Network Tools

A methodology without tools is just theory. The troubleshooting approaches we've learned become actionable through a range of diagnostic utilities—from simple command-line programs available on every operating system to sophisticated packet analyzers that reveal exactly what's happening on the wire.

The right tool for the right job:

Master carpenters don't just own hammers—they have chisels, planes, saws, and dozens of specialized tools for specific tasks. Similarly, network engineers need a complete toolkit where each tool serves a distinct purpose:

• Connectivity testers tell you if you can reach a destination
• Path analyzers tell you how packets travel and where they stop
• Name resolution tools verify DNS is translating names correctly
• Protocol analyzers reveal what data is being exchanged
• Performance monitors show how well the network is performing
• Configuration utilities let you examine and modify network settings

Network tools can be organized into categories based on their primary function. Understanding these categories helps you quickly identify which tool to reach for when facing a specific problem.

The Troubleshooting Funnel:

As you progress through troubleshooting, you typically move from broad connectivity tests to focused protocol analysis—a funnel that narrows as you isolate the problem:

Ping is the most fundamental network diagnostic tool—so fundamental that 'can you ping it?' is often the first question in any troubleshooting session. Ping sends ICMP Echo Request messages and waits for Echo Reply responses. If replies return, basic network connectivity exists.

How Ping Works:

1. Your system sends an ICMP Echo Request packet to the target IP
2. The packet traverses the network (routers, switches, etc.)
3. The target receives the request and sends an ICMP Echo Reply
4. Your system receives the reply and measures the round-trip time (RTT)

Basic Usage:

Interpreting Ping Results:

Advanced Ping Techniques:

1. Progressive Ping Testing: Start from your local machine and ping progressively further:

ping localhost          # Test local TCP/IP stack
ping 192.168.1.1       # Test default gateway
ping 10.0.0.1          # Test core router
ping 8.8.8.8           # Test Internet reachability
ping target.example.com # Test final destination

Where ping first fails indicates the location of the problem.

2. Packet Size Testing: Large pings help detect MTU problems:

# Windows - test with 1472 bytes (1500 - 20 IP - 8 ICMP = 1472)
ping -f -l 1472 target.example.com

# Linux - same test
ping -M do -s 1472 target.example.com

If this fails but smaller packets succeed, there's an MTU issue in the path.

3. Ping Statistics: After multiple pings, examine statistics:

• Minimum RTT: Best-case latency (network capacity)
• Maximum RTT: Worst-case latency (congestion events)
• Average RTT: Typical latency
• Packet loss %: Reliability (> 1% is concerning, > 5% is problematic)

DNS problems are among the most common network issues. When 'the website doesn't work' but IP addresses work fine, DNS is usually the culprit. Several tools help diagnose DNS issues.

nslookup - Basic DNS Queries:

Available on Windows, Linux, and macOS, nslookup performs DNS lookups and allows you to query specific DNS servers.

dig - Domain Information Groper (Linux/macOS):

dig is more powerful and provides more detailed output than nslookup. It's the preferred tool for serious DNS debugging.

Interpreting DNS Results:

Windows DNS Utilities:

# Flush DNS cache
ipconfig /flushdns

# Display DNS cache
ipconfig /displaydns

# Register DNS (force re-registration)
ipconfig /registerdns

# Resolve-DnsName (PowerShell)
Resolve-DnsName www.example.com
Resolve-DnsName -Name example.com -Type MX
Resolve-DnsName -Name example.com -Server 8.8.8.8

Checking Local DNS Configuration:

# Linux - check resolver configuration
cat /etc/resolv.conf

# Check systemd-resolved status (modern Linux)
resolvectl status

# macOS - check DNS servers
scutil --dns

# Windows - check DNS servers
ipconfig /all | findstr DNS

Before testing connectivity to remote hosts, verify your local network configuration is correct. These tools show IP addresses, subnet masks, gateways, and interface status.

ipconfig (Windows):

What to Look For in Configuration Output:

Viewing Connection State with netstat/ss:

These tools show active network connections, listening ports, and network statistics.

When you can ping a server but the application doesn't work, the problem is often at the transport layer. Port and service testing tools verify that specific TCP/UDP ports are reachable and services are responding.

telnet - Classic TCP Port Testing:

Though telnet is primarily a remote terminal protocol, it's commonly used simply to test if a TCP port is open:

curl and wget - Application Layer Testing:

For HTTP/HTTPS services, curl and wget test not just port accessibility but actual protocol functionality:

When connectivity problems aren't explained by simple reachability tests, examining routing tables and ARP caches can reveal the underlying issue.

Viewing the Routing Table:

The routing table determines where packets are sent. Incorrect routes cause packets to go to the wrong place (or nowhere).

Reading the Routing Table:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 eth0
10.0.0.0        10.0.0.1        255.0.0.0       UG    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     100    0        0 eth0

• Destination 0.0.0.0 = Default route (used when no specific route matches)
• Gateway = Next hop router (0.0.0.0 means directly connected)
• Flags: U = Up, G = Gateway (not directly connected), H = Host route
• Iface = Which interface to use

Common routing problems:

• No default gateway → Can't reach external networks
• Wrong gateway → Packets sent to wrong router
• Missing specific route → Network unreachable for that destination
• Conflicting routes → Unpredictable behavior based on metric

ARP Cache - Layer 2 Resolution:

ARP (Address Resolution Protocol) maps IP addresses to MAC addresses. ARP problems prevent local network communication even when IP configuration is correct.

When simpler tools don't reveal the problem, protocol analyzers (packet sniffers/capture tools) show exactly what's happening on the wire. They capture network traffic and decode protocol details, revealing what's actually being transmitted.

Wireshark - The Industry Standard GUI Analyzer:

Wireshark is the most widely used protocol analyzer, offering deep protocol decoding and powerful filtering.

tcpdump/tshark - Command-Line Capture:

For servers without GUI or remote troubleshooting, command-line tools are essential.

Common Capture Filter Expressions:

We'll explore Wireshark and packet capture in much more detail in a dedicated section.