5.5 - Network troubleshooting tools
Network+ N10-009 objective 5.5 covers the software and hardware tools used to diagnose networks. Wireshark captures and decodes packets for deep protocol analysis, letting you see exactly what is on the wire. A loopback plug tests a switch or router port by looping its own signal back to confirm the interface works. tracert (traceroute) shows the path and where it breaks - if it dies consistently at hop 4 with timeouts and nothing replies afterward, the break is at or after hop 4. nslookup queries DNS; an NXDOMAIN for a name created minutes ago is often negative caching of the earlier miss, which clears after the TTL. You should also know ping, ipconfig/ip, a cable tester, a Wi-Fi analyzer and a toner probe. Expect scenario questions that describe a diagnostic need and ask which tool provides it.
Capture + decode packets = Wireshark. Loop a port's signal to test it = loopback plug. Show path + where it breaks = tracert (dies at hop 4 = break at/after 4). Query DNS = nslookup (NXDOMAIN for a new name = negative caching).
Practice questions
1. Which command tests basic end-to-end reachability to a host?
- nslookup
- netstat
- ping (correct answer)
- arp
ping sends ICMP echo requests to confirm a host is reachable and measure latency. nslookup tests DNS, netstat shows connections, arp shows the MAC cache.
2. Which tool shows each router hop along the path to a destination?
- ipconfig
- netstat
- nslookup
- traceroute (correct answer)
traceroute (tracert on Windows) lists each Layer 3 hop and its latency, helping locate where a path breaks or slows. ipconfig shows local config, nslookup queries DNS.
3. Users reach sites by IP but not by name. Which tool best diagnoses this?
- ping -t
- tracert
- nslookup (correct answer)
- arp -a
IP works but names fail = a DNS problem. nslookup (or dig) queries DNS to confirm resolution and which server answers. ping/tracert test reachability, arp shows MAC cache.
4. Which command displays a Windows host's IP configuration and DNS servers?
- ifconfig -a
- ipconfig /all (correct answer)
- netstat -rn
- arp -a -v
ipconfig /all shows IP, mask, gateway, DHCP and DNS servers on Windows. ifconfig is Linux/legacy, netstat -r shows routes, arp -a shows the MAC cache.
5. Which tool identifies which physical port a cable connects to at a patch panel?
- Cable certifier
- Loopback plug
- OTDR
- Toner probe (correct answer)
A toner probe (tone generator + probe) traces which cable/port carries the tone. An OTDR measures fiber faults, a loopback tests a port, a certifier validates standards.
6. Which command shows active TCP connections and listening ports on a host?
- netstat (correct answer)
- tracert
- nslookup
- ipconfig
netstat lists active connections and listening sockets with their ports. tracert traces a path, nslookup queries DNS, ipconfig shows local IP settings.