Network Troubleshooting: Method and Tools
Method
Work a consistent loop: identify the problem and gather information, establish a theory, test it, plan and implement a fix, verify full functionality, and document. Choose a direction - top-down from the application, bottom-up from the physical layer, or divide-and-conquer from the middle. Change one variable at a time so results stay interpretable.
Tools
Ping tests reachability and round-trip time. Traceroute reveals the path and where it stops. ipconfig, ifconfig, or ip show addressing, and nslookup or dig query DNS directly. arp exposes the local resolution table. netstat or ss shows listening ports and connections. Wireshark or tcpdump captures packets, while a cable tester, toner probe, and OTDR cover copper and fiber plant. A Wi-Fi analyzer reveals channel overlap, RSSI, and SNR.
Symptom patterns
A 169.254 address means DHCP was unreachable - check VLAN, trunk, relay, and scope exhaustion. If IP pings work but names fail, suspect DNS. If the gateway answers but remote hosts do not, suspect routing, NAT, or a firewall. Intermittent performance can be latency, jitter, or loss; test each separately. Duplicate IP addresses, subnet mask mismatches, and wrong default gateways produce partial connectivity that looks like random failure.
Traps
Questions blur "cannot reach the internet" with "DNS is broken." Test by pinging a public IP, then a name. High latency is not the same as high jitter, and neither is packet loss. A link light does not guarantee correct duplex or VLAN assignment.
Worked example
A user receives 169.254.x.x. Confirm the physical link, then the access VLAN, then that the trunk allows it, then the relay address, and finally the DHCP scope. If a static address works, the fault is DHCP delivery rather than routing.
Rule of thumb
If pinging the default gateway fails, stop investigating DNS and applications - the problem is local or Layer 2/3.