I85PREP
⌘ K
CNPA study materials
CNPA study resources

CNPA: Network Operations and Troubleshooting

CNPA · Work through your exam, one topic at a time.

All guide sections

Network Operations and Troubleshooting

This domain asks you to diagnose faults methodically using the OSI model, show commands and test tools, and to describe operational practices such as monitoring, baselining and change control.

Method and tools

  • Frameworks: bottom-up (start at cabling), top-down (start at the application), divide-and-conquer (start at L3 and ping outward), follow-the-path, and compare against a baseline.
  • Tools: ping, traceroute/tracert (relies on TTL expiry; many systems send UDP probes, Windows sends ICMP), ipconfig/ifconfig, arp -a, netstat, nslookup/dig, packet capture, cable tester, TDR for copper distance-to-fault, OTDR and light meter for fibre.
  • Operations: SNMP polling and traps, syslog (severity 0 emergency to 7 debug), NetFlow, configuration backup, documented change windows, UPS and PoE budget checks.

Reading interface counters

  • CRC/FCS and input errors: cabling, connectors or EMI.
  • Late collisions and runts appearing alongside speed or duplex mismatch messages: duplex mismatch.
  • Giants: MTU mismatch, or jumbo frames enabled on one side only.
  • Rising output drops: congestion or oversubscription.

Symptom-to-cause shortcuts

  • Local pings succeed but remote pings fail: default gateway or subnet mask.
  • IP works but names fail: DNS.
  • Small packets pass while large transfers stall: MTU or PMTUD black hole.
  • One VLAN cannot reach another: missing SVI, trunk or 802.1Q configuration.
  • Wireless clients drop at cell edges: coverage, interference or roaming behaviour.

Worked example

A workstation at 192.168.1.50 cannot reach a server at 192.168.1.200. Both are in the same physical subnet, which is really 192.168.1.0/25. ping 192.168.1.200 fails and arp -a shows no entry for it, while the gateway pings fine. With a /24 mask the host believes 192.168.1.200 is on-link, so it ARPs for it instead of sending to the gateway; the router never sees the traffic and no reply arrives. Correcting the mask to 255.255.255.128 restores connectivity. The giveaway is that ARP resolution fails while other traffic works normally.

Traps

  • Treating "request timed out" as proof a host is down; a firewall may simply drop ICMP.
  • Reading asterisks in traceroute output as a dead network rather than filtered or rate-limited probes.
  • Blaming DNS whenever an application fails; test with an IP address first.
  • Rebooting or swapping hardware before identifying the root cause.
  • Reading CRC errors as a switching or VLAN problem instead of a Layer 1 problem.