Study Notes for the N10-009 Certification Exam
1. Introduction to Network Troubleshooting
Network troubleshooting involves identifying, diagnosing and resolving problems affecting network connectivity, configuration, security and performance.
Network administrators use software tools, command-line utilities, hardware testing equipment and commands built into routers and switches to investigate faults.
This course covers:
- Protocol analyser tools
- Windows command-line utilities
- Common Linux commands
- Physical network testing tools
- MAC address tables
- Routing tables
- Interface information
- Startup and running configurations
- Address Resolution Protocol (ARP)
- Virtual LANs (VLANs)
- Power over Ethernet (PoE)
The key skill is knowing which tool or command to use, what information it provides and how that information helps isolate a problem.
2. Using Protocol Analyser Tools
What is a protocol analyser?
A protocol analyser captures and examines network packets or frames travelling over wired or wireless connections.
It helps administrators understand how devices communicate and identify problems such as failed requests, unexpected traffic and communication errors.
Common protocol analyser tools
Wireshark
Wireshark is a widely used network protocol analyser. It captures and displays network packets, allowing administrators to inspect communication between devices.
Microsoft Network Monitor
Microsoft Network Monitor is another packet-capture and analysis tool referenced in the course.
Packet capture
A packet capture records network traffic for examination. Captured information may include:
- Source and destination addresses
- Protocol information
- Packet and frame details
- Communication requests and responses
- Payload data, depending on the protocol and encryption
Encrypted protocols protect their payloads, so captured traffic does not necessarily reveal the underlying application data in readable form. Some metadata may still be visible.
Port mirroring
A switch normally forwards traffic according to its switching rules. A monitoring computer connected to an ordinary switch port may not see traffic between other devices.
Port mirroring configures a switch to copy selected traffic to a monitoring port, allowing a protocol analyser to inspect it.
Using filters
Packet captures can contain large amounts of information. Filters help isolate the traffic relevant to the investigation.
For example, a DNS filter can help an administrator examine DNS queries and responses when investigating name-resolution problems.
When should you use a protocol analyser?
Use a protocol analyser when you need to:
- Investigate unexpected network communication.
- Examine DNS requests and responses.
- Inspect retransmissions or communication failures.
- Determine whether packets reach the expected destination.
- Analyse protocol behaviour in greater detail than basic connectivity tools allow.
Exam tip: Wireshark is appropriate when you need detailed packet-level evidence rather than just a basic connectivity result.
3. Using the Windows Command Line
Windows includes several commands that help diagnose IP addressing, connectivity, routing, name resolution and active network connections.
3.1 ipconfig
The ipconfig command displays network adapter configuration information.
Typical information includes:
- IP address
- Subnet mask
- Default gateway
Example:
ipconfig
For more detailed configuration information, use:
ipconfig /all
This is useful when checking whether a computer has received the expected network configuration.
3.2 ipconfig /release and ipconfig /renew
These commands help refresh a DHCP-assigned IPv4 address.
Release the current DHCP lease:
ipconfig /release
Request a new DHCP configuration:
ipconfig /renew
Use these commands when investigating a suspected DHCP addressing problem. Releasing an address temporarily removes the relevant IPv4 configuration, so do this with care on a computer that depends on its current connection.
3.3 ipconfig /flushdns
This command clears the local Windows DNS resolver cache.
ipconfig /flushdns
It can help when a computer appears to be using outdated cached DNS information.
It does not repair an unavailable DNS server or incorrect DNS records at their source.
3.4 ping
Ping tests whether a destination responds to ICMP Echo Requests and reports round-trip timing when replies are received.
Example:
ping 192.168.1.1
A useful troubleshooting sequence is to test:
- The local TCP/IP stack, such as the loopback address
127.0.0.1. - The computer's own configured IP address.
- The default gateway.
- A remote IP address.
- A hostname, to include name resolution in the test.
The results help narrow down where a connectivity problem may exist. However, some devices block ICMP, so a failed ping does not always prove that a device or service is unavailable.
3.5 tracert
The Windows tracert command traces the route towards a destination.
tracert example.com
It displays the network hops encountered along the route and can help investigate routing problems or delays.
A hop that does not respond may be filtering or deprioritising traceroute probes rather than failing to forward normal traffic.
3.6 arp -a
This command displays the local ARP cache, which contains learned mappings between IPv4 addresses and MAC addresses.
arp -a
It is useful when investigating local-network address resolution.
3.7 netstat -ano
This command displays network connections and listening endpoints, together with numeric addresses and process identifiers.
netstat -ano
The options mean:
-
-a: Displays active connections and listening ports. -
-n: Displays addresses and port numbers numerically. -
-o: Includes the owning process ID (PID).
The PID can help you identify which process is associated with a connection by checking it against Windows process information.
Windows command revision table
| Command | Main purpose |
|---|---|
ipconfig |
Display IP configuration |
ipconfig /all |
Display detailed adapter configuration |
ipconfig /release |
Release a DHCP-assigned IPv4 address |
ipconfig /renew |
Request DHCP configuration again |
ipconfig /flushdns |
Clear the local DNS resolver cache |
ping |
Test IP reachability and round-trip timing |
tracert |
Examine the route towards a destination |
arp -a |
Display cached IP-to-MAC mappings |
netstat -ano |
Display connections, listening endpoints and PIDs |
Exam tip: Be prepared to match each command to the problem it investigates.
4. Common Linux Commands
Linux systems provide similar troubleshooting capabilities, although the commands and their options may differ from Windows.
4.1 ifconfig
The course identifies ifconfig as a Linux command used to display and configure network adapter settings.
ifconfig
It can show information such as interface addresses and status.
Unlike Windows ipconfig, which is primarily used to display IP configuration, Linux ifconfig has historically supported both display and configuration operations.
Note that modern Linux distributions commonly use the ip command, and ifconfig may not be installed by default.
4.2 tcpdump
tcpdump captures network packets for analysis.
Example:
sudo tcpdump -i eth0
The -i option specifies the network interface to capture on. The interface name will vary by system.
To save captured traffic in a PCAP file:
sudo tcpdump -i eth0 -w capture.pcap
PCAP files can be opened in Wireshark for more detailed analysis.
Use packet captures responsibly because they may contain sensitive information.
4.3 iptables
iptables manages firewall rules on Linux systems using the relevant packet-filtering framework.
It can be used to allow or block traffic according to configured rules.
Example:
sudo iptables -L
This lists firewall rules.
Important: Rule order and the chain in which a rule appears can affect how traffic is handled. Incorrect firewall changes can disrupt legitimate network communication.
4.4 nmap
nmap is a network discovery and port-scanning tool.
Example:
nmap 192.168.1.10
It can help identify reachable hosts and exposed ports and services, depending on the scan and target configuration.
Administrators may use it to investigate unexpected services or monitor authorised network assets.
Only scan systems and networks you are authorised to assess.
4.5 dig
dig queries DNS servers and displays DNS responses.
Example:
dig example.com
It can help investigate hostname resolution and inspect DNS record information.
The course compares dig with Windows nslookup, as both can be used to query DNS.
Linux command revision table
| Command | Main purpose |
|---|---|
ifconfig |
Display or configure network interfaces on supported systems |
tcpdump |
Capture network packets |
iptables |
Inspect or manage Linux firewall rules |
nmap |
Discover hosts and examine ports and services |
dig |
Query DNS and inspect responses |
5. Common Network Hardware Tools
Software commands cannot diagnose every network fault. Physical testing tools help investigate cables, wiring, electrical continuity and signal quality.
5.1 Cable tester
A cable tester checks the wiring and continuity of network cables.
It can identify problems such as:
- Open connections
- Incorrect pin wiring
- Reversed or miswired pairs
- Continuity failures
Use a cable tester when a suspected Ethernet cable fault causes an unreliable or failed connection.
5.2 Multimeter
A multimeter measures electrical values such as voltage and resistance.
It can help check power supplies and electrical continuity, depending on the measurement being performed.
Examples include:
- Measuring AC or DC voltage.
- Checking resistance.
- Testing continuity on suitable circuits.
Use the correct measurement mode and follow electrical safety procedures.
5.3 Toner and probe
A toner and probe kit helps identify and trace cables.
The toner sends a signal through a cable, and the probe detects that signal so the cable can be located among other cables.
This is especially useful when tracing cables through racks, patch panels or cable bundles.
5.4 Reflectometer
A reflectometer examines cable characteristics by analysing signals travelling through the medium and their reflections.
Depending on the type of reflectometer, it can help locate cable faults or assess signal behaviour.
Examples include:
- Time-domain reflectometer (TDR): Helps locate faults and discontinuities in metallic cables.
- Optical time-domain reflectometer (OTDR): Used with fibre-optic links to investigate signal loss and locate events along the fibre.
Hardware tool comparison
| Tool | Main use |
|---|---|
| Cable tester | Check cable wiring and continuity |
| Multimeter | Measure voltage, resistance and suitable continuity |
| Toner and probe | Trace and identify cables |
| TDR | Locate faults in metallic cables |
| OTDR | Investigate fibre-optic links and signal loss |
Exam tip: If the problem is physical rather than logical, choose a tool designed to test the physical medium.
6. Using the MAC Address Table
What is a MAC address table?
A switch maintains a MAC address table, sometimes called a forwarding database, to record learned MAC addresses and the ports associated with them.
When a device sends a frame, the switch can learn the source MAC address and associate it with the incoming port and VLAN.
The table helps the switch forward Ethernet frames towards the correct destination port.
The show mac-address-table command
On supported Cisco-style network devices, the command is used to display learned MAC address entries.
show mac address-table
The precise syntax varies by platform and software version; the course refers to show mac-address-table.
The table can help you investigate:
- Which switch port has learned a device's MAC address.
- Whether a device is appearing on an expected port.
- Whether MAC entries have been learned in the relevant VLAN.
- Whether entries are disappearing or moving unexpectedly.
MAC address ageing
Learned dynamic MAC entries can age out when the switch has not received frames from the relevant source for the configured ageing period.
An entry disappearing does not necessarily mean the device has failed; it may simply have been inactive.
MAC addresses and routers
MAC addresses are used for communication on a local Layer 2 network segment.
When a router forwards an IP packet to another network, it removes the incoming Layer 2 framing and creates new Layer 2 framing for the outgoing link.
Therefore, the destination MAC address on the next link is normally the next-hop device's MAC address, not the original remote host's MAC address.
Key distinction: IP addresses identify endpoints at the network layer; MAC addresses are used for local-link delivery.
7. Displaying the Routing Table
What is a routing table?
A routing table contains information that a router uses to decide where to forward IP packets.
Routes may be learned from:
- Directly connected networks
- Static route configuration
- Dynamic routing protocols
The show ip route command
On Cisco-style routers, use:
show ip route
This displays the IPv4 routing table.
Directly connected networks normally appear when the relevant interfaces are configured and operational.
For a destination network that is not directly connected, the router needs a suitable route, such as a static route or one learned through a routing protocol.
Static routing
A static route is manually configured by an administrator.
It can be suitable for simple or predictable network paths, but the administrator must maintain the routes when the topology changes.
Dynamic routing and RIP
The course demonstrates the Routing Information Protocol (RIP) as an example of a dynamic routing protocol.
Routers running a compatible and correctly configured routing protocol can exchange routing information and learn networks beyond their directly connected interfaces.
For RIP to work, the participating routers need suitable interface addressing, protocol configuration and network statements. Merely enabling RIP without correct configuration does not guarantee connectivity.
Troubleshooting routing problems
- Display the routing table.
- Confirm that the destination network has a suitable route.
- Check the relevant interfaces and their status.
- Verify static route or dynamic routing configuration.
- Test connectivity to the next hop and destination.
Exam tip: If two devices on different IP networks cannot communicate, check routing information as well as interface status and addressing.
8. Displaying Interface Information
The show interfaces command
The command displays information about router or switch interfaces.
show interfaces
It helps administrators inspect interface status, traffic levels and errors.
Important interface information
- Physical status: Whether the interface's physical connection is operational.
- Line protocol status: Whether the interface's data-link protocol is operational.
- Input and output packet counts: Show traffic handled by the interface.
- Errors: May indicate physical faults, transmission problems or other interface issues.
- Collisions: Can provide evidence of problems on relevant Ethernet links, especially legacy or incorrectly configured shared/half-duplex environments.
- Interface resets: May indicate instability or repeated resets.
- MTU: The maximum transmission unit used by the interface.
- Bandwidth: A configured or reported interface bandwidth value, depending on platform; it is not necessarily a live measurement of available throughput.
- Load and reliability: Platform-reported indicators that help assess interface conditions.
Physical and protocol status
Interface status often reports two conditions: the physical interface state and the line protocol state.
A physical connection may be present while the line protocol is down. This suggests that the administrator should investigate the data-link layer, configuration or the condition of the link beyond basic physical connectivity.
Using traffic to test an interface
Generating test traffic, such as ping, can help determine whether input and output packet counters change.
Compare counters before and after testing, and examine whether errors increase.
Exam tip: show interfaces is valuable for checking link status, errors, traffic counters and other interface health indicators.
9. Displaying Startup Configuration Information
Routers and switches commonly maintain an active configuration and a saved configuration.
Running configuration
The running configuration represents the configuration currently active on the device. On Cisco-style devices, it is held in RAM.
Display it with:
show running-config
A shorter form is:
show run
Startup configuration
The startup configuration is the saved configuration used when the device boots.
Display it with:
show startup-config
A shorter form is:
show start
Saving configuration changes
Changes made to the running configuration may be lost after a reboot if they have not been saved.
On Cisco-style devices, save the running configuration to the startup configuration using:
copy running-config startup-config
The abbreviated form is:
copy run start
Why this matters
Imagine an administrator fixes a VLAN configuration and confirms that devices can communicate. If the change is not saved, the device may return to its previous configuration after a reboot.
Configuration comparison
| Configuration | Purpose | Stored in |
|---|---|---|
| Running configuration | Configuration currently active | RAM |
| Startup configuration | Saved configuration loaded at startup | Non-volatile memory |
Exam tip: If a configuration change works but disappears after a reboot, check whether it was saved to the startup configuration.
10. Using Common ARP Commands
What is ARP?
The Address Resolution Protocol (ARP) maps an IPv4 address to a MAC address on a local network.
When a host needs to send an IPv4 packet to another device on its local subnet, it may need to discover the destination device's MAC address.
If the destination is on another network, the host generally resolves the MAC address of its default gateway instead.
ARP tables
An ARP table stores learned IP-to-MAC address mappings.
These entries are populated as devices communicate and can expire according to the system's cache rules.
Windows command
arp -a
This displays the local computer's ARP cache.
Cisco-style router command
show arp
This displays ARP entries on supported router platforms.
Troubleshooting ARP
ARP information can help when investigating:
- Local IPv4 communication problems.
- Unexpected IP-to-MAC mappings.
- Whether an entry has been learned.
- Possible address-resolution problems.
An absent entry may simply mean that the device has not communicated recently or that the entry has expired.
ARP versus MAC address tables
| ARP table | MAC address table |
|---|---|
| Maps IPv4 addresses to MAC addresses | Maps learned MAC addresses to switch ports and VLANs |
| Used for IPv4 address resolution | Used for Ethernet frame forwarding |
Commonly inspected with arp -a or show arp
|
Commonly inspected with a MAC address-table command |
Exam tip: ARP answers “Which MAC address corresponds to this local IPv4 address?” A switch MAC address table answers “On which port and VLAN was this MAC address learned?”
11. Displaying VLAN Configurations
What is a VLAN?
A Virtual LAN (VLAN) logically separates devices into different Layer 2 broadcast domains, even when they use the same physical switch infrastructure.
VLANs are commonly used to separate departments, voice traffic, guest access or other groups of devices.
Devices in different VLANs generally need Layer 3 routing to communicate with one another.
The show vlan command
On supported Cisco-style switches:
show vlan brief
This displays VLAN information, often including VLAN IDs, names, status and associated access ports.
The course refers to the show vlan command; the exact command and output depend on the device.
Default VLAN configuration
In the course's example, a default switch has its ports assigned to VLAN 1. This means that, unless configuration changes have been made, those ports may share the same VLAN.
VLANs and IP subnets
VLANs and IP subnets are different concepts, but networks commonly assign a distinct IP subnet to each VLAN.
Correct VLAN assignment and IP addressing are important for local communication and routing.
Trunk links
A trunk link carries traffic for multiple VLANs over a single physical connection, using VLAN tagging where supported.
This allows a switch to connect to another switch or a router while transporting traffic for multiple VLANs.
Router subinterfaces
In a router-on-a-stick configuration, a router uses logical subinterfaces on a physical interface to handle traffic for different VLANs.
Each subinterface is configured for the relevant VLAN and IP network. The router can then route traffic between VLANs, subject to routing and access-control configuration.
VLAN troubleshooting checklist
- Check which VLAN the relevant switch port belongs to.
- Verify that the expected VLAN exists and is active.
- Check whether the connected device has suitable IP addressing.
- Inspect trunk configuration when multiple VLANs must cross a link.
- Verify router subinterfaces or other Layer 3 routing configuration.
- Review access control lists if routing exists but traffic is blocked.
Exam tip: If devices in different VLANs cannot communicate, verify both VLAN configuration and inter-VLAN routing.
12. Displaying Power Information for Interfaces
What is Power over Ethernet?
Power over Ethernet (PoE) allows supported network equipment to provide electrical power to compatible devices over Ethernet cabling.
Common PoE-powered devices include:
- IP phones
- Wireless access points
- Some security cameras
PoE can reduce the need for separate power supplies at the connected device.
The show power inline command
On supported Cisco-style switches, use:
show power inline
This displays information about PoE capability and consumption.
Depending on the platform, the output may include:
- Total available PoE power
- Power allocated to connected devices
- Per-port power usage
- Remaining power budget
- Port-level power limits or status
Why PoE information matters
A switch may have working data connectivity but fail to power a connected device if its PoE capability, port settings or available power budget is insufficient.
For example, if an IP phone does not power on, the administrator can inspect the port's PoE status and available power before replacing the device.
Troubleshooting PoE issues
- Confirm that the switch and port support PoE.
- Check the connected device's power requirements.
- Inspect the port's power status.
- Review the switch's total PoE budget and remaining capacity.
- Check cabling and port condition.
- Confirm whether the device receives power after any corrective action.
Exam tip: Use show power inline to investigate power delivery from a compatible switch to PoE-powered devices.
13. Practical Troubleshooting Scenarios
Scenario 1: A computer cannot connect to the network
Symptoms: A user reports that their computer has no network connectivity.
Suggested approach:
- Run
ipconfigto inspect the IP address, subnet mask and default gateway. - If DHCP addressing appears incorrect, investigate DHCP and consider renewing the lease.
- Ping the loopback address and then the computer's own address.
- Ping the default gateway.
- Use
tracertto investigate the route towards a remote destination if appropriate. - Review ARP information if local address resolution is suspected.
The results help narrow down whether the problem involves local configuration, the gateway, address resolution or the route beyond the local network.
Scenario 2: A hostname does not resolve
Symptoms: A user can reach some destinations by IP address but cannot access a service using its hostname.
Suggested approach:
- Test IP connectivity with
ping, where ICMP is permitted. - Use
digornslookupto query DNS. - Inspect the response and determine whether the expected record is returned.
- On Windows, consider
ipconfig /flushdnsif stale local cache data is suspected. - If necessary, use Wireshark to inspect DNS requests and responses.
Flushing the local cache will not fix an incorrect DNS record or an unavailable DNS server.
Scenario 3: A device cannot communicate with devices in another VLAN
Symptoms: Devices communicate within their own VLAN but cannot reach a different VLAN.
Suggested approach:
- Use
show vlanto inspect port assignments. - Confirm the relevant VLANs exist and are active.
- Check the trunk link if traffic must cross between switches or reach a router.
- Verify router subinterfaces or other Layer 3 interfaces.
- Inspect the routing configuration and any applicable access control lists.
The problem may be caused by VLAN membership, trunk configuration, missing routing or traffic filtering.
Scenario 4: An IP phone does not power on
Symptoms: An IP phone connected to a switch does not start.
Suggested approach:
- Check the Ethernet cable and switch port.
- Confirm that the port and switch support PoE.
- Run
show power inline. - Inspect the available power budget and per-port power information.
- Verify that the phone is compatible and that its power requirements can be met.
This avoids assuming that a failed phone is necessarily faulty when the problem may be power delivery.
Scenario 5: A router loses configuration after restarting
Symptoms: A network change works initially but disappears after a reboot.
Suggested approach:
- Run
show running-configto inspect the active configuration. - Run
show startup-configto inspect the saved configuration. - Compare the relevant settings.
- If the intended configuration is active and validated, save it using
copy running-config startup-config.
This ensures the intended configuration is saved for the next startup.
14. Essential Command Revision Sheet
| Command | Platform or context | Purpose |
|---|---|---|
ipconfig /all |
Windows | Detailed IP configuration |
ipconfig /release |
Windows | Release a DHCP-assigned IPv4 address |
ipconfig /renew |
Windows | Renew DHCP configuration |
ipconfig /flushdns |
Windows | Clear the local DNS cache |
ping |
Windows/Linux | Test reachability and round-trip timing |
tracert |
Windows | Trace the route towards a destination |
arp -a |
Windows | Display ARP cache entries |
netstat -ano |
Windows | Display connections, listening endpoints and PIDs |
ifconfig |
Linux, where available | Display or configure interface settings |
tcpdump |
Linux/Unix-like systems | Capture packets |
iptables -L |
Linux, where applicable | List firewall rules |
nmap |
Linux/other supported platforms | Discover hosts and examine ports |
dig |
Linux/Unix-like systems | Query DNS |
show mac-address-table |
Supported switches | Inspect learned MAC addresses and ports |
show ip route |
Cisco-style routers | Display the IPv4 routing table |
show interfaces |
Cisco-style routers/switches | Inspect interface state and counters |
show running-config |
Cisco-style devices | Display the active configuration |
show startup-config |
Cisco-style devices | Display the saved startup configuration |
show arp |
Supported routers | Display ARP entries |
show vlan brief |
Supported switches | Inspect VLANs and access-port membership |
show power inline |
Supported PoE switches | Inspect PoE power information |
Note: Commands and syntax can vary by operating system, device vendor and software version. Use the syntax supported by the equipment being examined.
15. Final Exam Revision Checklist
Before taking the CompTIA Network+ N10-009 exam, ensure you can:
- [ ] Explain why and when to use Wireshark and packet capture.
- [ ] Explain port mirroring and the role of packet filters.
- [ ] Match Windows commands to IP, DNS, connectivity and connection problems.
- [ ] Explain the purposes of
tcpdump,iptables,nmapanddig. - [ ] Distinguish cable testers, multimeters, toner probes and reflectometers.
- [ ] Explain what a switch MAC address table records.
- [ ] Interpret the purpose of a routing table.
- [ ] Identify useful interface counters and status information.
- [ ] Distinguish running configuration from startup configuration.
- [ ] Explain how ARP maps IPv4 addresses to MAC addresses.
- [ ] Explain VLANs, trunk links and inter-VLAN routing.
- [ ] Explain how to investigate PoE power problems.
- [ ] Select suitable commands for realistic troubleshooting scenarios.
Conclusion
Effective network troubleshooting requires more than memorising commands. It requires selecting the right tool, understanding the information returned and using the evidence to narrow down the fault.
For the Network+ N10-009 exam, focus on three things: the purpose of each command, the information it reveals and the networking problem it helps investigate. Practise applying these tools to real scenarios so that you can choose the appropriate troubleshooting method confidently.
Top comments (0)