Identify and Resolve Network Problems Full
Identify and Resolve Network Problems Full
Learning Outcomes:
Prepared By : Kiflework D.
Bishoftu, BPTC
Mengistu H. Page 1 of 13
June,2016
Mengistu H. Page 2 of 13
Network Monitoring
The purpose of network monitoring is the collecting of useful information from various parts of
the network so that the network can be managed and controlled using the collected
information.
There are generally three basic goals for network monitoring
Performance monitoring
Fault monitoring
Account monitoring
TRACERT / TRACEROUTE
Tracert
Determines the path taken to a destination by sending Internet Control Message Protocol (ICMP)
Echo Request messages to the destination with incrementally increasing Time to Live (TTL) field
values.
The path displayed is the list of near-side router interfaces of the routers in the path between a
source host and a destination. The near-side interface is the interface of the router that is closest to
the sending host in the path.
The path is determined by examining the ICMP Time Exceeded messages returned by intermediate
routers and the Echo Reply message returned by the destination.
Examples:
To trace the path to the host named www.google.co.in type:
tracert www.google.co.in
PING
Verifies IP-level connectivity to another TCP/IP computer by sending Internet Control Message
Protocol (ICMP) Echo Request messages. The receipt of corresponding Echo Reply messages are
displayed, along with round-trip times. Ping is the primary TCP/IP command used to troubleshoot
connectivity, reachability, and name resolution.
You can use ping to test both the computer name and the IP address of the computer. If pinging the
IP address is successful, but pinging the computer name is not, you might have a name resolution
problem. In this case, ensure that the computer name you are specifying can be resolved through
the local Hosts file, by using Domain Name System (DNS) queries, or through NetBIOS name
resolution techniques
NETBIOS
NetBIOS name tables for both the local computer and remote computers, and the NetBIOS name
cache. Nbtstat allows a refresh of the NetBIOS name cache and the names registered with Windows
Internet Name Service (WINS).
Nbtstat command-line parameters are case-sensitive.
Syntax
nbtstat [-a RemoteName] [-A IPAddress] [-c] [-n]
Parameters
Used without parameters, nbtstat displays help.
-a RemoteName Displays the NetBIOS name table of a remote computer, where RemoteName is
the NetBIOS computer name of the remote computer. The NetBIOS name table is the list of NetBIOS
names that corresponds to NetBIOS applications running on that computer.
-A IPAddress Displays the NetBIOS name table of a remote computer, specified by the IP address
(in dotted decimal notation) of the remote computer.
-c Displays the contents of the NetBIOS name cache, the table of NetBIOS names and their
resolved IP addresses.
-n Displays the NetBIOS name table of the local computer. The status of Registered indicates that
the name is registered either by broadcast or with a WINS server.
IPCONFIG
Displays all current TCP/IP network configuration values and refreshes Dynamic Host Configuration
Protocol (DHCP) and Domain Name System (DNS) settings. This command is most useful on
computers that are configured to obtain an IP address automatically. This enables users to
determine which TCP/IP configuration values have been configured by DHCP, Automatic Private IP
Addressing (APIPA), or an alternate configuration.
If the Adapter name contains any spaces, use quotation marks around the adapter name (that
is, "Adapter Name").
For adapter names, ipconfig supports the use of the asterisk (*) wildcard character to specify
either adapters with names that begin with a specified string or adapters with names that
contain a specified string.
For example, Local* matches all adapters that start with the string Local and *Con* matches
all adapters that contain the string Con.
Syntax
ipconfig [/all] [/renew [Adapter]] [/release [Adapter]] [/flushdns] [/displaydns] [/registerdns]
[/showclassid Adapter] [/setclassid Adapter [ClassID]]
Parameters
Used without parameters, ipconfig displays the IP address, subnet mask, and default gateway for all
adapters.
/all Displays the full TCP/IP configuration for all adapters. Without this parameter, ipconfig displays
only the IP address, subnet mask, and default gateway values for each adapter. Adapters can
represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-
up connections.
/renew [Adapter] Renews DHCP configuration for all adapters (if an adapter is not specified) or for a
specific adapter if the Adapter parameter is included. This parameter is available only on computers
with adapters that are configured to obtain an IP address automatically. To specify an adapter name,
type the adapter name that appears when you use ipconfig without parameters.
/release [Adapter] Sends a DHCPRELEASE message to the DHCP server to release the current
DHCP configuration and discard the IP address configuration for either all adapters (if an adapter is
not specified) or for a specific adapter if the Adapter parameter is included. This parameter disables
TCP/IP for adapters configured to obtain an IP address automatically. To specify an adapter name,
type the adapter name that appears when you use ipconfig without parameters.
/flushdns Flushes and resets the contents of the DNS client resolver cache. During DNS
troubleshooting, you can use this procedure to discard negative cache entries from the cache, as
well as any other entries that have been added dynamically.
Summary
To display the basic TCP/IP configuration for all adapters, type:
ipconfig
To display the full TCP/IP configuration for all adapters, type:
ipconfig /all
To renew a DHCP-assigned IP address configuration for only the Local Area Connection adapter,
type:
ipconfig /renew "Local Area Connection"
To flush the DNS resolver cache when troubleshooting DNS name resolution problems, type:
ipconfig /flushdns
To display the DHCP class ID for all adapters with names that start with Local, type:
ipconfig /showclassid Local
To set the DHCP class ID for the Local Area Connection adapter to TEST, type:
ipconfig /setclassid "Local Area Connection" TEST
WINIPCFG
This utility allows users or adminstrators to see the current IP address and other useful information
about your network configuration. You can reset one or more IP addresses. The Release or Renew
buttons allow you to release or renew one IP address.
If you want to release or renew all IP addresses click Release All or Renew All. When one of these
buttons is clicked, a new IP address is obtained from either the DHCP service or from the computer
assigning itself an automatic private IP address. To use the winipcfg utility:
Click Start,and then click Run and type winipcfg
Click More Info.
To see the addresses of the DNS servers the computer is configured to use, click the ellipsis
(...) button to the right of DNS Servers.
To see address information for your network adapter(s), select an adapter from the list in
Ethernet Adapter Information.
NSLOOKUP
Nslookup (Name Server lookup) is a UNIX shell command to query Internet domain name servers
Definitions
Nameserver: These are the servers that the internet uses to find out more about the domain.
Usually they are an ISP's computer.
Mailserver: Where email is sent to.
Webserver: The domains website.
FTPserver: FTP is file transfer protocol, this server is where files may be stored.
Hostname: The name of the host as given by the domain.
Real Hostname: This is hostname that you get by reverse resolving the IP address, may be
different to the given hostname.
IP Address: Unique four numbered identifier that is obtained by resolving the hostname.
TROUBLESHOOTING PROBLEM
Use the information in the next section to help you solve the troubleshooting problem that follows.
BACKGROUND INFORMATION
Choosing a network that does not meet an organization's needs leads directly to trouble. A common
problem arises from choosing a peer-to-peer network when the situation calls for a server-based
network.
A peer-to-peer, or workgroup, network might begin to exhibit problems with changes in the network
site. These are more likely to be logistical or operational problems than hardware or software
problems. The presence of several indicators is a sign that a peer-to-peer network is inadequate.
Possible scenarios include the following:
Lack of centralized security is causing difficulty.
Users are turning off computers that are providing resources to others on the network.
When a network's design is too limited, it cannot perform satisfactorily in some environments.
Problems can vary depending on the type of network topology in effect.
Problems in Bus Topology
A few situations will cause a bus network's termination to fail and thereby take the network down.
Possible scenarios include the following:
A cable on the network breaks, causing each end of the cable on either side of the break to
lose its termination. Signals will bounce, and this will take the network down.
A cable becomes loose or is disconnected, thereby separating the computer from the network.
It will also create an end that is not terminated, which in turn will cause signals to bounce and
the network to go down.
A terminator becomes loose; thereby creating an end that is not terminated. Signals will start
to bounce and the network will go down.
Problems in Hub-Based Topology
While problems with hubs are infrequent, they do occur. Possible scenarios include the following:
A hub drops a connection. When a computer becomes disconnected from the hub, that
computer will be off the network, but the rest of the network will continue to function normally.
An active hub loses power, causing the network to stop functioning.
Problems in Ring Topology
A ring network is usually very reliable, but problems can occur. Possible scenarios include the
following:
One of the cables in the ring breaks, causing the network to stop functioning temporarily. In
token-ring networks, restoring the cable will immediately restore the network.
One of the cables in the ring becomes disconnected, causing the network to temporarily stop
functioning. In token-ring networks, restoring the cable will immediately restore the network.
THE PROBLEM
Use what you have just read to troubleshoot the scenario that follows.
A small company with three departments recently began networking and has installed peer-to-peer
networks in each department. The peer-to-peer networks are not connected to each other. A user in
one department must make a diskette of the information to be loaded on the next network. Four
employees in one department are working on a project. Each person has a different set of
responsibilities, and each produces documentation for a different part of the project. Employees have
each made the hard drive on their own computers available to everyone else on the project.
As the project grows, each user produces more documents, and questions arise about who has
which document and which employee last revised a given document. Also, employees outside the
department who have an interest in the project are asking to see some of the completed material.
1. Why are problems arising concerning who has which document? Suggest at least one reason.
2. What one change could you make that would give you centralized control of the access to
these documents?
3. Describe one change that your solution will bring to the users' operating environment.
When a client enters this address into a Web browser, DNS is called to resolve
the Fully Qualified Domain Name (FQDN) to an IP address. When the address
is resolved, an HTTP get request is sent to the Web server. The Web server
responds with an HTTP send response.
Such communication is done several times throughout a single session to a
Web site. HTTP uses TCP for communication between clients and servers.
HTTP operates on port 80.
HTTPS (H YPERTEXT TRANSFER PROTOCOL SECURE)
HTTPS is used when Web transactions are required to be secure. HTTPS uses a
certificatebased technology such as VeriSign.
Certificate-based transactions offer a mutual authentication between the client and the
server. Mutual authentication ensures the client identity, and ensures server identity.
HTTPS, in addition to using certificate-based authentication, encrypts all data packets
sent during a session.
Simple Network Management Protocol (SNMP).
SNMP is a two-way network management protocol. SNMP consists of two components, the
SNMP Agent, and the SNMP Management Console. The SNMP Management Console is
the server side for SNMP. The management console sends requests to the SNMP Agents
as get commands that call for information about the client.
If an SNMP Agent receives a request from a Management Console that is not part of the
same community name, then the request for information is denied.
Layer 6 – Presentation
The Presentation Layer’s primary responsibility is to define the syntax that network hosts use to
communicate. Compression and encryption fall in the functions of this layer. It is sometimes
referred to as the “syntax” layer and is responsible for transforming information or data into
format(s) the application layer can use.
The functions performed at the Presentation layer of the OSI are:
Protocol conversion
Data translation.
Data encryption and decryption
Data compression
Character set conversion
Interpretation of graphics commands.
Layer 5 – Session
The Session Layer establishes process to process communications between two or more
networked hosts.
The important functions performed at Session layer to establish, maintain and terminate
communication sessions are summarized below:
Establishes, terminates, and monitors communication sessions between applications
Name lookup and security functions.
Placement the header information in a packet which determines the point where a message
starts and the point where a message ends.
Data synchronization. The layer performs synchronization between the Session layer of the
data sender and the Session layer of the receiver of the data.
Controls whether the communication or messages being exchanged in a session are
transmitted as full duplex messages or half duplex messages.
Layer 4 – Transport
The Transport Layer is responsible for the delivery of messages between two or more networked
hosts. It handles fragmentation and reassembly of messages and controls the reliability of a given
link.
The important functions performed at the Transport layer to enable network communication are listed
below:
Guaranteed data delivery
Name resolution
Flow control
Error detection
Error recovery
The Transport layer at each computer verifies that the application transmitting the data is actually
allowed to access the network. It also verifies that each end of the network connection can start the
data transfer process. The transport protocols running on each host partaking in communication
monitors the data transfer process, and monitors for errors as well.
Layer 3 – Network
The Network Layer is primarily responsible for establishing the paths used for transfer of data
packets between devices on the network. Network routers operate at this layer.
One of the main functions performed at the Network layer is routing. Routing enables packets to be
moved among computers which are more than one link from one another.
The functions performed at the Network layer of the OSI model are listed below:
Traffic direction to the end destination
Addressing; logical network addresses and services addresses
Routing functions; route discovery and route selection
Packet switching
Packet sequence control
End-to-end error detection, from the data sender to the receiver of data.
Congestion control
Network layer flow control and Network layer error control
Gateway services
Layer 2 manages the ordering of bits, packets, to and from data segments. The ensuing result is
called frames. Frames contain data that is already arranged in an orderly manner. The Data-link
layer receives packets from the Network layer and structures these packets into frames. The frames
are then moved to the Physical layer for sending.
A cyclic redundancy check (CRC) is added to the data frame. The CRC detects damaged frames.
The computer at the receiving end can request the cyclic redundancy check (CRC) so that it can
verify that the frame is not damaged. The Data-link layer can determine when a frame is lost. It also
requests any lost frames to be retransmitted. By performing these tasks, the Data-link layer makes it
possible for data bits to be transmitted in an organized manner.
Layer 1 – Physical
The Physical Layer handles the bit level transmission between two or more network nodes.
The first layer in the OSI model is the Physical layer which transmits raw bit streams over a physical
medium. The Physical layer deals with establishing a physical connection between computers to
enable communication.
The physical layer is hardware specific and deals with the actual physical connection between the
computer and the network medium. All devices that function at the Physical layer handle signalling.
Data handled at the layer are in bits (1s and 0s). The 1s and 0s are in represented by pulses of light
or electricity.
Components in this layer include connectors, cable types, pin-outs, and voltages which are defined
by the applicable standards organization.
The details on the actual physical connection defined at this layer include:
Physical topologies of the network.
Network connection types and how cable is attached to the Network Interface Card
(NIC).
Data encoding: This relates to the analog and digital signaling methods utilized to
encode data in the signals.
Bit synchronization
Multiplexing
Termination
ETHERNET (PHYSICAL/DATA LINK LAYERS)
The physical layer of the network focuses on hardware elements, such as cables, repeaters, and
network interface cards. By far the most common protocol used at the physical layer is Ethernet. For
example, an Ethernet network (such as 10BaseT or 100BaseTX) specifies the type of cables that
can be used, the optimal topology (star vs. bus, etc.), the maximum length of cables, etc. (See the
Cabling section for more information on Ethernet standards related to the physical layer).
The data link layer of the network addresses the way that data packets are sent from one node to
another. Ethernet uses an access method called CSMA/CD (Carrier Sense Multiple Access/Collision
Detection). This is a system where each computer listens to the cable before sending anything
through the network. If the network is clear, the computer will transmit.
If some other node is already transmitting on the cable, the computer will wait and try again when the
line is clear. Sometimes, two computers attempt to transmit at the same instant. When this happens
a collision occurs.
Each computer then backs off and waits a random amount of time before attempting to retransmit.
With this access method, it is normal to have collisions. However, the delay caused by collisions and
retransmitting is very small and does not normally effect the speed of transmission on the network.
ETHERNET
The original Ethernet standard was developed in 1983 and had a maximum speed of 10 Mbps
(phenomenal at the time) over coaxial cable. The Ethernet protocol allows for bus, star, or tree
topologies, depending on the type of cables used and other factors.
This heavy coaxial cabling was expensive to purchase, install, and maintain, and very difficult to
retrofit into existing facilities.
The current standards are now built around the use of twisted pair wire. Common twisted pair
standards are 10BaseT, 100BaseT, and 1000BaseT. The number (10, 100, 1000) ands for the speed
of transmission (10/100/1000 megabits per second); the "Base" stands for "baseband" meaning it
has full control of the wire on a single frequency; and the "T" stands for "twisted pair" cable. Fiber
cable can also be used at this level in 10BaseFL.
FAST ETHERNET
The Fast Ethernet protocol supports transmission up to 100 Mbps. Fast Ethernet requires the use of
different, more expensive network concentrators/hubs and network interface cards. In addition,
category 5 twisted pair or fiber optic cable is necessary. Fast Ethernet standards include:
100BaseT - 100 Mbps over 2-pair category 5 or better UTP cable.
100BaseFX - 100 Mbps over fiber cable.
100BaseSX -100 Mbps over multimode fiber cable.
100BaseBX - 100 Mbps over single mode fiber cable.
GIGABIT ETHERNET
Gigabit Ethernet standard is a protocol that has a transmission speed of 1 Gbps (1000 Mbps). It can
be used with both fiber optic cabling and copper.
1000BaseT - 1000 Mbps over 2-pair category 5 or better UTP cable.
1000BaseTX - 1000 Mbps over 2-pair category 6 or better UTP cable.
1000BaseFX - 1000 Mbps over fiber cable.
1000BaseSX -1000 Mbps over multimode fiber cable.
1000BaseBX - 1000 Mbps over single mode fiber cable.
The Ethernet standards continue to evolve. with 10 Gigabit Ethernet (10,000 Mbps) and 100 Gigabit
Ethernet (100,000 Mbps),
Ethernet Protocol Summary