← Network+ Troubleshooting Tools

CompTIA Network+ Certification Study Guide

Key concepts, definitions, and exam tips organized by topic.

27 cards covered

Network+ Troubleshooting Tools Study Guide


Overview

Network troubleshooting tools are essential utilities that help technicians diagnose and resolve connectivity, performance, and configuration issues across all layers of the OSI model. This guide covers command-line utilities, packet analysis software, hardware tools, and wireless troubleshooting tools — all critical knowledge areas for the CompTIA Network+ exam.


---


Command-Line Utilities


Connectivity Testing Tools


| Tool | Platform | Purpose |

|------|----------|---------|

| ping | All | Basic ICMP connectivity test |

| tracert | Windows | Path/hop mapping |

| traceroute | Linux/macOS | Path/hop mapping |

| pathping | Windows | Combined ping + tracert with statistics |


  • • ping sends ICMP Echo Request packets to a target host and reports round-trip time, latency, and packet loss
  • • tracert/traceroute uses incrementing TTL values to identify each router hop along the path
  • • pathping first maps the route (like tracert), then monitors each hop for 250 seconds by default to compute packet loss and latency — the most comprehensive of the three

    • IP Configuration Tools


  • • ipconfig (Windows): Displays IP address, subnet mask, default gateway, and DNS server

    • - `ipconfig /all` — full details including MAC address and DHCP info

    - `ipconfig /release` — releases current DHCP lease

    - `ipconfig /renew` — requests a new IP from the DHCP server

    - `ipconfig /flushdns` — clears the local DNS resolver cache

  • • ifconfig / ip addr (Linux/macOS): Equivalent to ipconfig

    • Address Resolution & Routing Tools


  • • arp — Displays and manages the ARP cache (IP-to-MAC address mappings)

    • - `arp -a` — displays the ARP cache

    - `arp -d` — deletes ARP cache entries

    - Troubleshoots Layer 2 address resolution issues

  • • route (Windows) — Displays and modifies the IP routing table

    • - `route print` — displays the routing table

    - `route add` / `route delete` — modifies static routes

    - Used for default gateway and routing troubleshooting


    Connection & Port Monitoring


  • • netstat — Displays:

    • - Active network connections

    - Listening ports

    - Protocol statistics

    - Routing table information

    - Useful for identifying open ports and unauthorized connections


    DNS Troubleshooting Tools


  • • nslookup — Queries DNS servers manually

    • - Supports A, MX, PTR, CNAME, and other record types

    - Can specify alternate DNS servers to test resolution

    - Available on Windows, Linux, and macOS

  • • dig (Linux/macOS) — More feature-rich DNS query tool

    • - Provides verbose output: full answer section, authority records, query statistics

    - Considered the preferred tool for advanced DNS troubleshooting


    NetBIOS Tools (Windows-Specific)


  • • nbtstat — Resolves NetBIOS names to IP addresses

    • - `nbtstat -c` — displays the NetBIOS name cache

    - `nbtstat -n` — shows local NetBIOS names

    - Used for troubleshooting legacy Windows NetBIOS name resolution


    Key Terms — Command-Line Utilities

  • • ICMP — Internet Control Message Protocol; used by ping and tracert
  • • TTL (Time to Live) — Value decremented at each hop; used by tracert to map paths
  • • ARP Cache — Table mapping IP addresses to MAC addresses
  • • DHCP Lease — Temporary IP address assignment from a DHCP server
  • • DNS Resolver Cache — Local store of recently resolved DNS records

    • Watch Out For ⚠️

  • • tracert vs. traceroute: Remember that `tracert` is Windows-only; Linux/macOS use `traceroute`
  • • ifconfig vs. ip addr: `ifconfig` is deprecated on modern Linux; `ip addr` is the current standard
  • • nslookup vs. dig: Both query DNS, but `dig` is Linux/macOS-preferred and provides more detail; nslookup is cross-platform
  • • ping blocked by firewalls: A failed ping does NOT always mean a host is down — firewalls may block ICMP
  • • arp -a vs. arp -d: Know the difference — `-a` displays, `-d` deletes

    • ---


    Packet Analysis & Software Tools


    Protocol Analyzers


  • • Wireshark

    • - Free, open-source packet analyzer (protocol analyzer / packet sniffer)

    - Captures and decodes traffic across all OSI layers (Layer 2 through Layer 7)

    - Used to diagnose application issues, detect malformed packets, identify unauthorized traffic, and analyze protocol behavior


  • • Protocol Analyzer (general)

    • - Captures raw network traffic and decodes it into human-readable format

    - Primary uses:

    - Diagnosing application-layer issues

    - Identifying malformed packets

    - Detecting unauthorized or suspicious traffic

    - Analyzing protocol behavior


    Network Discovery & Scanning


  • • Nmap (Network Mapper)

    • - Scans for:

    - Active hosts on a network

    - Open TCP/UDP ports

    - Running services and version detection

    - Operating system fingerprinting

    - Used for both troubleshooting and security auditing


    Traffic Flow Analysis


  • • NetFlow (Cisco protocol)

    • - Collects metadata about traffic flows (source/destination IP, ports, protocol, byte counts)

    - Does NOT capture full packet payloads

    - Used for:

    - Bandwidth analysis

    - Traffic baselining

    - Identifying top talkers (hosts consuming the most bandwidth)


    Performance Testing


  • • Bandwidth Speed Testers (e.g., iPerf, online speed tests)

    • - Measure actual throughput between two network points

    - Help identify whether bandwidth meets expected levels

    - Can reveal network bottlenecks


    Key Terms — Software Tools

  • • Packet Sniffer — Tool that captures raw network traffic
  • • NetFlow — Cisco protocol for traffic flow metadata collection
  • • Top Talker — Host consuming the most network bandwidth
  • • Throughput — Actual data transfer rate achieved on a network link
  • • Fingerprinting — Identifying OS or service details from network probe responses

    • Watch Out For ⚠️

  • • NetFlow vs. Wireshark: NetFlow captures metadata only (no packet payloads); Wireshark captures full packets
  • • Nmap is a dual-purpose tool: It's used for troubleshooting AND security auditing — know both contexts
  • • Protocol analyzer placement matters: Must be on the same collision domain or use port mirroring (SPAN) to capture traffic

    • ---


    Hardware Tools


    Copper Cable Testing Tools


    | Tool | Function |

    |------|----------|

    | Cable Tester | Checks continuity and correct pin mapping |

    | Cable Certifier | Measures attenuation, crosstalk, return loss to certify to a standard |

    | TDR | Locates cable faults and measures cable length |

    | Toner Probe | Traces cables through walls, ceilings, and patch panels |


  • • Cable Tester

    • - Verifies all 8 conductors are properly terminated and correctly paired

    - Basic: continuity and pin mapping

    - Advanced certifiers: also measure attenuation, crosstalk, and return loss


  • • TDR (Time-Domain Reflectometer)

    • - Sends an electrical pulse down a copper cable and measures the reflection

    - Can identify the precise distance to a break, short circuit, or impedance mismatch


  • • Toner Probe (Fox and Hound)

    • - Tone generator: injects a signal onto the cable

    - Inductive probe: traces the cable path to identify it at the other end

    - Used to locate cables through walls, ceilings, and patch panels


  • • Punch-Down Tool (Impact Tool)

    • - Terminates keystone jacks and patch panel connections

    - Simultaneously seats wire into IDC (Insulation Displacement Connector) terminals and trims excess wire


    Fiber Optic Testing Tools


    | Tool | Function |

    |------|----------|

    | Optical Power Meter | Measures end-to-end signal loss (insertion loss) |

    | OTDR | Maps entire fiber link; locates specific faults, splices, and connectors |


  • • Optical Power Meter

    • - Measures optical power at the receiving end of a fiber run

    - Used with a light source to measure insertion loss

    - Verifies whether the link meets the required power budget

    - Only measures end-to-end loss — cannot locate specific faults


  • • OTDR (Optical Time-Domain Reflectometer)

    • - Sends light pulses into fiber and analyzes backscatter

    - Creates a detailed map of the fiber link showing:

    - Location and magnitude of faults

    - Splices and connectors

    - More advanced than a power meter — can locate specific faults


    Port Testing


  • • Loopback Adapter

    • - Connects a port's transmit pins directly to its receive pins

    - Tests whether a NIC or switch port can successfully transmit and receive data

    - Used to verify hardware functionality independent of the network


    Key Terms — Hardware Tools

  • • IDC (Insulation Displacement Connector) — Connector type used in punch-down terminations
  • • Attenuation — Signal strength loss over distance in a cable
  • • Crosstalk — Interference between wire pairs in a cable
  • • Return Loss — Signal reflected back toward the source due to impedance mismatch
  • • Insertion Loss — Total signal loss across a fiber link
  • • Power Budget — The acceptable range of optical signal loss for a fiber link
  • • Backscatter — Light reflected back toward the OTDR source used to map fiber faults

    • Watch Out For ⚠️

  • • TDR vs. OTDR: TDR is for copper; OTDR is for fiber — don't mix these up
  • • Optical Power Meter vs. OTDR: Power meter only measures total loss; OTDR locates the faults
  • • Cable tester vs. cable certifier: A basic tester only checks wiring; a certifier measures performance to a standard
  • • Toner probe vs. cable tester: Toner probe traces/locates cables; cable tester tests wiring integrity
  • • Loopback adapter is used for hardware testing only — it does not test the actual network

    • ---


    Wireless Troubleshooting Tools


    Wi-Fi Analyzers


  • • Wireless Analyzer (e.g., inSSIDer)

    • - Discovers nearby 802.11 networks

    - Displays:

    - Signal strength (RSSI)

    - Channel assignments

    - Security settings

    - SSIDs in range

    - Helps identify channel overlap, co-channel interference, and coverage gaps

    - Only detects 802.11 Wi-Fi traffic — cannot detect non-Wi-Fi RF interference


    Spectrum Analyzers


  • • Spectrum Analyzer

    • - Measures all RF energy across a frequency band

    - Detects non-802.11 interference sources, including:

    - Microwave ovens

    - Bluetooth devices

    - Baby monitors

    - Cordless phones

    - More comprehensive than a Wi-Fi analyzer for identifying RF interference sources


    Signal Strength Measurement


  • • RSSI (Received Signal Strength Indicator)

    • - Measures the power level of a received wireless signal

    - Expressed in dBm (always negative values)

    - General guidelines:


    | RSSI Value | Signal Quality |

    |------------|----------------|

    | -50 dBm or higher | Excellent |

    | -60 to -70 dBm | Acceptable / Good |

    | -70 to -80 dBm | Weak / Marginal |

    | Below -80 dBm | Poor — likely causing connectivity issues |


    Key Terms — Wireless Tools

  • • RSSI — Received Signal Strength Indicator; measures wireless signal power in dBm
  • • dBm — Decibels relative to one milliwatt; unit used to express signal strength
  • • Co-channel Interference — Interference from multiple APs using the same channel
  • • Channel Overlap — Interference caused by APs using overlapping (non-orthogonal) channels
  • • Spectrum — The range of radio frequencies available for wireless communication

    • Watch Out For ⚠️

  • • Wi-Fi analyzer vs. spectrum analyzer: Wi-Fi analyzer only sees 802.11 networks; spectrum analyzer detects ALL RF sources — critical distinction for the exam
  • • RSSI is always negative: Higher (less negative) values mean stronger signal (-60 dBm is better than -80 dBm)
  • • Co-channel vs. adjacent channel interference: Co-channel = same channel; adjacent channel = overlapping but different channels

    • ---


    Quick Review Checklist


    Command-Line Tools

  • • [ ] ping — ICMP connectivity test; measures latency and packet loss
  • • [ ] tracert/traceroute — Maps path using incrementing TTL values
  • • [ ] pathping — Combines ping + tracert; runs for 250 seconds by default
  • • [ ] ipconfig — Windows IP config; know `/all`, `/release`, `/renew`, `/flushdns`
  • • [ ] ifconfig / ip addr — Linux/macOS equivalent to ipconfig
  • • [ ] arp -a — Displays ARP cache (IP-to-MAC mappings)
  • • [ ] netstat — Shows active connections and listening ports
  • • [ ] route print — Displays routing table
  • • [ ] nslookup — DNS query tool (cross-platform)
  • • [ ] dig — Advanced DNS query tool (Linux/macOS preferred)
  • • [ ] nbtstat — NetBIOS name resolution troubleshooting (Windows)

    • Software Tools

  • • [ ] Wireshark — Full packet capture across all OSI layers
  • • [ ] Nmap — Host/port discovery and OS fingerprinting
  • • [ ] NetFlow — Traffic metadata collection (no full payloads)
  • • [ ] iPerf / Speed testers — Measure actual network throughput

    • Hardware Tools

  • • [ ] Cable tester — Verifies continuity and pin mapping of copper cables
  • • [ ] TDR — Locates faults and measures length in copper cables
  • • [ ] Toner probe — Traces cables through walls and patch panels
  • • [ ] Punch-down tool — Terminates IDC connections in keystone jacks/patch panels
  • • [ ] Optical power meter — Measures end-to-end fiber signal loss
  • • [ ] OTDR — Maps fiber link and locates specific faults
  • • [ ] Loopback adapter — Tests NIC/port hardware functionality

    • Wireless Tools

  • • [ ] Wi-Fi analyzer — Shows 802.11 networks, RSSI, channels, and security settings
  • • [ ] Spectrum analyzer — Detects ALL RF sources including non-Wi-Fi interference
  • • [ ] RSSI — Signal strength in dBm; -70 dBm or better is generally acceptable

    • ---


    > Final Exam Tip: The Network+ exam frequently tests your ability to select the right tool for a given scenario. Focus on understanding what each tool does, what layer it operates at, and what specific problem it solves rather than memorizing syntax alone.

    📝

    Take a Practice Test

    Test yourself with multiple choice questions
    📇

    Study with Flashcards

    Flip through all 27 cards

    Want more study tools?

    Subscribe for $7.99/mo and turn your own notes into personalized flashcards and study guides.

    View Pricing