FrançaisGet started

Network diagnostic commands

ping, traceroute, ip addr, ip route, ip neigh, ss, dig and nc, with their Windows equivalents: what each command tests, how to read its output and in which order to run them, from the bottom up.

  • 29 cards
  • 4 topics
  • Free
Study this deck

The outline, topic by topic

Each topic is weighted the way the exam weighs it.

  1. Concepts
  2. Questions
  3. Sort and link
  4. Scenarios

A few cards from the deck

  • ping: what is it?

    Show the answer

    A command that sends ICMP echo requests to an address and prints, for each reply received, the round-trip time.

    A reply proves the round trip works as far as the host. On Linux, ping runs until stopped: -c 4 limits it to four probes, and the final summary gives the loss rate.

  • A host reaches nothing. What does this ip addr show eth0 output reveal?

    ```text
    2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::5054:ff:fe12:3456/64 scope link
    valid_lft forever preferred_lft forever
    `

    • The interface is up but has no IPv4 address
    • The cable is unplugged: the interface has no link
    • The card has no MAC address, so nothing can leave
    • The interface is disabled on the system side
    Show the answer

    The interface is up but has no IPv4 address

    state UP and LOWER_UP say the interface is enabled and the cable is plugged in; the MAC is shown; but there is no inet line: only the IPv6 link-local address exists. An IPv4 address is missing, from DHCP or by hand.

  • On Linux, … lists the interfaces and their addresses; its Windows equivalent is ….

    Show the answer

    On Linux, ip addr lists the interfaces and their addresses; its Windows equivalent is ipconfig.

    Plain ipconfig shows the address, mask and gateway; ipconfig /all adds the MAC address, the DNS servers and the DHCP state.

  • traceroute (Windows: tracert): what is it?

    Show the answer

    A command that reveals the routers crossed: it sends packets with an increasing TTL and records who answers "time exceeded" at each hop.

    A router that does not answer shows as * * *. If the stars continue to the end, the path stops there or the answer is filtered.

  • Here are three tests run from a host. What is the probable cause, and what next?

    ```text
    $ ping -c 1 192.168.1.1
    64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.9 ms
    $ ping -c 1 8.8.8.8
    64 bytes from 8.8.8.8: icmp_seq=1 ttl=116 time=14.2 ms
    $ ping -c 1 example.org
    ping: example.org: Temporary failure in name resolution
    `

    • The gateway is faulty: restart it, then test again
    • DNS is down: query the server with dig
    • The host has no route to the Internet: add a default route
    • example.org is down: wait for it to come back
    Show the answer

    DNS is down: query the server with dig

    The IP addresses answer, so the link, the address, the gateway and the route work. Only the name fails: the fault is at the DNS level. In bottom-up troubleshooting, the first step that fails points to the cause.

Study this deck