Network Troubleshooting: A Structured Methodology for Engineers
·2 min read·248 words
A structured network troubleshooting methodology: a systematic approach prevents hours of aimless investigation. Bottom-up OSI vs. top-down vs. divide-and-conquer. Essential tools: ping, traceroute, tcpdump/Wireshark, and show commands. Practical 2026 guide.
Methodologies
- Bottom-up OSI: L1 cabling → L2 switching → L3 routing → L4 ports → L7 applications
- Top-down: application → network (for malfunctioning applications)
- Divide-and-conquer: split the problem in half (test at the midpoint)
- Follow-the-path: trace the packet's physical and logical path
- Compare: check against a working baseline
Core tools
- ping: L3 connectivity
- traceroute: hop-by-hop path
- arp -a: local ARP table
- nslookup / dig: DNS resolution
- netstat / ss: local connections
- Wireshark / tcpdump: packet capture
- iperf: bandwidth test
Switch/router commands
- show interfaces: CRC errors and collisions
- show mac address-table: MAC learning
- show ip route: routing table
- show ip bgp summary: BGP status
- show spanning-tree: STP status
- show cdp/lldp neighbors: neighbors
- debug ip icmp: traffic debugging (use caution in production)
Common issues
- Faulty cable: check show interfaces errors
- Duplex mismatch: late collisions are a symptom
- VLAN not allowed on the trunk
- MTU mismatch: fragmentation
- Asymmetric routing: the FW drops the reverse flow
- DNS: nslookup fails, but the IP address responds to ping
- MTU 1500 vs 9000: jumbo frames
Packet capture
- tcpdump -i eth0 -w capture.pcap 'host 10.0.0.5'
- Wireshark: UI and advanced filters (ip.src==X, tcp.port==443)
- SPAN/mirror port on the switch for non-intrusive capture
- FortiGate: diagnose sniffer packet any 'host 10.0.0.5' 4
Order from OPTINOC
Network troubleshooting training and existing-infrastructure audits. Advanced Wireshark and Cisco/Juniper/FortiGate commands. Quote within 48 hours.