click below
click below
Normal Size Small Size show me how
N+ 5.Troubleshooting
5 > Network Troubleshooting
| Term | Definition |
|---|---|
| Network Troubleshooting IED EIV | - id the problem - establish a theory - test theory - evaluate results - plan of action - implement plan - verify system functionality - document findings |
| Establish Theory | Examine the problem from the OSI top to bottom |
| Using the Right Cable | - speed/bandwidth - throughput - distance |
| Cable Abbreviations | U-unshielded S-braided shielding F-foil shielding (Overall cable) / (individual pairs)TP - braided shielding with foil around the pairs S/FTP - foil around the cable and no shielding around the pairs F/UTP |
| Plenum-rated cable | - PVC - fire rated cable jacket - |
| Serial Console Cables | D-sub - serial communications standard |
| Rollover cable | RJ45 to serial standard |
| Ethernet Cross-over cables | - connect to ethernet devices without using a switch - |
| PoE | Power of Ethernet - power provided on an Ethernet cable - power provided at the switch |
| Attenuation | - loss of signal intensity as signal moves through a medium |
| dB Decibals | - signal strength ratio measurements |
| dB loss symptoms | - no connectivity - intermittent connectivity - poor performance -- signal too weak -- CRC errors, data corruption |
| Incorrect pin-out | - near and far pins in cables aren't where they are supposed to be - performance or connectivity issues |
| Bad ports | - interface errors |
| Incorrect Transceivers | - trans have to match the fibre -- single mode trans connects to single mode fibre - trans need to match the wavelength -- 850nm etc |
| Duplex/Speed Mismatch | - speed: 10/100/1000/auto - duplex: half/full/auto - incorrect speed -- many switch configs will auto-neg speed - incorrect duplex -- auto-neg -- needs to match on both sides -- mismatch significant slowdowns |
| TDR | Time Domain Reflectometre - troubleshoot opens / shorts |
| Reversing Transmit and Receive | wiring mistake - easy to find with a wire map -- 1-3, 2-6, 6-2 -- some network interfaces auto correct (A uto-MDIX) |
| Cable Crimpers | "pinch" the connector onto a wire -- coaxial, twisted pair, fibre - connect the modular connector to the Ethernet cable |
| Punch-down tools | "punch" a wire into a wiring block - 66 / 110 block |
| Tone Generator | - where does the wire go? -- follow the tone -- puts an analog sound on the wire - Inductive probe -- doesn't need to touch the copper |
| Loopback plugs | - useful for testing physical ports -- or fooling your applications - serial - network connections - NOT cross-over cables |
| TDR / OTDR | Time Domain Reflectometer / Optical - estimate cable lengths - identify splice locations - cable impedance info - signal losses - locate copper or fibre breaks |
| The TDR | - sends an electrical pulse down the cable - impedance discontinuities case a reflection -- TDR calculates time and distance -- OTDR does the sam with light |
| Multimetres | AC - check wall outlet voltage DC - PC power supply output voltages - CMOS battery power Continuity - cable connectivity - fuse status - wire mapping |
| Cable Testers | - continuity test - simple wire map - can identify missing pins or crossed wires |
| Taps and Port Mirrors | - intercept network traffic - physical taps - port mirror -- port redirection, SPAN (Switched Port Analyzer) -- software based tap |
| Fusion Splicer | - join two ends of a fibre together -- minimal light loss, low reflection - extend the length - add a connector to the end - remove a damaged section |
| Light Meter | - sometimes you just need to know how much light is getting through -- one of the most mportant things to know when installing fibre equipment |
| Traceroute | - tracert WIN - traceroute LINUX - determine the route a packet takes to a destination -- takes advantage of ICMP TTL exceeded error message |
| ARP | - determine a MAC address based on an IP address arp -a - view local ARP table |
| netstat | network statistics netstat -a - show all active connection netstat -b - show binaries (WIN) netstat -n - do not resolve names |
| route | - view the devices routing table -- find out which way the packets will go WIN: route print LINUX: netstat -r |
| tcpdump | - capture packets from command line - most LINUX systems - WIN: windump - apply filters, view in real-time - written in standard pcap format |
| basic platform commands | - show interface -- view the interfaces on a device -- view detailed interface info -- show config - view the device config / show run -- show route -- view the routing table / show ip route |
| hostname | - view the FQDN and |
| RSSI | Received Signal Strength Indication - measured in dBm (decibal-milliwatts) - shown as negative number on a log scale -- closer to zero is better |
| EIRP | Effective Isotropic Radiated Power - the radiated signal strength -- transmit strength + antenna gain - cable loss |
| Attenuation | Wireless signals get weaker as you move farther from the antenna - measured with a WiFi analyzer - control the power output on the access point - use a receive antenna with a higher gain -- capture more of the signa |
| Security Type Mismatch | - encryption on wireless is important -- make sure the client matches the access point |
| Device Configuration Review | - don't start blindly troubleshooting - view the configuration -- native desktop or web based console -- ssh/terminal console - try getting the configuration ahead of time |
| Interface Status | - know details of important interfaces - check easy stuff first -- verify physical connectivity |
| VLAN Assignment | - network link is active and IP address is assigned -- no access to resources or limited functionality - every switch interface is configured as an access port or a trunk port -- each access port is assigned to a VLAN |
| Collisions | - half duplex > collisions are normal - interface config issues -- duplex mismatch - hardware issue -- could indicate bac NIC or bad driver |
| Troubleshooting Broadcast Storms | - packet capture -- id the device - research the process that's broadcasting -- there may be another option - separate the network into smaller bc domains -- change one large subnet to many smaller routed subnets |
| Duplicate MAC Addresses | - may be an on-path attack - mistakes can happen - intermittent connectivity -- confirm with packet capture - use ARP command from another computer -- confirm MAC matches IP |
| Duplicate IP addresses | - static assignments must be very organized - DHCP isn't a panacea -- multiple DHCP servers overlap -- rogue DHCP servers |
| IGMP snooping | Internet Group Management Protocol -- hosts and routers use this to direct multicast transmissions - switches can watch for these messages -- switch then intelligently forwards multicasts to those specific devices Enable IGMP snooping |
| Rogue DHCP server | - disable rouge DHCP comms -- enable DHCP snooping on switch -- authorized DHCP servers in Active Directory - disable the rogue -- renew the IP leases |
| Exhausted DHCP scope | - client received an APIPA address -- local subnet comms only - check the DHCP server -- add more addresses if possible |
| IP Configuration Issues | - communicate to local IP addresses -- but not outside subnets - no IP comms -- local or remote - communicate to some IP addresses -- but not others |
| IP Configuration Issues II | - check documentation -- IP address, subnet mask, gateway, DNS - monitor the traffic - traceroute and ping |
| DNS Issues | - is the DNS IP address correct? - use nslookup or dig to test -- does resolution work? - try a different server -- 8.8.8.8 |