ITS124 Section 13

Troubleshooting methodology

An organized approach to identifying a problem's root cause and implementing an appropriate solution to resolve the problem.

Seven steps of troubleshooting methodology

Identify the problem.

Establish a theory of probable cause.

Test the theory to determine the cause.

Establish a plan of action to resolve the problem and identify potential effects.

Implement the solution or escalate as necessary.

Verify full system functionality and, if applicable, implement preventive measures.

Document findings, actions, outcomes, and lessons learned.

Layer 1 problem

A networking problem involving a physical layer item (e.g., hardware or network media).

Layer 2 problem

A networking problem involving a data link layer item (e.g., a switch or a MAC address).

Layer 3 problem

A networking problem involving a network layer item (e.g., a router or an IP address).

Layer 4 problem

A networking problem involving a transport layer item (e.g., TCP or a firewall).

Least obtrusive solution

A solution with minimal impact to a user or other entity.

Escalation

A process where a troubleshooting problem is elevated to a higher tier employee or department.

Level 0 support

Involves self-support resources (e.g., a knowledge base article or wiki page).

Level 1 support

Involves basic troubleshooting for end-user problems (e.g., account lockouts).

Level 2 support

Involves in-depth troubleshooting of a networking device (e.g., a switch or router).

Level 3 support

Involves subject matter experts and troubleshooting a large-scale problem (e.g., disaster recovery).

Level 4 support

Involves support from a vendor or service provider.

Preventive measure

A resource used to mitigate the likelihood of a recurring problem.

Physical preventive measure

A preventive measure using a physical option (e.g., a door lock).

Logical preventive measure

A preventive measure using a technical option (e.g., an intrusion prevention system).

Administrative preventive measure

A preventive measure using a procedural option (e.g., an acceptable use policy).

Employee training

Any sort of end-user training intended to improve an employee's interaction with a technology resource.

Trouble ticket

A generic term for the documentation method used for troubleshooting.

Trouble-ticket system

An application used to create, track, and store trouble tickets.

Layer 1 problem

A problem involving a physical layer item, such as hardware or network media.

Layer 1 problem symptoms

Identifiable issues including low or no throughput, fluctuating transmission speed, reduced transmission distance, high attenuation/interference/loss, or irregular NIC LED status indicators.

Bounded media problem

A layer 1 problem where bounded media (cables) is the root cause. Troubleshooting begins with physical inspection for loose connections, damage, and port functionality.

Open

A twisted pair (TP) media problem caused by a broken wire.

Short

A TP media problem caused when two wires contact each other.

TP cable ratings

Must match the deployment location, including plenum-rated for plenums and riser-rated for risers. Unshielded Twisted Pair (UTP) should never be used where Shielded Twisted Pair (STP) is required.

TP cable applications

Choosing the correct cable type for the connection, including straight through, crossover cable, or rollover/console cable. Incorrect application usually results in no transmission.

Duplex setting

Must be configured correctly at each end of a bounded media connection to avoid problems.

Unbounded media problem

A layer 1 problem where unbounded media (wireless) is the root cause. Troubleshooting begins by examining the client's location for range, obstructions, and disassociation issues.

RF attenuation

A reduction in wireless signal strength caused by factors like free space path loss (FSPL), absorption, noise, and interference.

Antenna polarization

An antenna's orientation in relation to the earth's surface. A wireless client's antenna must match the polarization of a WAP's antenna to communicate effectively.

Asymmetric power

The power level difference between a wireless client's antenna and a WAP's antenna. This can result in the WAP's signal reaching the client, but the client's weaker signal failing to reach the WAP.

Networking problem (Layers 2, 3, or 4)

A problem involving data link, network, or transport layer items (e.g., a switch, router, or firewall).

Service problem (Layers 5, 6, or 7)

A problem involving session, presentation, or application layer items (e.g., client/server sessions, encryption protocols, or DNS).

Higher-layer problem symptoms

Identifying symptoms such as low or no throughput, fluctuating transmission speed, irregular NIC LED status indicators, and service or application error messages.

Duplicate MAC address

A Layer 2 problem where two devices attempt to use the same MAC address.

Incorrect VLAN

A Layer 2 problem where a node cannot access a desired network resource because it is assigned to an incorrect VLAN.

Collision

A Layer 2 problem where at least two frame transmissions collide and require retransmission, potentially causing network congestion.

Network loop (Layer 2 loop / bridge loop)

A Layer 2 network topology in which more than one path exists between two network endpoints, which exhausts network bandwidth.

IP configuration problem (IP setting issue)

A Layer 3 problem where a node is configured with an incorrect IP address, subnet mask, default gateway, or DNS server.

Duplicate IP address

A Layer 3 problem where two devices attempt to use the same IP address.

Missing route

A Layer 3 problem where a needed routing table entry is not present on either a node or a router.

Asymmetrical routing

A Layer 3 problem where a transmission leaves a network using one route and returns to the network using a different route.

Multicast flooding

A Layer 3 problem that impacts Layer 2 by flooding a VLAN with multicast packets.

Broadcast storm (network storm)

A Layer 3 problem defined by the occurrence of a large number of broadcast and multicast packets on a network within a short time period.

Routing loop

A Layer 3 problem where a misconfigured routing protocol causes an endless loop of transmissions that consume bandwidth.

Layer 4 problems

Issues that usually deny a node's access to a network or external resource, often caused by host-based or network-based firewalls, IDS, IPS, or proxy servers blocking services or addresses.

Certificate problem

An upper-level layer problem involving a missing or expired digital certificate for a server, application, or website (sometimes caused by an incorrect NTP configuration).

Rogue DHCP server

An upper-level layer problem where an unauthorized DHCP server provides unauthorized DHCP services to a network.

DHCP scope exhaustion

An upper-level layer problem where a DHCP service does not have any IP configurations available for a DHCP client.

DNS problem

An upper-level layer problem where a DNS server or a DNS service does not provide name resolution services.

Licensed feature problem

An upper-level layer problem caused when an application's additional feature is not correctly installed or hasn't been purchased.

Tone generator

A network media troubleshooting tool used for twisted pair (TP) cables.

Loopback adapter

A network media troubleshooting tool used for TP cables.

Copper cable tester

A network media troubleshooting tool used to test or verify TP cable functionality.

OTDR (Optical Time-Domain Reflectometer)

A fiber network media troubleshooting tool.

OSA (Optical Spectrum Analyzer)

A fiber network media troubleshooting tool used to capture optical signal measurements.

Fiber cable tester

A troubleshooting tool used to identify damaged fiber cables.

Fiber light meter

A fiber network media troubleshooting tool.

WiFi analyzer

A wireless troubleshooting tool used to identify noise, interference sources, and other wireless issues.

Wireless spectrum analyzer

A wireless network tool used to measure radio wave characteristics.

Wire map

A multifunctional tool used to determine if a TP cable is constructed correctly (e.g., finding breaks in specific pins).

TAP (Test Access Point)

A multifunctional troubleshooting tool for various network media types.

Multimeter

A multifunctional troubleshooting tool used to verify the electrical properties of network devices, such as switch ports.

Packet capture tool

A software troubleshooting tool used to intercept network traffic for further analysis (e.g., Wireshark).

Protocol analyzer

A software troubleshooting tool used to analyze captured network traffic (e.g., Wireshark).

Bandwidth speed tester

A software troubleshooting tool used to determine the maximum amount of data a connection can transmit in a given amount of time (e.g., iperf).

Port scanner

A software troubleshooting tool used to determine port status, such as whether a node is listening on a specific port (e.g., Nmap).

NetFlow analyzer

A software tool that monitors network traffic primarily for statistical purposes (e.g., ManageEngine NetFlow Analyzer).

IP scanner

A software troubleshooting tool used to scan IP addresses on a network (e.g., Angry IP Scanner).

ping

A command-line tool used to confirm connectivity to a device, such as a default gateway.

tracert / traceroute

Command-line tools (Windows/Linux) used to follow the network path that traffic uses to reach a destination.

ipconfig / ifconfig / ip

Command-line tools used to view IP configuration information and renew DHCP leases (Windows/Linux).

route

A command-line tool used to confirm or set routing table configurations.

netstat

A command-line tool that provides detailed network connection information.

nmap

A command-line tool used to confirm port states or if a firewall is blocking traffic.

hostname

A protocol-specific command that confirms and displays a node's hostname or FQDN.

arp

A protocol-specific command that confirms a node is resolving IP addresses to MAC addresses via ARP.

nslookup / dig

Protocol-specific commands (Windows/Linux) used to confirm DNS functionality.

telnet

A protocol-specific command that establishes an unsecured connection to a remote node.

ssh

A protocol-specific command that establishes a secure, encrypted connection to a remote node.

tcpdump

A protocol-specific Linux command used to execute packet capture on a remote node.

Terminal emulator

Software (like PuTTY) used to establish a session with a target device to access the device's CLI.

show interface

A platform-specific command used to view a single interface configuration.

show route

A platform-specific command used to view a networking device's routing table.

show config

A platform-specific command used to view a networking device's entire configuration.

Preventive measure

An action that accompanies a solution implementation where possible to protect network media from future interference or physical damage.

Bounded media considerations

Troubleshooting solutions that include replacing UTP with STP for interference protection, using cable protectors to prevent physical damage, and deploying plenum-rated or riser-rated TP where required.

Copper to fiber upgrade

Replacing damaged copper-based cable with fiber cable to resolve damage problems and improve throughput.

Optical link budget

A fiber cable's tolerable loss amount that must be considered during upgrades (e.g., Single-Mode Fiber has a higher optical link budget than Multi-Mode Fiber).

Network baseline update

The requirement to update a network's baseline to reflect new changes in media performance and capabilities, such as improved throughput.

Unbounded media considerations

Troubleshooting solutions for WLANs that involve ensuring correct antenna type, placement, and polarization, verifying channel utilization to avoid overlap, minimizing WAP association time, and confirming consistent security configurations.

Site survey

A preventive measure conducted routinely and after any WLAN solution implementation to ensure performance and coverage remain satisfactory.