into an IP like 8.8.8.8.

Putting It Together: A Simple Diagnostic

Scenario: You cannot load any websites.

1. Step 1: Run ipconfig. Check that you have a valid IP address and that your Default Gateway has an address (it's not 0.0.0.0).
2. Step 2: ping your Default Gateway address (e.g., ping 192.168.1.1).
   • If this FAILS: The problem is between your computer and your router (local network issue: cable, Wi-Fi, router power).
   • If this SUCCEEDS: Your local network is fine. The problem is likely with your router's connection to the internet or your DNS.

This simple two-step test isolates the problem and tells you where to look next!

Once you know basic connectivity is possible (ping), the next questions are: "What path is the data taking?" and "What is my computer actually connected to right now?" The tools traceroute (or tracert on Windows) and netstat answer these more detailed questions.

Traceroute / Tracert: Mapping the Journey

The traceroute command reveals the path your data packets take as they travel from your computer to a final destination, like a website server. It shows every intermediate router (called a hop) along the way and measures the delay to each one.

Real-World Analogy: Imagine sending a package with a tracking number. The tracking receipt doesn't just show "delivered"; it shows every warehouse and distribution center it passed through: Your House → Local Post Office → Regional Hub → Destination City Post Office → Friend's House. traceroute does this for network packets.

How Traceroute Works (Simplified):

It sends a series of packets with increasing Time-To-Live (TTL) values. Each router that handles a packet decreases the TTL by 1. When the TTL hits 0, the router sends back an error message. By starting with TTL=1, then TTL=2, etc., traceroute gets a reply from each router along the path.

Using Traceroute to Diagnose Slowness

If a website is slow, traceroute can show you where the slowness occurs.

traceroute google.com

Output Insight: You'll see a list of hops with three time measurements each (e.g., 10 ms 12 ms 15 ms). A sudden, sustained increase in these times at a specific hop points to a network congestion problem at that point in the internet. If hops show * * *, that device isn't responding (which is common and doesn't always mean an error).

Netstat: Seeing Active Connections

While traceroute looks outward, netstat (Network Statistics) looks inward. It shows all active network connections to and from your computer, as well as which ports are listening for connections.

Real-World Analogy: This is like your phone's "Recent Calls" list combined with a list of services that are ready to receive calls (like your voicemail inbox). It tells you who you're talking to and what doors on your computer are open.

Common Netstat Command & Output:

netstat -an

• -a shows all connections and listening ports.
• -n displays addresses and port numbers in numbers (e.g., 192.168.1.10:443) instead of trying to resolve names, which is faster.

Common Netstat Connection States & Meanings

State	What It Means
LISTENING	Your computer has a service (program) waiting for incoming connections on a specific port. This is normal for web servers, game clients, etc.
ESTABLISHED	An active, two-way connection is currently happening between your computer and another.
CLOSE_WAIT	The remote side has closed the connection, and your system is finishing up before closing its end.
TIME_WAIT	Your system has closed the connection and is waiting to ensure no more packets arrive for it.

Scenario: The Slow Website

You're at work, and cloudservice.com is very slow. On your phone using cellular data, it's fast.

• Tool to Use: traceroute cloudservice.com from your work computer.
• What to Look For: You run the command and see that the first few hops (your office network) are fast (<5ms). At Hop 4, which belongs to your company's Internet Service Provider (ISP), the latency jumps to over 200ms and stays high for all subsequent hops.
• Conclusion: The bottleneck is at your ISP's network, not the destination website or your local office equipment. The problem is "in the middle" of the path.

Some network issues are like tricky puzzles. Basic connectivity is fine, but something more specific is wrong like names not resolving, or strange application errors. For these, you need more specialized tools: Nslookup/Dig for name resolution and Wireshark for deep packet inspection.

Nslookup and Dig: Consulting the Digital Phone Book

When you type google.com into your browser, your computer needs to find Google's IP address. It asks a DNS (Domain Name System) server,the internet's phone book. If this process breaks, you get "Site cannot be reached" errors even though the internet works. nslookup (Windows/Linux) and dig (Linux/macOS) let you query DNS servers directly to troubleshoot.

Real-World Analogy: This is like calling the telephone company's directory assistance to ask for a specific number, instead of just dialing and hoping it works.

Using Nslookup:

nslookup google.com

Output Example:

Server:  dns.yourisp.com
Address:  192.168.1.1

Non-authoritative answer:
Name:    google.com
Addresses:  2607:f8b0:4009:80e::200e
          172.217.16.206

This tells you which DNS server answered (dns.yourisp.com) and gives you the IP addresses (172.217.16.206 for IPv4, the longer one for IPv6) that google.com resolves to.

Common DNS Record Types & Their Purpose

Record Type	What It Does	Simple Explanation
A	Maps a domain name to an IPv4 address.	The main address entry.
AAAA	Maps a domain name to an IPv6 address.	The address entry for newer IPv6.
MX	Specifies mail servers for the domain.	Tells email where to be delivered.
CNAME	An alias for another domain name.	A nickname that points to a real name.

Digging with dig (more detailed output):

dig google.com

dig provides more technical details than nslookup and is a favorite of network administrators.

Scenario 1: The Website That Vanished

You can ping 8.8.8.8 successfully, but typing google.com into your browser fails.

• Diagnosis: This points to a DNS problem. Your computer can reach the internet (ping works to an IP), but it cannot translate the name google.com into an IP address.
• Test: Run nslookup google.com.
  • If it fails or times out, your configured DNS server is having issues. Try nslookup google.com 8.8.8.8 to test using Google's public DNS.
  • If it succeeds, the problem might be in your browser or a firewall blocking web traffic specifically.

Wireshark: The Network Microscope

Wireshark is the most powerful tool in a network troubleshooter's arsenal. It is a packet analyzer that captures the raw data traveling over a network interface, allowing you to inspect every single packet headers and data in detail.

Real-World Analogy: If ping is a door knock and traceroute is a delivery map, Wireshark is a high-speed camera recording every vehicle on a highway, letting you examine each one's license plate, contents, and destination. It's also like a network flight recorder or microscope.

What Does Wireshark Show You?

Wireshark displays captured packets in a list. Each packet can be expanded to show its protocol layers, just like the TCP/IP or OSI model.

Scenario 2: The Mysterious Application Failure

A custom business application cannot connect to its server. ping to the server IP works fine, so the network path is clear.

• Diagnosis: The problem is likely above the network layer perhaps in the TCP connection handshake, the specific port being blocked, or in the application's own data.
• Tool to Use: Wireshark. You would start a capture, attempt the connection in the application, then stop the capture.
• What to Look For: You would filter for the server's IP and look for TCP packets with "SYN" flags (connection attempt). If you see your computer send "SYN" but get no "SYN-ACK" reply from the server, the specific port is blocked by a firewall. Wireshark lets you see this exact conversation.

Congratuations! You have completed this room. You've learned essential network troubleshooting tools:

• ping : tests reachability and latency
• ipconfig/ifconfig : shows network configuration
• traceroute : maps network path
• netstat : displays active connections
• nslookup/dig : troubleshoots DNS
• Wireshark : analyzes packet-level traffic

Always follow a methodical approach: identify, gather, test, analyze, fix.