CHAPTER 11: Network Troubleshooting Tools 566 I have recently upgraded my copy of Microsoft Visio to Visio 2003. Q: I used to have the ability to perform an automatic network discov- ery from the Tools menu in Visio. Where is this option in Visio 2003? Unfortunately, Microsoft removed the automatic network discovery A: feature from Visio 2003. You’ll need to purchase a third- party tool like SolarWinds or LAN MapShot. If you are still running Visio 2000 or 2003, you have access to a basic network discovery tool that will map out the IP addresses and hostnames of computers within a Windows domain. I’m having a hard time remembering the different switches that are Q: available for all of these troubleshooting utilities. Is there an easy way to look these up when I need to use them? Yes. Almost all Windows and Linux command-line utilities have a A: Help switch, which you can access using the –? or /? switch after typing in the name of the command. SELF TEST Which of the following commands is a Linux-based command used 1. to troubleshoot DNS? DNSLookupA. NslookupB. DigC. QueryD. 2. You would like to use Nslookup to verify that your e-mail server, Email1, has correctly registered its A record in DNS. Which of the following commands shows the correct syntax to accomplish this? A. nslookup type=A Email1 B. nslookup A Email1 C. nslookup Email1 A record D. nslookup Email1 3. You would like to view the network path that is taken by packets across your internal routers before exiting your LAN and heading out into the Internet. Which of the following commands will show the route that packets take across the network? Select all that apply. Self Test 567 A. ping B. tracert C. dig D. traceroute E. nslookup 4. You are the network administrator for a network that employs a Windows 2003 server and 30 Windows XP Professional workstations. The Windows 2003 server runs the DHCP service to provide TCP/IP configuration information to the Windows XP clients. You receive a call from one of your users stating that he is unable to browse any internal network resources or Internet Web sites. To begin troubleshooting you would like to be able to view the locally configured TCP/IP settings. Which command should you run to view the following output on the problem workstation? Windows IP Configuration Host Name . . . . . . . . . . . . : IBM-A38375FF22E Primary Dns Suffix . . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No Ethernet adapter Wireless Network Connection: Connection-specific DNS Suffix . . .: Description . . . . . . . . . . . : Intel(R) PRO/Wireless 2200BG Network Connection Physical Address. . . . . . . . . : 00-1E-25-1A-D3-5A Dhcp Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . .: No IP Address. . . . . . . . . . . . : 192.168.1.12 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.1.1 DHCP Server . . . . . . . . . . . : 192.168.1.250 DNS Servers . . . . . . . . . . . : 192.168.1.250 Lease Obtained . . . . . . . . . .: Tuesday, March 29, 2005 1:00:10 PM Lease Expires . . . . . . . . . . : Wednesday, March 30, 2005 1:00:10 PM CHAPTER 11: Network Troubleshooting Tools 568 A. ipconfig B. ipconfig /show C. ipconfig /all D. ipconfig /release 5. You are issuing the following command on a Windows Vista machine: ping Server5. Which of the following commands will allow you to view the correct name cache where the resolution of Server5 is being stored? A. nslookup server5 B. dig server5 C. nbtstat –c D. ipconfig /displaydns 6. You have a series of hostnames that you need to verify are correctly registered in DNS. Which of the following tools is the most appro- priate for you to utilize? A. nslookup in command mode B. netstat in verification mode C. nslookup in interactive mode D. ipconfig in display mode 7. You are the administrator for a network which has recently experi- enced a failure on one of your Layer 3 devices. Which devices have most likely been impacted? Select all that apply. BridgesA. SwitchesB. RoutersC. HubsD. RepeatersE. 8. You believe that an electrical panel near one of your network switches may be causing interference in one of the Ethernet cables that connects a workstation to the switch port on the network. Which of the following tools will help you to determine if there is electrical interference on the line? Self Test 569 Crossover cableA. OscilloscopeB. Vampire TapC. Fox and HoundD. 9. You have an environment that has many Linux-based machines on it. Which of the following tasks can be performed on your Linux-based machines with the ifconfig command? Choose all that apply. Configure a network card with the IP address of 192.168.1.121.A. Set the NWLink Frame type.B. Disable a NIC.C. Display current configurations of a NIC in the Linux machine.D. 10. You network runs a mixture of IPX/SPX and TCP/IP protocols. You have added three new Windows XP workstations and must configure them for both protocols. You utilize the ipconfig / all command on each of the three workstations and verify that they have all set to DHCP for TCP/IP and have received an IP address from the DHCP server and are functioning properly. You must now verify that the IPX/SPX protocol is configured properly on the three workstations. Which of the following com- mands will you allow to verify the IPX/SPX configuration on the workstations? A. ipxroute all B. ipxroute config C. ipconfig config D. ipxconfig /all 11. Examine the tracert output shown in Figure 11.24. What is a possible explanation for the “Request timed out” values shown? Choose all that apply. The router at that hop is down.A. The router at that hop does not respond to ping attempts.B. There has been an incorrect DNS resolution and the wrong C. router is being contacted. The maximum hop count has been reached, so all other hops D. beyond it will show Request timed out. CHAPTER 11: Network Troubleshooting Tools 570 12. All of the machines in your network are configured to use DHCP. You have made a change to your DHCP settings on some subnets to adjust the default gateway to a new value. Some users are com- plaining that they can no longer connect to the Internet or get to file shares on the network. What command can you use to verify that client computers are configured correctly? PingA. CheckItB. IpconfigC. ConfigStatsD. 13. You have a specialized application that has been homegrown and is used to receive orders from various terminals throughout your manufacturing plant. The programmers have come up with a new revision of the application which contains some significant changes. One of the changes is a new module that uses port 4523. You have installed the new module on your test application server, but there is no method built into the application to see if the port is active. Which of the following commands will tell you if the module is active and listening on port 4523? FIGURE 11.24 Sample Tracert Output. Self Test 571 A. nbstat -an B. netstat -show C. netstat -an D. nbtstat -show 14. A user calls to complain that when they attempt to use a mapped network drive on their computer, Drive F, they are not able to con- nect. Suddenly many calls are coming in with the same problem. Drive F on the user machines maps to \\Server43\Accounting. From a Windows XP client machine which of the following tools is the most appropriate for you use to attempt to diagnose this problem? PingA. IpconfigB. DigC. NetstatD. 15. Over the weekend you have installed a new NIC in a server and have configured the NIC to have the same static IP address that was set on the old NIC. First thing Monday morning you receive a network alert that there are a large number of broadcasts taking place on the network segment where this server resides. What is the probable cause for the increase in broadcasts? ARP resolutionsA. RARP resolutionsB. DNS resolutionsC. Dig attemptsD. SELF TEST QUICK ANSWER KEY C1. D2. B and D3. C4. C5. C6. C7. B8. A, C, and D9. B10. A and B11. C12. C13. A14. A15. This page intentionally left blank 573 CHAPTER 12 EXAM OBJECTIVES IN THIS CHAPTER HOW TO USE THE OSI MODEL IN TROUBLESHOOTING 575 TROUBLESHOOTING THE PHYSICAL LAYER 581 TROUBLESHOOTING THE DATA LINK LAYER 591 TROUBLESHOOTING THE NETWORK LAYER 598 TROUBLESHOOTING THE TRANSPORT LAYER 603 TROUBLESHOOTING THE SESSION LAYER 609 TROUBLESHOOTING THE PRESENTATION LAYER 612 TROUBLESHOOTING THE APPLICATION LAYER 614 INTRODUCTION Congratulations! You’ve made it almost all the way through the Network+ exam preparation guide. You’ve learned all about the physical and logical components that make up a network, and how to install and configure the Transmission Control Protocol/Internet Protocol (TCP/IP) suite. You’ve also learned about the different protocols that make up the TCP/IP suite as well as how they map to the Open Systems Interconnect (OSI) model. This includes the Internet Protocol (IP), which is the workhorse of the TCP/IP suite that handles the “heavy lifting” of routing TCP/IP traffic from one host to another. You’ve also learned about TCP/IP’s two session layer protocols: TCP, and the User Datagram Protocol (UDP). TCP is a connection-oriented protocol that’s used when each session layer packet has to be acknowledged by the computer it’s being sent to. UDP is connectionless, which is useful for low-overhead connections where speed is at a premium. You’ve also seen the Internet Control Message Protocol (ICMP), which is used for TCP/IP trouble- shooting. In our last chapter, we talked extensively about the various utilities that are available to troubleshoot connectivity problems on a network. In our Network Troubleshooting Methodology CHAPTER 12 : Network Troubleshooting Methodology 574 final chapter, we’ll take the tools discussed in Chapter 11 and learn how to use them in a real-world situation to troubleshoot network connectivity issues. We will revisit the OSI model and the TCP/IP-based Department of Defense (DoD) model. We’ll also review the components of the suite of protocols that make up the TCP/IP stack and how common connectivity devices, such as repeaters, bridges, routers, and switches are used to expand or segment TCP/IP networks. All of this is critical information to have at your fingertips when you’re troubleshooting because, just as a physician is better able to treat a sick patient if he knows the person’s background, characteristics, and how the patient normally behaves when he is not ill, you will be at a big advantage when you’re confronted with “sick” or a badly functioning network if you understand your network’s “anatomy” and components. Most networks depend on the TCP/IP protocol to communicate, making it one of the most important “body parts”. The objective of this chapter is to give you a detailed review of TCP/IP, and explain the methodology that will enable you to recognize symptoms of network troubles and to diagnose and correct any errors or misconfigurations that you may find. We all know that a healthy network makes for a happy network administrator, and the information you find in this chapter will help you in preparing both for the Network+ exam and for your journey into the real world of network administration and troubleshooting. To help you with this, we will first go through each layer of the OSI model and talk about the different troubleshooting steps you can take at each layer. For example, the physical layer is concerned with physical connectivity between two computers, so here you’ll look for broken cables or a malfunctioning network interface card (NIC). The data link layer is where switches, bridges, and Ethernet frame types operate, so you’ll troubleshoot this layer by examining all of these components. We will start our review at the physical layer, which is the lowest layer of the OSI model, and work all the way up through the application layer. This chapter will help you to put together all of the concepts you’ve learned throughout this study guide, to help you use them in troubleshooting real-world issues that you might encounter on a network. Exam Warning Be sure that you really understand what is happening at each layer of the OSI model. It’s important for the Network+ exam that you’re able to recognize the different network protocols and devices that operate at each level, rather than just memorizing the “Please Do Not Throw Sausage Pizza Away” or “All People Seem To Need Data Processing” mnemonics. How to Use the OSI Model in Troubleshooting 575 HOW TO USE THE OSI MODEL IN TROUBLESHOOTING As a network administrator, you should be familiar with the common networking models. In this chapter, we will be using the OSI and DoD models as our guide down the path of troubleshooting. We will learn how to map issues you may encounter back to different levels, which will allow you to pinpoint the devices on which to start troubleshooting. Depending on the layer that you begin your troubleshooting, different techniques may be required to determine the root cause of the issue. For example, if you had a problem with a wireless access point (WAP), which layer would you start with? Why would you select that layer and what could be the issue? What if you had misconfigured your encryption settings for Wireless Encryption Protocol (WEP) and cannot connect to the wireless network? We’ll look at examples like these to see how each layer of the OSI model fits into an overall troubleshooting strategy. Troubleshooting skills are critical in the world of networking and they are also important to learn as you prepare for the Network+ exam. The Purpose of Networking Models Chapter 6 covered network models and their importance in depth. One of the key benefits of having a network model in place is that it gives you a standard to utilize and reference, thereby helping to isolate network issues to specific layers of a protocol stack. Being able to isolate which layer a problem stems from allows you to identify the types of components that may be involved in the issue, thus helping you to troubleshoot the prob- lem. You’ll often hear the OSI model referenced in everyday networking related conversations, and when used while troubleshooting a problem, it can help everyone involved understand precisely where an issue is occurring. For instance, “We have a Layer 3 problem.” This should immediately bring thoughts of components that exist at Layer 3 of the OSI model such as IP addresses and routers. Because understanding the OSI model is so critical to the network troubleshooting process, it’s imperative that you master the OSI model’s layering. A network protocol is a set of rules used by computers to communicate. Protocols had to be developed so that two computers attempting to transfer data back and forth would be able to understand one another. Some people will describe protocols as “languages,” but this isn’t entirely accurate and can cause confusion, because computer languages are an entirely different concept. A protocol is more like the syntax of the language, which refers to the order in which the words are put together, rather than the language itself. . 575 TROUBLESHOOTING THE PHYSICAL LAYER 581 TROUBLESHOOTING THE DATA LINK LAYER 591 TROUBLESHOOTING THE NETWORK LAYER 598 TROUBLESHOOTING THE TRANSPORT LAYER 603 TROUBLESHOOTING THE SESSION LAYER. LAYER 614 INTRODUCTION Congratulations! You’ve made it almost all the way through the Network+ exam preparation guide. You’ve learned all about the physical and logical components that make up. This chapter will help you to put together all of the concepts you’ve learned throughout this study guide, to help you use them in troubleshooting real-world issues that you might encounter on