Domain 5 — Network Troubleshooting

Lesson 5 · Domain 5 — Network Troubleshooting · Download .docx

Objectives

Apply the CompTIA 7-step troubleshooting methodology to network problems.
Select and use the correct diagnostic tool for each OSI layer (cable tester, ping, traceroute, nslookup, netstat, arp, ipconfig).
Diagnose common connectivity issues including APIPA, duplicate IPs, DNS failure, and VLAN misconfiguration.
Explain the systematic ping sequence for isolating network layer faults.

Key terms

CompTIA troubleshooting model: 7 steps: Identify, Establish theory, Test theory, Action plan, Implement, Verify, Document.
ping: ICMP echo request/reply — tests Layer 3 reachability to a target IP address.
traceroute: Sends TTL-expiring probes to map each router hop to a destination — identifies where packets are dropped.
nslookup: Queries DNS servers to verify hostname resolution; identifies DNS failures.
netstat: Displays active TCP/UDP connections, listening ports, and per-interface statistics.
arp: Displays or manipulates the ARP cache mapping IP addresses to MAC addresses.
ipconfig: Windows command showing IP address, subnet mask, gateway; /release and /renew reset the DHCP lease.
cable tester: Layer 1 tool verifying cable continuity, pinout, opens, and shorts.
APIPA: 169.254.x.x address indicating DHCP failure — first step: verify DHCP server reachability.
duplicate IP: Two hosts claiming the same IP — causes oscillating ARP cache entries and intermittent connectivity for both.
VLAN misconfiguration: Hosts on same physical switch but different VLANs cannot communicate — appears as Layer 2 isolation.
DNS failure: Hostnames do not resolve but IP pings succeed — confirms DNS is the missing link, not IP connectivity.

The concept

THE CompTIA 7-STEP TROUBLESHOOTING METHODOLOGY

CompTIA Network+ requires mastery of a structured 7-step approach: (1) Identify the problem — gather symptoms, interview affected users, determine the scope (one user or everyone?), check recent changes. (2) Establish a theory of probable cause — list the most likely causes ranked by probability; start with the simplest. (3) Test the theory — run a diagnostic command or swap a cable to confirm or rule out your theory. If the theory is disproved, form a new one. (4) Establish an action plan — determine the steps needed to fix the root cause and consider side effects. (5) Implement the solution — apply the fix. (6) Verify full system functionality — confirm the reported issue is resolved and no new problems were introduced. (7) Document findings, actions, and outcomes — this builds the knowledge base for future incidents and reduces MTTR.

SYSTEMATIC DIAGNOSTIC SEQUENCE

For connectivity problems, work from Layer 1 to Layer 7. The standard ping sequence isolates the fault layer: (1) ping 127.0.0.1 — confirms the local IP stack is functional; (2) ping your own IP — confirms the NIC is bound correctly; (3) ping the default gateway — confirms Layer 1/2/3 to the local router; (4) ping a remote IP address — confirms routing; (5) ping a remote hostname — adds DNS to the test. If step 4 works but step 5 fails, DNS is the culprit. If step 3 fails, the problem is local (cable, NIC, VLAN). If steps 1–2 succeed but step 3 fails, the issue is between the PC and the gateway.

DIAGNOSTIC TOOLS BY OSI LAYER

Layer 1 — cable tester: verifies continuity, pinout, opens, and shorts on copper cable. No software tool can detect a broken wire. Layer 2 — arp -a: shows the IP-to-MAC mapping cache; oscillating entries indicate ARP poisoning or a duplicate IP. Layer 3 — ping: tests ICMP reachability. traceroute/tracert: maps the hop-by-hop path. ipconfig/ifconfig: shows assigned IP, mask, and gateway; /release and /renew reset a DHCP lease. Layer 4 — netstat: lists active TCP/UDP connections and listening ports. Layer 7 — nslookup: tests DNS resolution. Knowing which tool belongs at which layer determines exam answers and real-world efficiency.

COMMON FAILURE PATTERNS

APIPAaddress (169.254.x.x): always means DHCP failed — check the switch port, DHCP server status, and scope exhaustion before suspecting the NIC. Can ping IP but not browse: DNS is failing — nslookup will confirm. Hosts on same switch cannot reach each other: check VLAN assignments — they may be on different VLANs. Duplicate IP: both affected hosts experience intermittent connectivity — arp -a shows the gateway MAC changing; use ipconfig to check static IP assignments. Document every step: the final step in the methodology is not optional — it prevents the same incident from costing double the time next occurrence.

Standards alignment: CompTIA Network+ Objective 5.1 (Troubleshooting Methodology); Maryland Blueprint College and Career Readiness — Technology and Engineering.

Worked examples

Example 1: A user reports 'I can't reach the internet.' Step 1 — Identify: only this user is affected. Step 2 — Theory: cable, NIC, DHCP, DNS, or gateway. Step 3 — Test: ping 127.0.0.1 (pass), ping own IP (pass), ping gateway 10.0.0.1 (fail). Theory revised: problem is between PC and gateway — cable or switch port. Step 4 — Action plan: replace patch cable and check switch port LED. Step 5 — Implement: replace cable. Step 6 — Verify: ping gateway succeeds, browse succeeds. Step 7 — Document: 'Defective patch cable from user workstation to patch panel port 14 replaced. Gateway reachable after cable swap.'

Example 2: Two hosts on the same switch cannot ping each other. Both have valid 192.168.10.x addresses. Ping to the gateway succeeds for both. The technician runs arp -a on each and compares MAC addresses for the peer's IP — both show the correct MAC. She checks the switch: Host A is on VLAN 10, Host B is on VLAN 20. Despite both being in the 192.168.10.0/24 range, the switch isolates them by VLAN. She moves Host B to VLAN 10 (or adds inter-VLAN routing) and connectivity is restored. Root cause: VLAN misconfiguration, not an IP addressing issue.

Common mistakes

Skipping documentation as 'optional' — it is Step 7 and tested on the exam; future incidents without it cost double the resolution time.
Jumping to reinstall drivers or OS when ping 127.0.0.1 fails — this is extremely rare; check cables and NIC settings first.
Using nslookup when APIPA is present — you cannot run DNS queries without a valid IP address; fix DHCP first.
Assuming both hosts with duplicate IPs lose connectivity completely — traffic actually alternates between them based on whose ARP reply arrived most recently, causing intermittent failures for both.
Confusing traceroute (maps path, uses TTL-expiring ICMP/UDP) with ping (simple reachability test) — traceroute identifies WHERE in the path packets are dropped; ping only confirms IF they arrive.

Self-check

Try each one before you look. A miss here costs nothing and tells you exactly what to reread.

1. What is the first step in CompTIA's network troubleshooting methodology?

2. A user can successfully ping 8.8.8.8 but cannot browse any website. The most likely cause is:

3. Which tool tests Layer 1 cable continuity, pinout, and shorts?

4. What does 'ipconfig /release' followed by 'ipconfig /renew' accomplish?

5. Hosts on the same switch cannot communicate with each other, but both can reach the default gateway. The most likely cause is:

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top