1 00:00:00,120 --> 00:00:01,170 In this lesson, 2 00:00:01,170 --> 00:00:03,780 we're going to discuss how you can troubleshoot network issues 3 00:00:03,780 --> 00:00:05,760 that you may come across in the field. 4 00:00:05,760 --> 00:00:08,340 By having a basic understanding of network troubleshooting, 5 00:00:08,340 --> 00:00:10,530 you can determine whether or not the issue is caused by the 6 00:00:10,530 --> 00:00:12,930 network, your own Linux workstation or server, 7 00:00:12,930 --> 00:00:14,340 or something else. 8 00:00:14,340 --> 00:00:16,710 We're going to cover the basics of network troubleshooting via 9 00:00:16,710 --> 00:00:19,860 the command line inside of Linux inside of this lesson 10 00:00:19,860 --> 00:00:22,350 to help you understand how to diagnose most networking 11 00:00:22,350 --> 00:00:24,480 issues and how to solve them faster 12 00:00:24,480 --> 00:00:26,220 and using a more consistent method 13 00:00:26,220 --> 00:00:28,320 when you find these different network problems. 14 00:00:28,320 --> 00:00:30,660 Things like latency, disconnections, 15 00:00:30,660 --> 00:00:33,180 unresolved host names, and much more. 16 00:00:33,180 --> 00:00:35,670 A lot of the commands that you're going to see here are things 17 00:00:35,670 --> 00:00:36,600 that we've already talked about 18 00:00:36,600 --> 00:00:39,180 back in your A plus or network plus studies. 19 00:00:39,180 --> 00:00:41,310 So I'm going to be sure to cover them all here, 20 00:00:41,310 --> 00:00:43,530 but I won't necessarily dive deep into some of those 21 00:00:43,530 --> 00:00:45,840 commands because you should already know them. 22 00:00:45,840 --> 00:00:48,180 If you need more information in any of these commands, 23 00:00:48,180 --> 00:00:51,360 remember, you can always use man and the command name 24 00:00:51,360 --> 00:00:54,180 to learn more about it from within your Linux system. 25 00:00:54,180 --> 00:00:56,580 Now, network troubleshooting should always begin with a 26 00:00:56,580 --> 00:00:58,320 series of general steps before 27 00:00:58,320 --> 00:01:00,780 you move into more complex techniques. 28 00:01:00,780 --> 00:01:01,613 First, 29 00:01:01,613 --> 00:01:02,970 you want to make sure you check the basics, 30 00:01:02,970 --> 00:01:06,420 like is your device actually plugged in and powered on? 31 00:01:06,420 --> 00:01:07,253 Next, 32 00:01:07,253 --> 00:01:08,970 you want to verify that the network interfaces 33 00:01:08,970 --> 00:01:10,860 are actually configured correctly. 34 00:01:10,860 --> 00:01:11,693 Remember, 35 00:01:11,693 --> 00:01:14,130 they have to have an appropriate IP address configuration, 36 00:01:14,130 --> 00:01:16,470 subnet mass, default gateway value, 37 00:01:16,470 --> 00:01:18,960 and name resolution settings inside of those 38 00:01:18,960 --> 00:01:22,140 network interfaces, otherwise, they're not going to work. 39 00:01:22,140 --> 00:01:22,973 Also, 40 00:01:22,973 --> 00:01:24,960 you want to check that the network interface is actually 41 00:01:24,960 --> 00:01:27,330 detected by your Linux operating system. 42 00:01:27,330 --> 00:01:30,840 And you can use the ETH tool command to gather driver and 43 00:01:30,840 --> 00:01:33,780 other information about that particular device. 44 00:01:33,780 --> 00:01:36,390 Now you can also troubleshoot name resolution issues 45 00:01:36,390 --> 00:01:38,130 using several different techniques 46 00:01:38,130 --> 00:01:40,860 if you're having trouble reaching certain websites. 47 00:01:40,860 --> 00:01:43,380 The first way to do this is to ping a destination 48 00:01:43,380 --> 00:01:46,410 by both its host name and then by its IP address. 49 00:01:46,410 --> 00:01:48,390 If you can ping it using the IP address, 50 00:01:48,390 --> 00:01:50,490 but you can't ping it using the host name, 51 00:01:50,490 --> 00:01:53,370 that means your system is not properly resolving network 52 00:01:53,370 --> 00:01:55,860 names and there is a DNS issue. 53 00:01:55,860 --> 00:01:56,760 At this point, 54 00:01:56,760 --> 00:01:59,130 you're going to use tools like host or nslookup 55 00:01:59,130 --> 00:02:01,890 or dig to test your system's ability to perform name 56 00:02:01,890 --> 00:02:04,680 resolution by querying that DNS server. 57 00:02:04,680 --> 00:02:06,210 If it's your own DNS server, 58 00:02:06,210 --> 00:02:08,070 you might have to go look at that DNS server 59 00:02:08,070 --> 00:02:10,380 and check its configurations as well. 60 00:02:10,380 --> 00:02:12,750 The network itself can also experience issues, 61 00:02:12,750 --> 00:02:14,580 including things like high traffic, 62 00:02:14,580 --> 00:02:17,190 which can cause latency and saturation issues 63 00:02:17,190 --> 00:02:19,410 at various points within your network. 64 00:02:19,410 --> 00:02:22,050 If you use netstat on your Linux system, 65 00:02:22,050 --> 00:02:24,420 you can then determine the number and types of connections 66 00:02:24,420 --> 00:02:26,910 that are being made to your system and see if the latency is 67 00:02:26,910 --> 00:02:30,450 too high or if you're starting to become overly saturated. 68 00:02:30,450 --> 00:02:32,310 Another issue is that your network interface 69 00:02:32,310 --> 00:02:34,110 card itself could be failing 70 00:02:34,110 --> 00:02:35,520 and this can cause data packets 71 00:02:35,520 --> 00:02:36,870 to be dropped on the network, 72 00:02:36,870 --> 00:02:39,660 which causes a loss in data, timeout messages, 73 00:02:39,660 --> 00:02:41,460 or reduced network throughput. 74 00:02:41,460 --> 00:02:43,290 If any of these issues are occurring, 75 00:02:43,290 --> 00:02:45,180 you're going to need to look at whether you need to replace 76 00:02:45,180 --> 00:02:48,120 your network card or check to make sure that the network 77 00:02:48,120 --> 00:02:49,440 itself isn't having a problem 78 00:02:49,440 --> 00:02:51,060 on the other side of the connection, 79 00:02:51,060 --> 00:02:52,350 such as the network switch, 80 00:02:52,350 --> 00:02:54,570 to ensure that's not what's at fault. 81 00:02:54,570 --> 00:02:55,403 Now, 82 00:02:55,403 --> 00:02:57,120 when a developer is trying to troubleshoot application 83 00:02:57,120 --> 00:02:58,890 performance on a Linux system, 84 00:02:58,890 --> 00:03:00,570 they actually have to decide which way 85 00:03:00,570 --> 00:03:02,610 the communication is going to occur. 86 00:03:02,610 --> 00:03:05,173 This can be done using either a local host or Unix sockets 87 00:03:05,173 --> 00:03:07,800 to be able to send data to and from the network 88 00:03:07,800 --> 00:03:09,660 when they design their programs. 89 00:03:09,660 --> 00:03:11,850 Now the first method known as local host 90 00:03:11,850 --> 00:03:13,950 is going to create a full network connection, 91 00:03:13,950 --> 00:03:16,380 and this includes all the TCP error-checking, 92 00:03:16,380 --> 00:03:17,580 so you're going to be able to troubleshoot 93 00:03:17,580 --> 00:03:19,260 the connection much easier. 94 00:03:19,260 --> 00:03:20,250 This method, though, 95 00:03:20,250 --> 00:03:22,860 is significantly slower than our second method, 96 00:03:22,860 --> 00:03:25,080 which relies on using Unix sockets, 97 00:03:25,080 --> 00:03:27,780 also known as Unix domain sockets. 98 00:03:27,780 --> 00:03:30,360 This approach has a much faster performance because it 99 00:03:30,360 --> 00:03:33,330 removes the TCP overhead from this transaction, 100 00:03:33,330 --> 00:03:36,750 but it does result in less detailed error-checking. 101 00:03:36,750 --> 00:03:37,980 Now, unless you're a developer, 102 00:03:37,980 --> 00:03:40,950 you're really not going to mess too much with the local host or 103 00:03:40,950 --> 00:03:42,780 Unix socket's methods because 104 00:03:42,780 --> 00:03:44,700 that's going to be coded into the applications 105 00:03:44,700 --> 00:03:46,350 you're already using. 106 00:03:46,350 --> 00:03:48,390 Now, as you might know, network adapters, 107 00:03:48,390 --> 00:03:51,420 which are also called network interface cards or NICs, 108 00:03:51,420 --> 00:03:52,830 are those devices that provide the 109 00:03:52,830 --> 00:03:55,080 physical connectivity to your network. 110 00:03:55,080 --> 00:03:58,500 These cards typically are going to have an RJ45 connector 111 00:03:58,500 --> 00:04:02,640 if your network relies on UTP or STP copper wiring. 112 00:04:02,640 --> 00:04:04,950 These network interface cards are often found 113 00:04:04,950 --> 00:04:06,630 integrated onto your motherboard 114 00:04:06,630 --> 00:04:10,080 or they can be added to the system using an expansion slot. 115 00:04:10,080 --> 00:04:12,000 If your network card is not being recognized 116 00:04:12,000 --> 00:04:13,290 by your Linux system, 117 00:04:13,290 --> 00:04:16,050 verify that the appropriate driver has been installed so 118 00:04:16,050 --> 00:04:17,550 that Linux can detect the NIC and 119 00:04:17,550 --> 00:04:19,560 take advantage of its features. 120 00:04:19,560 --> 00:04:20,392 All right. 121 00:04:20,392 --> 00:04:21,959 With some of the basics out of the way, 122 00:04:21,959 --> 00:04:23,790 let's go ahead and look at some of the different network 123 00:04:23,790 --> 00:04:26,400 utilities that you can use for troubleshooting. 124 00:04:26,400 --> 00:04:29,580 This includes ping, traceroute, tracepath, 125 00:04:29,580 --> 00:04:33,990 netstat, SS, dig, nslookup, host, 126 00:04:33,990 --> 00:04:38,990 IP, route, nmap, wireshark, tcpdump, netcraft, 127 00:04:39,240 --> 00:04:44,240 iftop, iperf, MTR, ARP, and whois. 128 00:04:44,400 --> 00:04:46,350 One of the first parts of network troubleshooting 129 00:04:46,350 --> 00:04:48,990 is sending test packets between two systems. 130 00:04:48,990 --> 00:04:52,740 This is done using a TCP/IP utility known as ping. 131 00:04:52,740 --> 00:04:54,240 The ping command is going to generate 132 00:04:54,240 --> 00:04:56,730 a response request from the sending computer 133 00:04:56,730 --> 00:04:59,760 and it should receive a reply from the destination computer. 134 00:04:59,760 --> 00:05:01,980 Possible outcomes from the ping command include 135 00:05:01,980 --> 00:05:03,990 receiving a reply from host, 136 00:05:03,990 --> 00:05:06,540 which means the connection was successful. 137 00:05:06,540 --> 00:05:09,750 But if you get a reply as destination unreachable, 138 00:05:09,750 --> 00:05:11,610 this means that your source computer 139 00:05:11,610 --> 00:05:14,010 can't find the path to the destination. 140 00:05:14,010 --> 00:05:16,350 This often indicates there's a problem with your source 141 00:05:16,350 --> 00:05:18,630 computer or the connection along the way 142 00:05:18,630 --> 00:05:20,910 between you and the distant end. 143 00:05:20,910 --> 00:05:23,880 Timeout is another thing you might see and timeout means 144 00:05:23,880 --> 00:05:26,070 that the request reached the destination computer, 145 00:05:26,070 --> 00:05:29,460 but a response did not return to the source computer because 146 00:05:29,460 --> 00:05:31,650 the source computer timed out. 147 00:05:31,650 --> 00:05:33,120 This often indicates that the problem 148 00:05:33,120 --> 00:05:36,000 is with the destination computer or some really bad 149 00:05:36,000 --> 00:05:37,920 slowdowns in your network. 150 00:05:37,920 --> 00:05:39,300 Although using ping is one of the 151 00:05:39,300 --> 00:05:41,490 earliest steps in the troubleshooting process, 152 00:05:41,490 --> 00:05:43,920 it's only going to tell you if something is wrong, 153 00:05:43,920 --> 00:05:46,590 but not exactly what is wrong. 154 00:05:46,590 --> 00:05:47,970 To run the ping command, 155 00:05:47,970 --> 00:05:50,460 you're going to simply type in ping, the options, 156 00:05:50,460 --> 00:05:52,680 and the destination you want to test. 157 00:05:52,680 --> 00:05:54,210 One of the most common ping options 158 00:05:54,210 --> 00:05:56,430 you're going to use is dash C. 159 00:05:56,430 --> 00:05:59,670 Dash C is used to tell you exactly how many ping attempts 160 00:05:59,670 --> 00:06:02,640 you're going to use when trying to connect to the destination. 161 00:06:02,640 --> 00:06:04,440 The dash V option is another one 162 00:06:04,440 --> 00:06:05,880 that you'll commonly see used 163 00:06:05,880 --> 00:06:07,500 and this is to specify that you want to see 164 00:06:07,500 --> 00:06:09,360 the output in verbose mode, 165 00:06:09,360 --> 00:06:10,470 which means you're going to see 166 00:06:10,470 --> 00:06:12,780 a lot more information coming back 167 00:06:12,780 --> 00:06:15,360 that's going to help you in your troubleshooting process. 168 00:06:15,360 --> 00:06:16,800 When you're using the ping command, 169 00:06:16,800 --> 00:06:20,070 you're also going to get a sequence number for the ICMP 170 00:06:20,070 --> 00:06:22,470 sequence for each ping attempt. 171 00:06:22,470 --> 00:06:25,530 The host that sends the ping can use this number to match up 172 00:06:25,530 --> 00:06:28,110 each request with the response it gets back. 173 00:06:28,110 --> 00:06:30,060 If you get mismatched sequence numbers, 174 00:06:30,060 --> 00:06:32,700 this could indicate that there's a drop packet going on 175 00:06:32,700 --> 00:06:34,860 and that means there's instability in the network 176 00:06:34,860 --> 00:06:37,320 or with your network interface card. 177 00:06:37,320 --> 00:06:39,963 The next utility we have is known as traceroute. 178 00:06:39,963 --> 00:06:42,570 The traceroute command is used to report the network path 179 00:06:42,570 --> 00:06:44,940 between the source and the destination computers, 180 00:06:44,940 --> 00:06:47,940 including any routers that the connection uses in between. 181 00:06:47,940 --> 00:06:49,770 The process of a packet traveling across 182 00:06:49,770 --> 00:06:52,800 from one router to the next is known as a hop 183 00:06:52,800 --> 00:06:54,540 and the traceroute command is going to give 184 00:06:54,540 --> 00:06:57,210 an output for each hop along the path. 185 00:06:57,210 --> 00:06:59,040 This is really effective in troubleshooting 186 00:06:59,040 --> 00:07:00,720 your internet connectivity issues 187 00:07:00,720 --> 00:07:02,970 because you're going to be able to figure out exactly which 188 00:07:02,970 --> 00:07:05,130 router things are falling off at. 189 00:07:05,130 --> 00:07:06,120 To run traceroute, 190 00:07:06,120 --> 00:07:09,750 simply type in traceroute, options, and the destination. 191 00:07:09,750 --> 00:07:11,040 Now, similar to traceroute, 192 00:07:11,040 --> 00:07:13,620 there's another utility known as tracepath. 193 00:07:13,620 --> 00:07:15,390 It does much of the same functionality 194 00:07:15,390 --> 00:07:17,100 and it's used in the same way. 195 00:07:17,100 --> 00:07:19,290 To use it, you're going to type in tracepath, 196 00:07:19,290 --> 00:07:21,600 options, and the destination. 197 00:07:21,600 --> 00:07:24,030 A lot of your routing issues are also the result of 198 00:07:24,030 --> 00:07:26,070 misconfigured routing tables. 199 00:07:26,070 --> 00:07:27,840 These issues can usually be fixed by 200 00:07:27,840 --> 00:07:29,730 updating the routing tables themselves. 201 00:07:29,730 --> 00:07:30,563 However, 202 00:07:30,563 --> 00:07:33,240 you first have to identify what's causing the issue. 203 00:07:33,240 --> 00:07:35,730 By using commands like traceroute and tracepath, 204 00:07:35,730 --> 00:07:38,160 you're going to be able to reveal routing issues like routing 205 00:07:38,160 --> 00:07:41,160 loops in which traffic is continuously routed back and forth 206 00:07:41,160 --> 00:07:42,570 between multiple nodes and 207 00:07:42,570 --> 00:07:44,730 never gets to its final destination. 208 00:07:44,730 --> 00:07:45,570 For example, 209 00:07:45,570 --> 00:07:49,380 let's say that node A uses node B as a path to node C, 210 00:07:49,380 --> 00:07:53,190 but node B uses node A as a path to node C. 211 00:07:53,190 --> 00:07:55,410 If the traffic is bound for node C, 212 00:07:55,410 --> 00:07:57,480 nodes A and B are endlessly going to send 213 00:07:57,480 --> 00:07:59,220 traffic between themselves because 214 00:07:59,220 --> 00:08:02,400 each one thinks the other one knows the way to get to node C 215 00:08:02,400 --> 00:08:04,350 and this causes a routing loop. 216 00:08:04,350 --> 00:08:05,183 To fix this, 217 00:08:05,183 --> 00:08:06,840 you're going to have to go into the routing table 218 00:08:06,840 --> 00:08:09,870 of either A or B to be able to fix those issues 219 00:08:09,870 --> 00:08:11,640 and send them along a straight path 220 00:08:11,640 --> 00:08:13,590 instead of this circular path. 221 00:08:13,590 --> 00:08:15,390 Next, we have netstat. 222 00:08:15,390 --> 00:08:18,120 Now the netstat command is used to gather information about 223 00:08:18,120 --> 00:08:20,490 TCP connections on your system. 224 00:08:20,490 --> 00:08:22,080 Depending on the options used, 225 00:08:22,080 --> 00:08:25,050 netstat can inform the user of existing connections, 226 00:08:25,050 --> 00:08:27,600 ports that are set in a listening state on a server, 227 00:08:27,600 --> 00:08:30,390 NIC information, and other things like that. 228 00:08:30,390 --> 00:08:32,400 Some common options for the netstat command 229 00:08:32,400 --> 00:08:33,809 include dash V, 230 00:08:33,809 --> 00:08:36,299 which is going to be used to activate verbose mode, 231 00:08:36,299 --> 00:08:38,100 dash I and interface, 232 00:08:38,100 --> 00:08:40,590 which is used to display information about the network 233 00:08:40,590 --> 00:08:42,960 interfaces or specified interface. 234 00:08:42,960 --> 00:08:46,380 Dash C is an option to continuously print information every 235 00:08:46,380 --> 00:08:48,240 second to continually refresh 236 00:08:48,240 --> 00:08:50,370 what it's seeing inside of netstat. 237 00:08:50,370 --> 00:08:53,040 And the dash L option is going to be used to show only what 238 00:08:53,040 --> 00:08:56,430 ports are set to listening mode on that given server. 239 00:08:56,430 --> 00:08:58,950 To run the netstat command, type netstat, 240 00:08:58,950 --> 00:09:01,140 the options, and then hit enter. 241 00:09:01,140 --> 00:09:04,050 The default output of netstat is going to be presented in a 242 00:09:04,050 --> 00:09:07,410 column-based format with the protocol used by the socket, 243 00:09:07,410 --> 00:09:09,900 the number of processes attached to that socket, 244 00:09:09,900 --> 00:09:11,490 the flies that get further information 245 00:09:11,490 --> 00:09:13,140 about the socket status, 246 00:09:13,140 --> 00:09:16,020 the type of socket access, the state of the socket, 247 00:09:16,020 --> 00:09:18,450 the idea of the process attached to the socket, 248 00:09:18,450 --> 00:09:21,510 and the path of the process attached to that socket. 249 00:09:21,510 --> 00:09:22,380 For example, 250 00:09:22,380 --> 00:09:25,230 you might see something like Unix two 251 00:09:25,230 --> 00:09:30,090 bracket bracket stream connected 472 slash run slash 252 00:09:30,090 --> 00:09:33,900 dbus slash system underscore bus underscore socket. 253 00:09:33,900 --> 00:09:36,990 Now it's important to mention that netstat is installed by 254 00:09:36,990 --> 00:09:39,330 default on most Linux distributions, 255 00:09:39,330 --> 00:09:42,360 but it has been considered deprecated for a little while 256 00:09:42,360 --> 00:09:45,420 now, and instead, it's been replaced with SS. 257 00:09:45,420 --> 00:09:47,730 So, let's talk about SS. 258 00:09:47,730 --> 00:09:50,760 The SS command, which stands for socket state, 259 00:09:50,760 --> 00:09:52,470 is an information gathering utility 260 00:09:52,470 --> 00:09:55,620 that's very similar to netstat and actually replaced it. 261 00:09:55,620 --> 00:09:58,410 The nice thing about SS is it provides simpler output 262 00:09:58,410 --> 00:10:00,780 and syntax than using netstat. 263 00:10:00,780 --> 00:10:03,450 The SS tool can provide information about the established 264 00:10:03,450 --> 00:10:05,520 TCP connections or which ports the 265 00:10:05,520 --> 00:10:08,340 system may be listening on for inbound connections. 266 00:10:08,340 --> 00:10:10,710 This can also be used to help you diagnose problems related 267 00:10:10,710 --> 00:10:12,090 to clients and servers that are 268 00:10:12,090 --> 00:10:13,890 unable to communicate with one another 269 00:10:13,890 --> 00:10:15,690 over a desired protocol. 270 00:10:15,690 --> 00:10:18,540 A missing socket could mean that the service isn't running 271 00:10:18,540 --> 00:10:20,970 and a closed socket could mean that either the client or the 272 00:10:20,970 --> 00:10:24,330 server is prematurely terminating that connection. 273 00:10:24,330 --> 00:10:26,880 Some common options you should be aware of using the SS 274 00:10:26,880 --> 00:10:29,190 utility include dash L. 275 00:10:29,190 --> 00:10:32,160 Dash L is used to show currently listening sockets. 276 00:10:32,160 --> 00:10:35,820 The DST host option is another option you should be aware of 277 00:10:35,820 --> 00:10:38,070 and it's used to show whether the specified host is 278 00:10:38,070 --> 00:10:40,980 connected and what the connection statistics are. 279 00:10:40,980 --> 00:10:43,770 And the dash I option is going to be used to show only what 280 00:10:43,770 --> 00:10:46,920 ports are being listened on on that given server. 281 00:10:46,920 --> 00:10:48,240 To run the SS command, 282 00:10:48,240 --> 00:10:51,720 simply type in SS and the options you want to use. 283 00:10:51,720 --> 00:10:53,640 Now one of the most important network services 284 00:10:53,640 --> 00:10:55,800 that we have is name resolution. 285 00:10:55,800 --> 00:10:58,170 If systems aren't able to reach a DNS server 286 00:10:58,170 --> 00:10:59,970 or conduct name resolution, 287 00:10:59,970 --> 00:11:01,620 they're likely not going to be able to access 288 00:11:01,620 --> 00:11:03,870 a lot of their needed network services 289 00:11:03,870 --> 00:11:06,390 because most things are referred to by their host name or 290 00:11:06,390 --> 00:11:10,170 their domain name and not by their IP address by default. 291 00:11:10,170 --> 00:11:11,910 There are three different tools that we can use 292 00:11:11,910 --> 00:11:14,430 to test and troubleshoot name resolution. 293 00:11:14,430 --> 00:11:18,210 This includes dig, nslookup, and host. 294 00:11:18,210 --> 00:11:19,680 First, we have dig. 295 00:11:19,680 --> 00:11:21,420 The dig command is a powerful tool for 296 00:11:21,420 --> 00:11:23,817 gathering information and testing name resolution 297 00:11:23,817 --> 00:11:27,300 and it's installed on most Linux distributions by default. 298 00:11:27,300 --> 00:11:29,970 The output is going to be displayed in an answer section 299 00:11:29,970 --> 00:11:32,400 and so when you want to do this and figure out what is the 300 00:11:32,400 --> 00:11:34,410 IP address for a given domain name, 301 00:11:34,410 --> 00:11:37,290 you simply type in dig and the domain name. 302 00:11:37,290 --> 00:11:40,560 The command dig at IP address domain name 303 00:11:40,560 --> 00:11:43,650 will resolve that domain name against a given DNS server 304 00:11:43,650 --> 00:11:45,990 that you specify using an IP address. 305 00:11:45,990 --> 00:11:47,430 This can be helpful if you trying to test 306 00:11:47,430 --> 00:11:51,300 if the issue is with your DNS server or DNS at large. 307 00:11:51,300 --> 00:11:52,133 For example, 308 00:11:52,133 --> 00:11:54,240 if I did dig diontraining.com 309 00:11:54,240 --> 00:11:56,070 and it came back as unresolved, 310 00:11:56,070 --> 00:11:58,560 that can indicate a problem with my DNS server. 311 00:11:58,560 --> 00:12:03,560 So, I can then type in dig at 8.8.8.8 diontraining.com 312 00:12:04,050 --> 00:12:05,970 and test my domain name against 313 00:12:05,970 --> 00:12:09,480 the Google DNS server located 8.8.8.8, 314 00:12:09,480 --> 00:12:11,130 which is highly reliable. 315 00:12:11,130 --> 00:12:12,660 If that comes back successfully, 316 00:12:12,660 --> 00:12:16,080 I know it's my DNS server that's having an issue. 317 00:12:16,080 --> 00:12:18,630 The next command we have is known as nslookup 318 00:12:18,630 --> 00:12:20,130 and this is a tool for gathering name 319 00:12:20,130 --> 00:12:23,130 resolution information and testing name resolution. 320 00:12:23,130 --> 00:12:25,350 This is available on most Linux distributions 321 00:12:25,350 --> 00:12:28,260 as well as on Windows and Mac systems. 322 00:12:28,260 --> 00:12:30,930 This command has a noninteractive mode in which you can 323 00:12:30,930 --> 00:12:33,000 provide a domain name in a single command 324 00:12:33,000 --> 00:12:35,370 or you can use an interactive mode 325 00:12:35,370 --> 00:12:37,320 in which you issue the command by itself 326 00:12:37,320 --> 00:12:40,260 and then you enter into a text-based user interface where 327 00:12:40,260 --> 00:12:41,610 you can provide domain names on 328 00:12:41,610 --> 00:12:44,190 separate consecutive prompts to get information. 329 00:12:44,190 --> 00:12:45,630 If you have a lot of work to do with 330 00:12:45,630 --> 00:12:47,400 a domain name server and testing, 331 00:12:47,400 --> 00:12:49,920 I like to go into this interactive mode. 332 00:12:49,920 --> 00:12:51,300 To enter this interactive mode, 333 00:12:51,300 --> 00:12:54,360 simply type in nslookup and hit enter. 334 00:12:54,360 --> 00:12:56,130 The third command we have for DNS 335 00:12:56,130 --> 00:12:57,870 is known as the host command. 336 00:12:57,870 --> 00:13:00,300 The host command is capable of gathering information and 337 00:13:00,300 --> 00:13:02,220 testing name resolution, and again, 338 00:13:02,220 --> 00:13:04,800 it's installed on most Linux distributions. 339 00:13:04,800 --> 00:13:06,630 To use it, simply type in host, 340 00:13:06,630 --> 00:13:08,280 the domain name you want to test, 341 00:13:08,280 --> 00:13:10,230 and the IP address of the DNS server 342 00:13:10,230 --> 00:13:12,690 you want to use to look up that name. 343 00:13:12,690 --> 00:13:14,160 Now, like most things in Linux, 344 00:13:14,160 --> 00:13:15,780 there's lots of different tools to use 345 00:13:15,780 --> 00:13:17,670 to do name resolution, but here, 346 00:13:17,670 --> 00:13:19,590 we're just going to cover the three big ones 347 00:13:19,590 --> 00:13:22,710 which were dig, nslookup, and host. 348 00:13:22,710 --> 00:13:24,810 Next, we have the IP command. 349 00:13:24,810 --> 00:13:28,050 The IP command has replaced the older IF config command for 350 00:13:28,050 --> 00:13:30,510 interacting with your network interface card. 351 00:13:30,510 --> 00:13:33,300 This means the IP command can be used for troubleshooting 352 00:13:33,300 --> 00:13:35,490 as well as for network configuration. 353 00:13:35,490 --> 00:13:37,650 The first steps in the troubleshooting network connectivity 354 00:13:37,650 --> 00:13:40,650 process is to verify that all your settings are correct, 355 00:13:40,650 --> 00:13:42,720 including your IP address. 356 00:13:42,720 --> 00:13:43,553 To check this, 357 00:13:43,553 --> 00:13:48,210 simply type in IP space ADDR, or IP address, 358 00:13:48,210 --> 00:13:50,100 as a way to enable the administrator 359 00:13:50,100 --> 00:13:51,450 to see the configuration that is 360 00:13:51,450 --> 00:13:53,790 currently set for that adapter. 361 00:13:53,790 --> 00:13:54,623 When you do this, 362 00:13:54,623 --> 00:13:56,850 you're going to be able to check the IP address configuration, 363 00:13:56,850 --> 00:13:58,590 the status of the network interface card, 364 00:13:58,590 --> 00:14:01,230 and the usage of the network interface card. 365 00:14:01,230 --> 00:14:04,200 There's lots of other sub commands you can use with IP, 366 00:14:04,200 --> 00:14:06,240 but again, for your basic troubleshooting, 367 00:14:06,240 --> 00:14:09,330 IP addr is going to be your first step. 368 00:14:09,330 --> 00:14:11,250 Next, we have the route command. 369 00:14:11,250 --> 00:14:14,280 This is used to view the routing table on a given machine. 370 00:14:14,280 --> 00:14:16,380 This command is going to be used to manipulate the routing 371 00:14:16,380 --> 00:14:19,350 table and enable the administrator to configure desired 372 00:14:19,350 --> 00:14:22,710 routes statically inside of the system if they need to. 373 00:14:22,710 --> 00:14:23,850 To use the route command, 374 00:14:23,850 --> 00:14:25,770 simply type in route and hit enter 375 00:14:25,770 --> 00:14:28,470 to display the current routing table on the system. 376 00:14:28,470 --> 00:14:29,970 If you want to add a gateway, 377 00:14:29,970 --> 00:14:33,150 you can do that by typing route space add space 378 00:14:33,150 --> 00:14:36,660 default space GW space IP address 379 00:14:36,660 --> 00:14:38,610 and this will configure a default gateway 380 00:14:38,610 --> 00:14:41,340 by its IP address into your routing table. 381 00:14:41,340 --> 00:14:43,710 If you need to add another host into your routing table, 382 00:14:43,710 --> 00:14:45,870 you can do this by typing route space 383 00:14:45,870 --> 00:14:49,800 add space dash host space and the IP address. 384 00:14:49,800 --> 00:14:51,810 If you want to reject or filter traffic 385 00:14:51,810 --> 00:14:53,640 that's destined to a specific address, 386 00:14:53,640 --> 00:14:56,460 you can do that by using the reject sub command. 387 00:14:56,460 --> 00:14:58,650 This will enable an administrator to control the connections 388 00:14:58,650 --> 00:15:01,290 to any given host that's going through this system, 389 00:15:01,290 --> 00:15:03,330 and that way, it will block that route. 390 00:15:03,330 --> 00:15:04,890 Now, to run the route command, 391 00:15:04,890 --> 00:15:07,020 you're going to use the basic format of route 392 00:15:07,020 --> 00:15:08,640 and then the options. 393 00:15:08,640 --> 00:15:10,260 The next tool we have is known as 394 00:15:10,260 --> 00:15:12,750 the network mapper or nmap. 395 00:15:12,750 --> 00:15:15,600 Nmap is a powerful tool for exploring a network environment 396 00:15:15,600 --> 00:15:18,330 and it can be used to identify nodes and be able to report 397 00:15:18,330 --> 00:15:21,270 back on the available services, operating system versions, 398 00:15:21,270 --> 00:15:24,240 host names, IP addresses, Mac addresses, 399 00:15:24,240 --> 00:15:27,420 network devices like switches and routers, network printers, 400 00:15:27,420 --> 00:15:30,591 and other things that it finds when you run nmap. 401 00:15:30,591 --> 00:15:33,060 Nmap is a great command line utility 402 00:15:33,060 --> 00:15:35,490 that is used heavily by cybersecurity analysts 403 00:15:35,490 --> 00:15:38,310 as they're doing vulnerability scans across a network. 404 00:15:38,310 --> 00:15:39,210 To run nmap, 405 00:15:39,210 --> 00:15:41,340 simply type in nmap, the options, 406 00:15:41,340 --> 00:15:43,500 and the targets that you want to scan. 407 00:15:43,500 --> 00:15:45,450 Next, we have wireshark. 408 00:15:45,450 --> 00:15:48,090 Wireshark is a very popular packet sniffer 409 00:15:48,090 --> 00:15:49,740 and network analyzer. 410 00:15:49,740 --> 00:15:51,570 Network analyzers are basically used 411 00:15:51,570 --> 00:15:54,270 to intercept and potentially read network traffic 412 00:15:54,270 --> 00:15:55,410 and these tools can be used for 413 00:15:55,410 --> 00:15:57,330 eavesdropping attacks by attackers, 414 00:15:57,330 --> 00:16:00,420 but it can also be used by us for network troubleshooting. 415 00:16:00,420 --> 00:16:02,580 When network traffic is being intercepted, 416 00:16:02,580 --> 00:16:04,950 we're going to get information about it such as the source and 417 00:16:04,950 --> 00:16:07,350 destination Mac addresses at layer two, 418 00:16:07,350 --> 00:16:10,410 the source and destination IP addresses at layer three, 419 00:16:10,410 --> 00:16:13,080 the port numbers and the packet payload data 420 00:16:13,080 --> 00:16:15,960 and all of that can be seen inside of wireshark. 421 00:16:15,960 --> 00:16:18,480 Now an advantage of a tool like wireshark is our ability to 422 00:16:18,480 --> 00:16:21,413 see exactly what packets are moving through a given network 423 00:16:21,413 --> 00:16:24,360 segment or across a given network interface card 424 00:16:24,360 --> 00:16:25,650 and what packets aren't. 425 00:16:25,650 --> 00:16:27,090 And so this can be really helpful 426 00:16:27,090 --> 00:16:28,770 when you're doing your troubleshooting. 427 00:16:28,770 --> 00:16:31,830 Wireshark is a graphical user interface-based tool, 428 00:16:31,830 --> 00:16:33,720 so you have to have a graphical environment 429 00:16:33,720 --> 00:16:35,010 to be able to run it. 430 00:16:35,010 --> 00:16:35,843 On the other hand, 431 00:16:35,843 --> 00:16:38,040 if you're using a command line environment only, 432 00:16:38,040 --> 00:16:41,910 you can use the network analyzer known as tcpdump. 433 00:16:41,910 --> 00:16:44,517 Tcpdump was created back in 1987 434 00:16:44,517 --> 00:16:45,960 and it still remains one of the most 435 00:16:45,960 --> 00:16:48,420 popular packet sniffers available today. 436 00:16:48,420 --> 00:16:51,480 It's installed by default on many Linux distributions, too, 437 00:16:51,480 --> 00:16:53,820 making it an easy go-to tool for you to use 438 00:16:53,820 --> 00:16:55,320 in your command line. 439 00:16:55,320 --> 00:16:58,200 Now, users can determine the exact traffic type and content 440 00:16:58,200 --> 00:17:00,060 they want to see using this command 441 00:17:00,060 --> 00:17:01,740 and setting up different filters. 442 00:17:01,740 --> 00:17:03,450 It works very similar to wireshark, 443 00:17:03,450 --> 00:17:06,359 but you can use it in the command line environment. 444 00:17:06,359 --> 00:17:09,119 Now, some common options you're going to see with tcpdump 445 00:17:09,119 --> 00:17:10,410 include dash I, 446 00:17:10,410 --> 00:17:12,930 which specifies the interface you want to listen on, 447 00:17:12,930 --> 00:17:13,950 dash N, 448 00:17:13,950 --> 00:17:16,440 which is going to be used to not resolve host names and show 449 00:17:16,440 --> 00:17:18,089 everything as IP addresses, 450 00:17:18,089 --> 00:17:19,050 and dash V, 451 00:17:19,050 --> 00:17:22,079 which is used to tell the system to operate in verbose mode 452 00:17:22,079 --> 00:17:23,910 and give you a lot more errors and details 453 00:17:23,910 --> 00:17:25,170 that you can go through. 454 00:17:25,170 --> 00:17:28,920 To run the tcpdump command, simply type in tcpdump, 455 00:17:28,920 --> 00:17:30,960 the options dash I and the 456 00:17:30,960 --> 00:17:33,090 interface you want to listen on, and host, 457 00:17:33,090 --> 00:17:35,490 and the IP address that you want to look at. 458 00:17:35,490 --> 00:17:37,290 Next, we have netcat. 459 00:17:37,290 --> 00:17:39,030 The netcat command can be used to test 460 00:17:39,030 --> 00:17:42,330 connectivity and send data across network connections. 461 00:17:42,330 --> 00:17:44,730 This command may be spelled out as netcat 462 00:17:44,730 --> 00:17:47,430 or abbreviated as NC depending on 463 00:17:47,430 --> 00:17:49,590 the distribution of Linux you're using. 464 00:17:49,590 --> 00:17:51,540 Systems may also be identified by their 465 00:17:51,540 --> 00:17:53,250 IP address or their host name, 466 00:17:53,250 --> 00:17:55,350 depending on how you want to connect to them. 467 00:17:55,350 --> 00:17:56,580 When you're troubleshooting, 468 00:17:56,580 --> 00:17:59,640 you can use netcat to listen on the destination computer 469 00:17:59,640 --> 00:18:01,920 and then attempt a connection from a source computer 470 00:18:01,920 --> 00:18:04,590 in order to verify that network functionality exists between 471 00:18:04,590 --> 00:18:06,090 those two systems. 472 00:18:06,090 --> 00:18:08,070 Netcat can also be used to send files to 473 00:18:08,070 --> 00:18:09,690 and from a remote machine. 474 00:18:09,690 --> 00:18:12,720 To use netcat, simply type Netcat and the options 475 00:18:12,720 --> 00:18:15,240 or NC and the options. 476 00:18:15,240 --> 00:18:18,210 Next, we have iftop or if top. 477 00:18:18,210 --> 00:18:20,760 The iftop command displays bandwidth usage information 478 00:18:20,760 --> 00:18:22,650 for the system and helps to identify 479 00:18:22,650 --> 00:18:24,450 whether a particular network interface card 480 00:18:24,450 --> 00:18:27,330 or protocol is consuming a lot of bandwidth. 481 00:18:27,330 --> 00:18:30,060 This command can be used to identify why a particular link 482 00:18:30,060 --> 00:18:31,890 may be slowing down by showing you 483 00:18:31,890 --> 00:18:33,660 the traffic on that connection. 484 00:18:33,660 --> 00:18:35,010 And you can use it to check to see 485 00:18:35,010 --> 00:18:38,130 what's consuming the most bandwidth on a given interface. 486 00:18:38,130 --> 00:18:41,610 Network slowness is often a symptom of bandwidth saturation 487 00:18:41,610 --> 00:18:43,740 and this occurs when a network's link capacity 488 00:18:43,740 --> 00:18:45,030 is being exceeded. 489 00:18:45,030 --> 00:18:45,863 For example, 490 00:18:45,863 --> 00:18:48,060 all the bandwidth is being used up because you're streaming 491 00:18:48,060 --> 00:18:51,060 too many videos over a small internet connection. 492 00:18:51,060 --> 00:18:53,070 This can lead to degraded network performance 493 00:18:53,070 --> 00:18:54,780 or even service outages. 494 00:18:54,780 --> 00:18:56,220 With the iftop command, 495 00:18:56,220 --> 00:18:58,830 you can investigate any NIC on a network link that you 496 00:18:58,830 --> 00:19:01,800 suspect may be sending or receiving excessive amounts of 497 00:19:01,800 --> 00:19:03,660 traffic across that link. 498 00:19:03,660 --> 00:19:07,860 To use iftop, type iftop, options, dash I, 499 00:19:07,860 --> 00:19:10,080 and the interface you want to interact with. 500 00:19:10,080 --> 00:19:11,820 Next, we have iperf. 501 00:19:11,820 --> 00:19:14,100 The iperf command is used to test the maximum 502 00:19:14,100 --> 00:19:17,040 throughput of an interface across a network. 503 00:19:17,040 --> 00:19:18,060 To use this, though, 504 00:19:18,060 --> 00:19:20,220 you have to install it on two systems. 505 00:19:20,220 --> 00:19:21,780 One is going to be the sending machine 506 00:19:21,780 --> 00:19:23,550 and one's going to be the receiver. 507 00:19:23,550 --> 00:19:25,890 Essentially, we're going to have one acting as a server 508 00:19:25,890 --> 00:19:27,540 and the other one as a client. 509 00:19:27,540 --> 00:19:30,270 Then, the iperf client is going to be sending 510 00:19:30,270 --> 00:19:32,130 data over to the server and the server 511 00:19:32,130 --> 00:19:34,590 is going to calculate how much and how fast that 512 00:19:34,590 --> 00:19:36,150 data has been getting there. 513 00:19:36,150 --> 00:19:37,920 This will help you ensure that the throughput that you're 514 00:19:37,920 --> 00:19:40,410 expecting is actually what you're receiving. 515 00:19:40,410 --> 00:19:41,820 To run the iperf command, 516 00:19:41,820 --> 00:19:44,880 type in iperf dash C if you're running it on the client 517 00:19:44,880 --> 00:19:48,390 or iperf dash S if you're setting it up on the server. 518 00:19:48,390 --> 00:19:50,910 Now, both the iftop and iperf utilities 519 00:19:50,910 --> 00:19:52,980 are really here to measure throughput, 520 00:19:52,980 --> 00:19:56,040 and there is a difference between throughput and bandwidth. 521 00:19:56,040 --> 00:19:58,860 Bandwidth is a potential amount of data that you could move 522 00:19:58,860 --> 00:20:01,320 through a network connection in a given amount of time. 523 00:20:01,320 --> 00:20:02,670 It's theoretical. 524 00:20:02,670 --> 00:20:05,340 But throughput is the amount of data that is actually moving 525 00:20:05,340 --> 00:20:06,240 through the network. 526 00:20:06,240 --> 00:20:07,440 And that's why we use utilities 527 00:20:07,440 --> 00:20:11,100 like iftop and iperf to measure that actual throughput to 528 00:20:11,100 --> 00:20:14,130 see where the slowdowns exist on your given network. 529 00:20:14,130 --> 00:20:14,963 For example, 530 00:20:14,963 --> 00:20:17,310 let's say you just went and ran all new cabling for your 531 00:20:17,310 --> 00:20:21,180 network using one gigabit per second Cat6 cabling. 532 00:20:21,180 --> 00:20:22,013 That's great, 533 00:20:22,013 --> 00:20:24,270 but if you're only getting 100 megabits per second, 534 00:20:24,270 --> 00:20:26,940 that means something is wrong, and by using these tools, 535 00:20:26,940 --> 00:20:28,740 you can identify where that's happening 536 00:20:28,740 --> 00:20:29,910 inside of your network, 537 00:20:29,910 --> 00:20:31,230 between different network segments 538 00:20:31,230 --> 00:20:33,420 or different network devices. 539 00:20:33,420 --> 00:20:35,250 Next, we have MTR. 540 00:20:35,250 --> 00:20:36,990 Now, the MTR utility is really 541 00:20:36,990 --> 00:20:39,300 a combination of ping and traceroute, 542 00:20:39,300 --> 00:20:41,790 but it has additional improvements that enable testing the 543 00:20:41,790 --> 00:20:43,830 quality of a network connection, too. 544 00:20:43,830 --> 00:20:46,410 The MTR command can also help you identify if there's 545 00:20:46,410 --> 00:20:49,410 packet losses or packet drops in your network. 546 00:20:49,410 --> 00:20:52,290 This can happen if one or more packets sent from a source 547 00:20:52,290 --> 00:20:54,720 aren't able to reach their intended destination. 548 00:20:54,720 --> 00:20:57,450 And this packet loss can actually cause latency because 549 00:20:57,450 --> 00:20:58,890 those packets are being queued 550 00:20:58,890 --> 00:21:01,770 for retransmission using the TCP protocol. 551 00:21:01,770 --> 00:21:03,180 If you're using UDP, 552 00:21:03,180 --> 00:21:05,070 that data will not be resent 553 00:21:05,070 --> 00:21:06,300 and that means the data is not 554 00:21:06,300 --> 00:21:08,490 going to be successfully transmitted at all. 555 00:21:08,490 --> 00:21:10,830 If you have a large number of lost packets, 556 00:21:10,830 --> 00:21:13,140 this is really an indicator that you have a network issue 557 00:21:13,140 --> 00:21:14,370 along your path. 558 00:21:14,370 --> 00:21:16,260 By identifying that the issue exists, 559 00:21:16,260 --> 00:21:18,750 we can then figure out where in the path it exists by 560 00:21:18,750 --> 00:21:22,410 using MTR, or traceroute, or other things like that. 561 00:21:22,410 --> 00:21:24,510 MTR will enable an administrator to find 562 00:21:24,510 --> 00:21:27,600 all those potential failures of those networking components 563 00:21:27,600 --> 00:21:29,940 and then figure out what percentage of packets are being 564 00:21:29,940 --> 00:21:32,820 dropped along the way at which points in the network. 565 00:21:32,820 --> 00:21:35,010 This will help us identify exactly which router 566 00:21:35,010 --> 00:21:37,260 or switch we need to look at first. 567 00:21:37,260 --> 00:21:39,900 To be able to run MTR, simply type in MTR, 568 00:21:39,900 --> 00:21:42,540 the options, and the host name that you want to reach. 569 00:21:42,540 --> 00:21:44,220 Next, we have ARP. 570 00:21:44,220 --> 00:21:46,470 ARP is the address resolution protocol 571 00:21:46,470 --> 00:21:49,860 and this is used to relate IP addresses to Mac addresses and 572 00:21:49,860 --> 00:21:52,350 do the conversion from layer two to layer three 573 00:21:52,350 --> 00:21:54,270 or layer three to layer two, 574 00:21:54,270 --> 00:21:57,000 depending on if you're doing ARP or reverse ARP. 575 00:21:57,000 --> 00:21:58,230 There's also an ARP command that 576 00:21:58,230 --> 00:21:59,490 administrators are going to run 577 00:21:59,490 --> 00:22:01,170 and that will help you discover information 578 00:22:01,170 --> 00:22:04,110 about known Mac addresses on a given system. 579 00:22:04,110 --> 00:22:07,320 If a computer has cached incorrect or outdated information, 580 00:22:07,320 --> 00:22:09,990 connectivity problems can happen and you can lose your 581 00:22:09,990 --> 00:22:12,090 connectivity to particular nodes. 582 00:22:12,090 --> 00:22:13,500 The ARP cache can be cleared 583 00:22:13,500 --> 00:22:15,270 as part of the troubleshooting process too 584 00:22:15,270 --> 00:22:16,950 using the ARP command. 585 00:22:16,950 --> 00:22:17,790 For example, 586 00:22:17,790 --> 00:22:20,760 if you want to delete a single address from your ARP table, 587 00:22:20,760 --> 00:22:24,390 you can do that by running ARP dash D and the IP address to 588 00:22:24,390 --> 00:22:26,130 clear the entry for that IP address 589 00:22:26,130 --> 00:22:28,200 that matches a given Mac address. 590 00:22:28,200 --> 00:22:29,850 Then, you could try pinging the host again 591 00:22:29,850 --> 00:22:31,740 and seeing if that fixes it. 592 00:22:31,740 --> 00:22:33,300 To be able to see your entire cache, 593 00:22:33,300 --> 00:22:35,430 simply type in ARP dash A 594 00:22:35,430 --> 00:22:38,250 and this will display all of the things in your cache. 595 00:22:38,250 --> 00:22:39,420 Anytime you want to run ARP, 596 00:22:39,420 --> 00:22:42,630 simply type in ARP and the options you want to use. 597 00:22:42,630 --> 00:22:44,460 Next, we have whois. 598 00:22:44,460 --> 00:22:46,470 The whois command is going to provide information 599 00:22:46,470 --> 00:22:48,450 on the internet DNS registrations 600 00:22:48,450 --> 00:22:50,220 for different organizations. 601 00:22:50,220 --> 00:22:52,140 This is useful if you're trying to learn or verify 602 00:22:52,140 --> 00:22:55,110 information regarding the ownership of a given domain name, 603 00:22:55,110 --> 00:22:57,900 including the contact information for an organization. 604 00:22:57,900 --> 00:23:00,270 To run whois, simply type in whois, 605 00:23:00,270 --> 00:23:02,010 the options, and the domain name, 606 00:23:02,010 --> 00:23:05,130 such as whois deontraining.com. 607 00:23:05,130 --> 00:23:07,710 Remember, when you're troubleshooting networking issues, 608 00:23:07,710 --> 00:23:09,570 you need to narrow the scope of the problem 609 00:23:09,570 --> 00:23:12,750 and then verify the IP address configuration on your system 610 00:23:12,750 --> 00:23:14,940 using the IP addr command. 611 00:23:14,940 --> 00:23:19,050 If the system has an IP address beginning with a 169.254 612 00:23:19,050 --> 00:23:20,550 dot something dot something, 613 00:23:20,550 --> 00:23:23,700 that means it failed to get a lease from the DHCP server 614 00:23:23,700 --> 00:23:25,560 and it doesn't have a valid IP address 615 00:23:25,560 --> 00:23:27,540 because that is an IP pop. 616 00:23:27,540 --> 00:23:28,380 In this case, 617 00:23:28,380 --> 00:23:31,020 you need to go troubleshoot your DHCP server or your 618 00:23:31,020 --> 00:23:34,200 connectivity between your system and the DHCP server. 619 00:23:34,200 --> 00:23:35,033 After that, 620 00:23:35,033 --> 00:23:38,010 you can attempt to renew your IP address using DHCP to see 621 00:23:38,010 --> 00:23:41,850 if you can then connect to the DHCP server and get a new IP. 622 00:23:41,850 --> 00:23:43,680 If you're using a static IP address, 623 00:23:43,680 --> 00:23:46,437 always make sure your static IP is properly typed in 624 00:23:46,437 --> 00:23:49,200 and that you don't have any typos or errors in it. 625 00:23:49,200 --> 00:23:52,230 If you want to test your latency, you can use tools like ping. 626 00:23:52,230 --> 00:23:54,870 If you want to test the connectivity from end to end, 627 00:23:54,870 --> 00:23:57,270 you can use ping or traceroute. 628 00:23:57,270 --> 00:24:00,060 If you need to test your bandwidth versus your throughput, 629 00:24:00,060 --> 00:24:03,210 you can use tools like iftop and iperf to test that 630 00:24:03,210 --> 00:24:06,090 connection from end to end and verify that you're actually 631 00:24:06,090 --> 00:24:08,340 getting the throughput you'd expect based on the bandwidth 632 00:24:08,340 --> 00:24:09,930 your system was designed for. 633 00:24:09,930 --> 00:24:10,763 If you're not, 634 00:24:10,763 --> 00:24:12,960 it could be an issue with the interface itself. 635 00:24:12,960 --> 00:24:15,270 Maybe you're only using a 100 megabit per second 636 00:24:15,270 --> 00:24:16,560 network interface card, 637 00:24:16,560 --> 00:24:17,790 but you're expecting to get 638 00:24:17,790 --> 00:24:19,620 one gigabit per second of traffic 639 00:24:19,620 --> 00:24:21,570 because you're on a Cat6 network. 640 00:24:21,570 --> 00:24:23,250 Those two things aren't going to work. 641 00:24:23,250 --> 00:24:25,410 To be able to make it go to one gigabit per second, 642 00:24:25,410 --> 00:24:27,630 you're going to have to replace that network interface card 643 00:24:27,630 --> 00:24:29,640 with a one gigabit adapter. 644 00:24:29,640 --> 00:24:31,800 This is the idea of how to use these general commands that 645 00:24:31,800 --> 00:24:34,830 we talked about in this lesson to test your connectivity, 646 00:24:34,830 --> 00:24:37,290 your latency, your bandwidth and throughput, 647 00:24:37,290 --> 00:24:38,790 as well as your name resolution 648 00:24:38,790 --> 00:24:40,380 to solve the issues you're seeing 649 00:24:40,380 --> 00:24:42,180 in a given troubleshooting scenario.