click below
click below
Normal Size Small Size show me how
N+ 5.Troubleshooting
5 > Network Troubleshooting
Term | Definition |
---|---|
Network Troubleshooting IED EIV | - id the problem - establish a theory - test theory - evaluate results - plan of action - implement plan - verify system functionality - document findings |
Establish Theory | Examine the problem from the OSI top to bottom |
Using the Right Cable | - speed/bandwidth - throughput - distance |
Cable Abbreviations | U-unshielded S-braided shielding F-foil shielding (Overall cable) / (individual pairs)TP - braided shielding with foil around the pairs S/FTP - foil around the cable and no shielding around the pairs F/UTP |
Plenum-rated cable | - PVC - fire rated cable jacket - |
Serial Console Cables | D-sub - serial communications standard |
Rollover cable | RJ45 to serial standard |
Ethernet Cross-over cables | - connect to ethernet devices without using a switch - |
PoE | Power of Ethernet - power provided on an Ethernet cable - power provided at the switch |
Attenuation | - loss of signal intensity as signal moves through a medium |
dB Decibals | - signal strength ratio measurements |
dB loss symptoms | - no connectivity - intermittent connectivity - poor performance -- signal too weak -- CRC errors, data corruption |
Incorrect pin-out | - near and far pins in cables aren't where they are supposed to be - performance or connectivity issues |
Bad ports | - interface errors |
Incorrect Transceivers | - trans have to match the fibre -- single mode trans connects to single mode fibre - trans need to match the wavelength -- 850nm etc |
Duplex/Speed Mismatch | - speed: 10/100/1000/auto - duplex: half/full/auto - incorrect speed -- many switch configs will auto-neg speed - incorrect duplex -- auto-neg -- needs to match on both sides -- mismatch significant slowdowns |
TDR | Time Domain Reflectometre - troubleshoot opens / shorts |
Reversing Transmit and Receive | wiring mistake - easy to find with a wire map -- 1-3, 2-6, 6-2 -- some network interfaces auto correct (A uto-MDIX) |
Cable Crimpers | "pinch" the connector onto a wire -- coaxial, twisted pair, fibre - connect the modular connector to the Ethernet cable |
Punch-down tools | "punch" a wire into a wiring block - 66 / 110 block |
Tone Generator | - where does the wire go? -- follow the tone -- puts an analog sound on the wire - Inductive probe -- doesn't need to touch the copper |
Loopback plugs | - useful for testing physical ports -- or fooling your applications - serial - network connections - NOT cross-over cables |
TDR / OTDR | Time Domain Reflectometer / Optical - estimate cable lengths - identify splice locations - cable impedance info - signal losses - locate copper or fibre breaks |
The TDR | - sends an electrical pulse down the cable - impedance discontinuities case a reflection -- TDR calculates time and distance -- OTDR does the sam with light |
Multimetres | AC - check wall outlet voltage DC - PC power supply output voltages - CMOS battery power Continuity - cable connectivity - fuse status - wire mapping |
Cable Testers | - continuity test - simple wire map - can identify missing pins or crossed wires |
Taps and Port Mirrors | - intercept network traffic - physical taps - port mirror -- port redirection, SPAN (Switched Port Analyzer) -- software based tap |
Fusion Splicer | - join two ends of a fibre together -- minimal light loss, low reflection - extend the length - add a connector to the end - remove a damaged section |
Light Meter | - sometimes you just need to know how much light is getting through -- one of the most mportant things to know when installing fibre equipment |
Traceroute | - tracert WIN - traceroute LINUX - determine the route a packet takes to a destination -- takes advantage of ICMP TTL exceeded error message |
ARP | - determine a MAC address based on an IP address arp -a - view local ARP table |
netstat | network statistics netstat -a - show all active connection netstat -b - show binaries (WIN) netstat -n - do not resolve names |
route | - view the devices routing table -- find out which way the packets will go WIN: route print LINUX: netstat -r |
tcpdump | - capture packets from command line - most LINUX systems - WIN: windump - apply filters, view in real-time - written in standard pcap format |
basic platform commands | - show interface -- view the interfaces on a device -- view detailed interface info -- show config - view the device config / show run -- show route -- view the routing table / show ip route |
hostname | - view the FQDN and |
RSSI | Received Signal Strength Indication - measured in dBm (decibal-milliwatts) - shown as negative number on a log scale -- closer to zero is better |
EIRP | Effective Isotropic Radiated Power - the radiated signal strength -- transmit strength + antenna gain - cable loss |
Attenuation | Wireless signals get weaker as you move farther from the antenna - measured with a WiFi analyzer - control the power output on the access point - use a receive antenna with a higher gain -- capture more of the signa |
Security Type Mismatch | - encryption on wireless is important -- make sure the client matches the access point |
Device Configuration Review | - don't start blindly troubleshooting - view the configuration -- native desktop or web based console -- ssh/terminal console - try getting the configuration ahead of time |
Interface Status | - know details of important interfaces - check easy stuff first -- verify physical connectivity |
VLAN Assignment | - network link is active and IP address is assigned -- no access to resources or limited functionality - every switch interface is configured as an access port or a trunk port -- each access port is assigned to a VLAN |
Collisions | - half duplex > collisions are normal - interface config issues -- duplex mismatch - hardware issue -- could indicate bac NIC or bad driver |
Troubleshooting Broadcast Storms | - packet capture -- id the device - research the process that's broadcasting -- there may be another option - separate the network into smaller bc domains -- change one large subnet to many smaller routed subnets |
Duplicate MAC Addresses | - may be an on-path attack - mistakes can happen - intermittent connectivity -- confirm with packet capture - use ARP command from another computer -- confirm MAC matches IP |
Duplicate IP addresses | - static assignments must be very organized - DHCP isn't a panacea -- multiple DHCP servers overlap -- rogue DHCP servers |
IGMP snooping | Internet Group Management Protocol -- hosts and routers use this to direct multicast transmissions - switches can watch for these messages -- switch then intelligently forwards multicasts to those specific devices Enable IGMP snooping |
Rogue DHCP server | - disable rouge DHCP comms -- enable DHCP snooping on switch -- authorized DHCP servers in Active Directory - disable the rogue -- renew the IP leases |
Exhausted DHCP scope | - client received an APIPA address -- local subnet comms only - check the DHCP server -- add more addresses if possible |
IP Configuration Issues | - communicate to local IP addresses -- but not outside subnets - no IP comms -- local or remote - communicate to some IP addresses -- but not others |
IP Configuration Issues II | - check documentation -- IP address, subnet mask, gateway, DNS - monitor the traffic - traceroute and ping |
DNS Issues | - is the DNS IP address correct? - use nslookup or dig to test -- does resolution work? - try a different server -- 8.8.8.8 |