Network Fundamentals · Topic 6 of 6

Diagnosing Connectivity Issues and Network Constraints

Diagnose application connectivity problems caused by NAT, blocked ports, proxies and VPNs, and see how latency, jitter and packet loss affect applications.

5 min

In a nutshell

Diagnose in order: name, reachability, port, application and intermediaries.
ping, traceroute, nslookup, nc -zv and curl -v are the basic tools.
NAT can break inbound connections and cannot join networks that use overlapping ranges.

What it is

Diagnosing application connectivity means finding which part of the path stops an application from working, and network constraints are the limits of the path itself.

Common causes are NAT, a blocked transport port, a proxy and a VPN. Constraints such as latency, bandwidth, jitter and packet loss do not stop traffic, but they change how well an application behaves.

A calm, step by step method finds most faults quickly.

How it works

Work from the client toward the server, and test one layer at a time.

A diagnostic method

Name. Does the host name resolve to the right address?
Reachability. Can you reach the address? Try ping and traceroute.
Port. Is the TCP or UDP port open from this client?
Application. Does the service answer correctly once connected?
Intermediaries. Is a proxy, NAT or VPN changing the traffic?

$ nslookup app.example
$ ping 192.0.2.10
$ traceroute 192.0.2.10
$ nc -zv 192.0.2.10 443
$ curl -v HOST_ADDRESS

nslookup tests DNS, and ping tests basic reachability. traceroute shows the hops along the path, and nc -zv checks that a TCP port accepts connections. curl -v shows the full HTTP exchange, including TLS and headers.

A server can show what it is listening on.

$ ss -tln

NAT problems

NAT rewrites addresses, so it can cause faults.

Missing translation. Private hosts have no route to the internet because NAT is not configured, or the inside and outside interfaces are wrong.
Inbound connections fail. Outside hosts cannot start a connection to a private server unless a static mapping or port forward exists.
Overlapping addresses. Two networks that use the same private range cannot be joined without translation.

On a Cisco router, show ip nat translations shows whether a translation exists.

Transport port blocked

A firewall or access list may block the port that the application uses. The symptoms differ.

Symptom	Likely meaning
Connection refused at once	Nothing is listening on the port, or the host rejects it
Connection times out	A firewall silently drops the packets, or the host is unreachable
Ping works but the application fails	The port is blocked, or the service is down
Works from one network but not another	A rule or route differs between the paths

Test with nc -zv HOST PORT. Then check the firewall rules and access lists on each device along the path, and the host firewall.

Proxy problems

A proxy sits between the client and the server. If the client must use a proxy and does not, the connection fails. If it uses one and should not, the connection may go to the wrong place or be blocked.

Check the proxy settings of the client or the environment variables such as HTTPS_PROXY.
A proxy may need credentials, and it may refuse a request with a 407 status.
A proxy can change headers or block certain sites and methods.
TLS inspecting proxies replace certificates, which can break clients that check them.

VPN problems

A VPN creates an encrypted tunnel to another network.

Tunnel down. Nothing passes until it is up. Check the VPN status.
Split tunnelling. Only some traffic goes through the tunnel, so a destination may use the wrong path.
Routes and DNS. The client needs a route to the remote network and may need the remote DNS server.
MTU. Tunnel headers use space, so large packets may be dropped or fragmented, and small ones work while large ones fail.
Overlapping subnets. The local and remote networks use the same range, and traffic goes to the wrong place.

Network constraints

Constraint	Meaning	Effect on applications
Latency	The time a packet takes to travel	Slow responses, and chatty protocols that make many round trips suffer most
Bandwidth	The capacity of the link	Slow large transfers, and congestion when many users share the link
Jitter	Variation in latency	Choppy voice and video
Packet loss	Packets that never arrive	Retransmissions and timeouts, so throughput drops
MTU	The largest packet size that a link carries	Fragmentation, or dropped packets when fragmentation is not allowed
Congestion	Too much traffic for a link	Delay and loss at busy times

TCP retransmits lost packets, so loss slows TCP applications. UDP does not retransmit, so loss shows up directly in voice and video as gaps.

Designing around constraints

Set timeouts, and retry with a growing delay.
Send fewer, larger requests instead of many small ones.
Cache data and compress it.
Use quality of service to protect real time traffic.
Run services closer to users, for example at the edge.

Exam tip

A refused connection answers at once, while a timeout means that packets vanish. Refused points to the host or service, and a timeout points to a firewall or a routing problem.

What to remember for the exam

Seven facts cover this topic.

Diagnose in order: name, reachability, port, application and intermediaries.
ping, traceroute, nslookup, nc -zv and curl -v are the basic tools.
NAT can break inbound connections and cannot join networks that use overlapping ranges.
A port that a firewall drops usually gives a timeout, and a closed port usually gives an immediate refusal.
A proxy or VPN can change the route, the DNS or the headers of a connection.
Latency, bandwidth, jitter and packet loss limit how well an application performs.
Jitter hurts voice and video, and packet loss slows TCP applications.

Common mistakes

Four mistakes are typical.

Testing only with ping. Ping can work while the application port is blocked.

Ignoring DNS. A wrong or missing record looks like a dead server.

Forgetting the proxy. A browser may use it while a script does not.

Overlooking MTU on tunnels. Small packets pass and large ones fail, which seems random.

Watch out

A port scan or test against systems that you do not own may be against the rules. Test only your own and authorised systems.

Check yourself

Work through these three questions.

A connection to a port times out, while another port on the same host answers. What does this suggest?
A firewall or access list is probably dropping packets for the blocked port.
Why can a private server not be reached from the internet through NAT?
NAT does not allow outside hosts to start connections to private addresses unless a static mapping or port forward exists.
Which network constraint most harms voice and video quality, and why?
Jitter, because variation in delay makes the audio and video choppy.

Topic 6 of 6 in Network Fundamentals

Test yourself on Network Fundamentals

The full Cisco CCNA 200-901 DEVASC question bank has 808 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.