Network Troubleshooting · Topic 3 of 6
Troubleshooting Network Service Issues
Troubleshoot addressing, DHCP, DNS, VLAN, spanning tree, routing, ACL, certificate and time problems by matching symptoms to the likely causes.
- 5 min
- Local works but remote fails: suspect the default gateway or routing.
- Works by IP address but not by name: suspect DNS.
- A 169.254.x.x address means DHCP failed.
What it is
A cable can be perfect and a network can still fail. Services such as addressing, name resolution, switching and routing depend on correct settings, and one wrong value can cut off a user or a whole subnet.
The exam gives a symptom, for example "can reach local devices but not the internet", and asks for the likely cause. This page links common symptoms to the settings behind them.
How it works
Addressing problems
| Problem | Typical symptom |
|---|---|
| Wrong Internet Protocol (IP) address | Host cannot communicate with its own subnet |
| Wrong subnet mask | Can reach some local hosts but not others, or cannot reach the gateway |
| Wrong default gateway | Local access works, remote networks fail |
| Duplicate IP address | Intermittent loss of connection for two devices, with warnings about a conflict |
| Duplicate Media Access Control (MAC) address | Two devices share one hardware address, so the switch keeps moving the entry between ports and both see intermittent loss |
| Expired lease | A client that cannot renew its lease loses its address |
| Dynamic Host Configuration Protocol (DHCP) pool exhausted | New clients get no address or an Automatic Private IP Addressing (APIPA) address (169.254.x.x) |
| Rogue DHCP server | Clients get a wrong gateway or Domain Name System (DNS) server |
A host with a 169.254 address did not get a DHCP answer. Check the cable and the virtual LAN (VLAN), then the DHCP server, its scope and the relay agent.
Name resolution problems
If a site works by IP address but not by name, DNS is the problem. Causes include the wrong DNS server address, an unreachable DNS server, a missing or wrong record, or an old cached entry.
| Check | Purpose |
|---|---|
| Ping by name and by IP address | Separates a name problem from a path problem |
| Query the DNS server directly | Shows whether the record exists |
| Flush the local DNS cache | Removes stale answers |
Switching problems
| Problem | Typical symptom |
|---|---|
| Wrong VLAN assignment | Host gets the wrong subnet or cannot reach its own resources |
| Missing VLAN on a trunk | Hosts in that VLAN cannot cross between switches |
| Native VLAN mismatch | Odd connectivity and warnings on trunk links |
| Switching loop | Network slows or stops, with a broadcast storm and high central processing unit (CPU) use |
| Wrong root bridge | Traffic takes poor paths because an unplanned switch became the root |
A switching loop appears when spanning tree is missing or fails. Look for very high link utilization, many broadcasts and unstable MAC address tables.
Routing problems
If hosts reach local devices but not a remote network, check the default gateway, then the router's routing table.
Missing routes, an incorrect default route, a route learned from the wrong source, or traffic that goes out one way and returns another way through a different path can cause failures. A return route is required, or replies never reach the sender.
Filtering and service problems
If a specific service fails while others work, an access control list (ACL) or firewall rule may block it. Check rule order, direction, the implicit deny and whether the correct port and protocol are allowed. A host based firewall on the server itself can block a port even when the network is fine.
If the port is open on the network but the service does not answer, the service may be stopped or the server hardware may have failed.
Certificate and time problems
An expired certificate, a name mismatch or an untrusted issuer breaks secure connections. A wrong clock makes certificates look expired or not yet valid, and breaks authentication such as Kerberos.
Wireless service problems
Users who cannot connect may face a wrong password or security type, an exhausted DHCP scope on the wireless VLAN, or an access point on a channel with heavy interference.
What to remember for the exam
- Local works but remote fails: suspect the default gateway or routing.
- Works by IP address but not by name: suspect DNS.
- A 169.254.x.x address means DHCP failed.
- A wrong subnet mask breaks communication with some hosts only.
- A duplicate IP address causes intermittent conflicts.
- A switching loop causes a broadcast storm. Spanning tree prevents it.
- A missing VLAN on a trunk blocks traffic in that VLAN.
- Replies need a return route as well as a forward route.
- A wrong clock can break certificates and authentication.
Work outward. Ping your own address, then the gateway, then a remote IP address, then a name. The first failure points to the layer to investigate.
Common mistakes
Blaming the internet for a DNS fault. If an IP address works, the network is fine and the name service is not.
Overlooking the subnet mask. A host with a mask that is too small or too large cannot reach some neighbors.
Fixing only the forward route. The remote side also needs a route back.
Ignoring ACL order. A deny above a permit blocks traffic the administrator meant to allow.
Forgetting about the clock. Authentication and certificates fail when time is wrong.
Do not change the DHCP scope or a static address without checking for overlaps. Overlapping ranges create duplicate IP addresses.
Check yourself
Work through these three.
A user can ping 8.8.8.8 but cannot open a website by name. What is the likely cause?
A DNS problem, such as a wrong or unreachable DNS server.
A client has the address 169.254.5.9. What does that tell you?
The client got no response from a DHCP server and assigned itself an APIPA address.
Hosts in VLAN 30 cannot cross a trunk although other VLANs work. What should you check?
Whether VLAN 30 exists and is allowed on the trunk.
Topic 3 of 6 in Network Troubleshooting
Test yourself on Network Troubleshooting
The full CompTIA Network+ N10-009 question bank has 910 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.