CompTIA Network+: Solving Networking Issues

Study Notes for the N10-009 Certification Exam

1. Introduction to Network Troubleshooting

Network troubleshooting involves identifying, diagnosing and resolving problems affecting network connectivity, configuration, security and performance.

Network administrators use software tools, command-line utilities, hardware testing equipment and commands built into routers and switches to investigate faults.

This course covers:

• Protocol analyser tools
• Windows command-line utilities
• Common Linux commands
• Physical network testing tools
• MAC address tables
• Routing tables
• Interface information
• Startup and running configurations
• Address Resolution Protocol (ARP)
• Virtual LANs (VLANs)
• Power over Ethernet (PoE)

The key skill is knowing which tool or command to use, what information it provides and how that information helps isolate a problem.

2. Using Protocol Analyser Tools

What is a protocol analyser?

A protocol analyser captures and examines network packets or frames travelling over wired or wireless connections.

It helps administrators understand how devices communicate and identify problems such as failed requests, unexpected traffic and communication errors.

Common protocol analyser tools

Wireshark

Wireshark is a widely used network protocol analyser. It captures and displays network packets, allowing administrators to inspect communication between devices.

Microsoft Network Monitor

Microsoft Network Monitor is another packet-capture and analysis tool referenced in the course.

Packet capture

A packet capture records network traffic for examination. Captured information may include:

• Source and destination addresses
• Protocol information
• Packet and frame details
• Communication requests and responses
• Payload data, depending on the protocol and encryption

Encrypted protocols protect their payloads, so captured traffic does not necessarily reveal the underlying application data in readable form. Some metadata may still be visible.

Port mirroring

A switch normally forwards traffic according to its switching rules. A monitoring computer connected to an ordinary switch port may not see traffic between other devices.

Port mirroring configures a switch to copy selected traffic to a monitoring port, allowing a protocol analyser to inspect it.

Using filters

Packet captures can contain large amounts of information. Filters help isolate the traffic relevant to the investigation.

For example, a DNS filter can help an administrator examine DNS queries and responses when investigating name-resolution problems.

When should you use a protocol analyser?

Use a protocol analyser when you need to:

• Investigate unexpected network communication.
• Examine DNS requests and responses.
• Inspect retransmissions or communication failures.
• Determine whether packets reach the expected destination.
• Analyse protocol behaviour in greater detail than basic connectivity tools allow.

Exam tip: Wireshark is appropriate when you need detailed packet-level evidence rather than just a basic connectivity result.

3. Using the Windows Command Line

Windows includes several commands that help diagnose IP addressing, connectivity, routing, name resolution and active network connections.

3.1 ipconfig

The ipconfig command displays network adapter configuration information.

Typical information includes:

• IP address
• Subnet mask
• Default gateway

Example:

ipconfig

For more detailed configuration information, use:

ipconfig /all

This is useful when checking whether a computer has received the expected network configuration.

3.2 ipconfig /release and ipconfig /renew

These commands help refresh a DHCP-assigned IPv4 address.

Release the current DHCP lease:

ipconfig /release

Request a new DHCP configuration:

ipconfig /renew

Use these commands when investigating a suspected DHCP addressing problem. Releasing an address temporarily removes the relevant IPv4 configuration, so do this with care on a computer that depends on its current connection.

3.3 ipconfig /flushdns

This command clears the local Windows DNS resolver cache.

ipconfig /flushdns

It can help when a computer appears to be using outdated cached DNS information.

It does not repair an unavailable DNS server or incorrect DNS records at their source.

3.4 ping

Ping tests whether a destination responds to ICMP Echo Requests and reports round-trip timing when replies are received.

Example:

ping 192.168.1.1

A useful troubleshooting sequence is to test:

1. The local TCP/IP stack, such as the loopback address 127.0.0.1.
2. The computer's own configured IP address.
3. The default gateway.
4. A remote IP address.
5. A hostname, to include name resolution in the test.

The results help narrow down where a connectivity problem may exist. However, some devices block ICMP, so a failed ping does not always prove that a device or service is unavailable.

3.5 tracert

The Windows tracert command traces the route towards a destination.

tracert example.com

It displays the network hops encountered along the route and can help investigate routing problems or delays.

A hop that does not respond may be filtering or deprioritising traceroute probes rather than failing to forward normal traffic.

3.6 arp -a

This command displays the local ARP cache, which contains learned mappings between IPv4 addresses and MAC addresses.

arp -a

It is useful when investigating local-network address resolution.

3.7 netstat -ano

This command displays network connections and listening endpoints, together with numeric addresses and process identifiers.

netstat -ano

The options mean:

• -a: Displays active connections and listening ports.
• -n: Displays addresses and port numbers numerically.
• -o: Includes the owning process ID (PID).

The PID can help you identify which process is associated with a connection by checking it against Windows process information.

Windows command revision table

Exam tip: Be prepared to match each command to the problem it investigates.

4. Common Linux Commands

Linux systems provide similar troubleshooting capabilities, although the commands and their options may differ from Windows.

4.1 ifconfig

The course identifies ifconfig as a Linux command used to display and configure network adapter settings.

ifconfig

It can show information such as interface addresses and status.

Unlike Windows ipconfig, which is primarily used to display IP configuration, Linux ifconfig has historically supported both display and configuration operations.

Note that modern Linux distributions commonly use the ip command, and ifconfig may not be installed by default.

4.2 tcpdump

tcpdump captures network packets for analysis.

Example:

sudo tcpdump -i eth0

The -i option specifies the network interface to capture on. The interface name will vary by system.

To save captured traffic in a PCAP file:

sudo tcpdump -i eth0 -w capture.pcap

PCAP files can be opened in Wireshark for more detailed analysis.

Use packet captures responsibly because they may contain sensitive information.

4.3 iptables

iptables manages firewall rules on Linux systems using the relevant packet-filtering framework.

It can be used to allow or block traffic according to configured rules.

Example:

sudo iptables -L

This lists firewall rules.

Important: Rule order and the chain in which a rule appears can affect how traffic is handled. Incorrect firewall changes can disrupt legitimate network communication.

4.4 nmap

nmap is a network discovery and port-scanning tool.

Example:

nmap 192.168.1.10

It can help identify reachable hosts and exposed ports and services, depending on the scan and target configuration.

Administrators may use it to investigate unexpected services or monitor authorised network assets.

Only scan systems and networks you are authorised to assess.

4.5 dig

dig queries DNS servers and displays DNS responses.

Example:

dig example.com

It can help investigate hostname resolution and inspect DNS record information.

The course compares dig with Windows nslookup, as both can be used to query DNS.

Linux command revision table

5. Common Network Hardware Tools

Software commands cannot diagnose every network fault. Physical testing tools help investigate cables, wiring, electrical continuity and signal quality.

5.1 Cable tester

A cable tester checks the wiring and continuity of network cables.

It can identify problems such as:

• Open connections
• Incorrect pin wiring
• Reversed or miswired pairs
• Continuity failures

Use a cable tester when a suspected Ethernet cable fault causes an unreliable or failed connection.

5.2 Multimeter

A multimeter measures electrical values such as voltage and resistance.

It can help check power supplies and electrical continuity, depending on the measurement being performed.

Examples include:

• Measuring AC or DC voltage.
• Checking resistance.
• Testing continuity on suitable circuits.

Use the correct measurement mode and follow electrical safety procedures.

5.3 Toner and probe

A toner and probe kit helps identify and trace cables.

The toner sends a signal through a cable, and the probe detects that signal so the cable can be located among other cables.

This is especially useful when tracing cables through racks, patch panels or cable bundles.

5.4 Reflectometer

A reflectometer examines cable characteristics by analysing signals travelling through the medium and their reflections.

Depending on the type of reflectometer, it can help locate cable faults or assess signal behaviour.

Examples include:

• Time-domain reflectometer (TDR): Helps locate faults and discontinuities in metallic cables.
• Optical time-domain reflectometer (OTDR): Used with fibre-optic links to investigate signal loss and locate events along the fibre.

Hardware tool comparison

Exam tip: If the problem is physical rather than logical, choose a tool designed to test the physical medium.

6. Using the MAC Address Table

What is a MAC address table?

A switch maintains a MAC address table, sometimes called a forwarding database, to record learned MAC addresses and the ports associated with them.

When a device sends a frame, the switch can learn the source MAC address and associate it with the incoming port and VLAN.

The table helps the switch forward Ethernet frames towards the correct destination port.

The show mac-address-table command

On supported Cisco-style network devices, the command is used to display learned MAC address entries.

show mac address-table

The precise syntax varies by platform and software version; the course refers to show mac-address-table.

The table can help you investigate:

• Which switch port has learned a device's MAC address.
• Whether a device is appearing on an expected port.
• Whether MAC entries have been learned in the relevant VLAN.
• Whether entries are disappearing or moving unexpectedly.

MAC address ageing

Learned dynamic MAC entries can age out when the switch has not received frames from the relevant source for the configured ageing period.

An entry disappearing does not necessarily mean the device has failed; it may simply have been inactive.

MAC addresses and routers

MAC addresses are used for communication on a local Layer 2 network segment.

When a router forwards an IP packet to another network, it removes the incoming Layer 2 framing and creates new Layer 2 framing for the outgoing link.

Therefore, the destination MAC address on the next link is normally the next-hop device's MAC address, not the original remote host's MAC address.

Key distinction: IP addresses identify endpoints at the network layer; MAC addresses are used for local-link delivery.

7. Displaying the Routing Table

What is a routing table?

A routing table contains information that a router uses to decide where to forward IP packets.

Routes may be learned from:

• Directly connected networks
• Static route configuration
• Dynamic routing protocols

The show ip route command

On Cisco-style routers, use:

show ip route

This displays the IPv4 routing table.

Directly connected networks normally appear when the relevant interfaces are configured and operational.

For a destination network that is not directly connected, the router needs a suitable route, such as a static route or one learned through a routing protocol.

Static routing

A static route is manually configured by an administrator.

It can be suitable for simple or predictable network paths, but the administrator must maintain the routes when the topology changes.

Dynamic routing and RIP

The course demonstrates the Routing Information Protocol (RIP) as an example of a dynamic routing protocol.

Routers running a compatible and correctly configured routing protocol can exchange routing information and learn networks beyond their directly connected interfaces.

For RIP to work, the participating routers need suitable interface addressing, protocol configuration and network statements. Merely enabling RIP without correct configuration does not guarantee connectivity.

Troubleshooting routing problems

1. Display the routing table.
2. Confirm that the destination network has a suitable route.
3. Check the relevant interfaces and their status.
4. Verify static route or dynamic routing configuration.
5. Test connectivity to the next hop and destination.

Exam tip: If two devices on different IP networks cannot communicate, check routing information as well as interface status and addressing.

8. Displaying Interface Information

The show interfaces command

The command displays information about router or switch interfaces.

show interfaces

It helps administrators inspect interface status, traffic levels and errors.

Important interface information

• Physical status: Whether the interface's physical connection is operational.
• Line protocol status: Whether the interface's data-link protocol is operational.
• Input and output packet counts: Show traffic handled by the interface.
• Errors: May indicate physical faults, transmission problems or other interface issues.
• Collisions: Can provide evidence of problems on relevant Ethernet links, especially legacy or incorrectly configured shared/half-duplex environments.
• Interface resets: May indicate instability or repeated resets.
• MTU: The maximum transmission unit used by the interface.
• Bandwidth: A configured or reported interface bandwidth value, depending on platform; it is not necessarily a live measurement of available throughput.
• Load and reliability: Platform-reported indicators that help assess interface conditions.

Physical and protocol status

Interface status often reports two conditions: the physical interface state and the line protocol state.

A physical connection may be present while the line protocol is down. This suggests that the administrator should investigate the data-link layer, configuration or the condition of the link beyond basic physical connectivity.

Using traffic to test an interface

Generating test traffic, such as ping, can help determine whether input and output packet counters change.

Compare counters before and after testing, and examine whether errors increase.

Exam tip: show interfaces is valuable for checking link status, errors, traffic counters and other interface health indicators.

9. Displaying Startup Configuration Information

Routers and switches commonly maintain an active configuration and a saved configuration.

Running configuration

The running configuration represents the configuration currently active on the device. On Cisco-style devices, it is held in RAM.

Display it with:

show running-config

A shorter form is:

show run

Startup configuration

The startup configuration is the saved configuration used when the device boots.

Display it with:

show startup-config

A shorter form is:

show start

Saving configuration changes

Changes made to the running configuration may be lost after a reboot if they have not been saved.

On Cisco-style devices, save the running configuration to the startup configuration using:

copy running-config startup-config

The abbreviated form is:

copy run start

Why this matters

Imagine an administrator fixes a VLAN configuration and confirms that devices can communicate. If the change is not saved, the device may return to its previous configuration after a reboot.

Configuration comparison

Exam tip: If a configuration change works but disappears after a reboot, check whether it was saved to the startup configuration.

10. Using Common ARP Commands

What is ARP?

The Address Resolution Protocol (ARP) maps an IPv4 address to a MAC address on a local network.

When a host needs to send an IPv4 packet to another device on its local subnet, it may need to discover the destination device's MAC address.

If the destination is on another network, the host generally resolves the MAC address of its default gateway instead.

ARP tables

An ARP table stores learned IP-to-MAC address mappings.

These entries are populated as devices communicate and can expire according to the system's cache rules.

Windows command

arp -a

This displays the local computer's ARP cache.

Cisco-style router command

show arp

This displays ARP entries on supported router platforms.

Troubleshooting ARP

ARP information can help when investigating:

• Local IPv4 communication problems.
• Unexpected IP-to-MAC mappings.
• Whether an entry has been learned.
• Possible address-resolution problems.

An absent entry may simply mean that the device has not communicated recently or that the entry has expired.

ARP versus MAC address tables

Exam tip: ARP answers “Which MAC address corresponds to this local IPv4 address?” A switch MAC address table answers “On which port and VLAN was this MAC address learned?”

11. Displaying VLAN Configurations

What is a VLAN?

A Virtual LAN (VLAN) logically separates devices into different Layer 2 broadcast domains, even when they use the same physical switch infrastructure.

VLANs are commonly used to separate departments, voice traffic, guest access or other groups of devices.

Devices in different VLANs generally need Layer 3 routing to communicate with one another.

The show vlan command

On supported Cisco-style switches:

show vlan brief

This displays VLAN information, often including VLAN IDs, names, status and associated access ports.

The course refers to the show vlan command; the exact command and output depend on the device.

Default VLAN configuration

In the course's example, a default switch has its ports assigned to VLAN 1. This means that, unless configuration changes have been made, those ports may share the same VLAN.

VLANs and IP subnets

VLANs and IP subnets are different concepts, but networks commonly assign a distinct IP subnet to each VLAN.

Correct VLAN assignment and IP addressing are important for local communication and routing.

Trunk links

A trunk link carries traffic for multiple VLANs over a single physical connection, using VLAN tagging where supported.

This allows a switch to connect to another switch or a router while transporting traffic for multiple VLANs.

Router subinterfaces

In a router-on-a-stick configuration, a router uses logical subinterfaces on a physical interface to handle traffic for different VLANs.

Each subinterface is configured for the relevant VLAN and IP network. The router can then route traffic between VLANs, subject to routing and access-control configuration.

VLAN troubleshooting checklist

1. Check which VLAN the relevant switch port belongs to.
2. Verify that the expected VLAN exists and is active.
3. Check whether the connected device has suitable IP addressing.
4. Inspect trunk configuration when multiple VLANs must cross a link.
5. Verify router subinterfaces or other Layer 3 routing configuration.
6. Review access control lists if routing exists but traffic is blocked.

Exam tip: If devices in different VLANs cannot communicate, verify both VLAN configuration and inter-VLAN routing.

12. Displaying Power Information for Interfaces

What is Power over Ethernet?

Power over Ethernet (PoE) allows supported network equipment to provide electrical power to compatible devices over Ethernet cabling.

Common PoE-powered devices include:

• IP phones
• Wireless access points
• Some security cameras

PoE can reduce the need for separate power supplies at the connected device.

The show power inline command

On supported Cisco-style switches, use:

show power inline

This displays information about PoE capability and consumption.

Depending on the platform, the output may include:

• Total available PoE power
• Power allocated to connected devices
• Per-port power usage
• Remaining power budget
• Port-level power limits or status

Why PoE information matters

A switch may have working data connectivity but fail to power a connected device if its PoE capability, port settings or available power budget is insufficient.

For example, if an IP phone does not power on, the administrator can inspect the port's PoE status and available power before replacing the device.

Troubleshooting PoE issues

1. Confirm that the switch and port support PoE.
2. Check the connected device's power requirements.
3. Inspect the port's power status.
4. Review the switch's total PoE budget and remaining capacity.
5. Check cabling and port condition.
6. Confirm whether the device receives power after any corrective action.

Exam tip: Use show power inline to investigate power delivery from a compatible switch to PoE-powered devices.

13. Practical Troubleshooting Scenarios

Scenario 1: A computer cannot connect to the network

Symptoms: A user reports that their computer has no network connectivity.

Suggested approach:

1. Run ipconfig to inspect the IP address, subnet mask and default gateway.
2. If DHCP addressing appears incorrect, investigate DHCP and consider renewing the lease.
3. Ping the loopback address and then the computer's own address.
4. Ping the default gateway.
5. Use tracert to investigate the route towards a remote destination if appropriate.
6. Review ARP information if local address resolution is suspected.

The results help narrow down whether the problem involves local configuration, the gateway, address resolution or the route beyond the local network.

Scenario 2: A hostname does not resolve

Symptoms: A user can reach some destinations by IP address but cannot access a service using its hostname.

Suggested approach:

1. Test IP connectivity with ping, where ICMP is permitted.
2. Use dig or nslookup to query DNS.
3. Inspect the response and determine whether the expected record is returned.
4. On Windows, consider ipconfig /flushdns if stale local cache data is suspected.
5. If necessary, use Wireshark to inspect DNS requests and responses.

Flushing the local cache will not fix an incorrect DNS record or an unavailable DNS server.

Scenario 3: A device cannot communicate with devices in another VLAN

Symptoms: Devices communicate within their own VLAN but cannot reach a different VLAN.

Suggested approach:

1. Use show vlan to inspect port assignments.
2. Confirm the relevant VLANs exist and are active.
3. Check the trunk link if traffic must cross between switches or reach a router.
4. Verify router subinterfaces or other Layer 3 interfaces.
5. Inspect the routing configuration and any applicable access control lists.

The problem may be caused by VLAN membership, trunk configuration, missing routing or traffic filtering.

Scenario 4: An IP phone does not power on

Symptoms: An IP phone connected to a switch does not start.

Suggested approach:

1. Check the Ethernet cable and switch port.
2. Confirm that the port and switch support PoE.
3. Run show power inline.
4. Inspect the available power budget and per-port power information.
5. Verify that the phone is compatible and that its power requirements can be met.

This avoids assuming that a failed phone is necessarily faulty when the problem may be power delivery.

Scenario 5: A router loses configuration after restarting

Symptoms: A network change works initially but disappears after a reboot.

Suggested approach:

1. Run show running-config to inspect the active configuration.
2. Run show startup-config to inspect the saved configuration.
3. Compare the relevant settings.
4. If the intended configuration is active and validated, save it using copy running-config startup-config.

This ensures the intended configuration is saved for the next startup.

14. Essential Command Revision Sheet

Note: Commands and syntax can vary by operating system, device vendor and software version. Use the syntax supported by the equipment being examined.

15. Final Exam Revision Checklist

Before taking the CompTIA Network+ N10-009 exam, ensure you can:

• [ ] Explain why and when to use Wireshark and packet capture.
• [ ] Explain port mirroring and the role of packet filters.
• [ ] Match Windows commands to IP, DNS, connectivity and connection problems.
• [ ] Explain the purposes of tcpdump, iptables, nmap and dig.
• [ ] Distinguish cable testers, multimeters, toner probes and reflectometers.
• [ ] Explain what a switch MAC address table records.
• [ ] Interpret the purpose of a routing table.
• [ ] Identify useful interface counters and status information.
• [ ] Distinguish running configuration from startup configuration.
• [ ] Explain how ARP maps IPv4 addresses to MAC addresses.
• [ ] Explain VLANs, trunk links and inter-VLAN routing.
• [ ] Explain how to investigate PoE power problems.
• [ ] Select suitable commands for realistic troubleshooting scenarios.

Conclusion

Effective network troubleshooting requires more than memorising commands. It requires selecting the right tool, understanding the information returned and using the evidence to narrow down the fault.

For the Network+ N10-009 exam, focus on three things: the purpose of each command, the information it reveals and the networking problem it helps investigate. Practise applying these tools to real scenarios so that you can choose the appropriate troubleshooting method confidently.