All right, let's take a look at Module 16,
which deals with network troubleshooting.
Troubleshooting in general is meant to
find the source of a problem and correct it.
Finding issues in a computer network and diagnosing them for the purpose of
eradicating the issue and hopefully not allowing it to recur.
Some things we're going to look at as far as network troubleshooting goes, typical
network issues, physical connection issues, loose connection of cables, faulty
crips on cable ends, things like that, unplugged cables, connectivity issues,
network failure or faulty configuration of ports or interfaces in land and WAN, which
may affect the connectivity of the host server.
Configuration issues, misconfigurations of DHCP and DNS settings,
causing routing issues that result in communication failure.
Software issues, incompatible software
inversion mismatch, which could lead to the disruptions of transmission of IP data
packets, traffic overload issues, just too much traffic, denial service conditions,
your behavior changes when traffic exceeds the capacity of the network devices,
things slow down, and again, that gives you denial of service.
Network IP issues, improper IP configurations will get you every time.
That's one of the first things you're going to look at.
Subnet mask routing of the source,
resulting in the interruption of communication with the destination IP.
Basic network issues.
First order of business, unreachable networks.
I just can't get to it.
The first thing you're going to check is connectivity.
Icmp, Internet Control Messaging Protocol,
is a really useful protocol with a variety of message types and then codes which
further define why you got the message type.
There's several different ICMP message types, each with a specific purpose, and a
lot of them can be misused for malicious activities, footprinting and
reconnaissance, pack in this treating attacks, denial services, etc.
A lot of times ICMP is filtered,
so the results you get from some ICMP tests may be unreliable.
We'll look at some alternatives for that
around scanning discovery tools like NMAP, a little bit later in the module.
An ICMP destination unreachable message is
sent when the host or port is unreachable or the network is unreachable.
There's actually 14 different codes on why
you could get an ICMP destination unreachable.
Communication, administrative, prohibited,
firewall, destination network, unknown, destination host, port, don't
fragment it's set and needs to be fragmented, etc.
That is one type, it's a Type 3 message.
You would also potentially just use a ping request.
A ping request, an echo request is a Type 8, an echo reply is a Type 0.
We also lay out a little bit on the structure of an ICMP packet.
You have the type, you have the code, you have the checksum, parameters, and data.
Some ICMP packets actually carry a payload, so the echo request, echo reply,
for example, contains alphabetic characters, numeric characters, and it's
different based on the operating system that's actually sending the ping request.
All right, ping is also somewhat reliable
due to the fact it's been heavily misused over the years for things like denial of
service attacks, and quite often it is filtered at perimeter devices.
Or host base firewalls reject echo request packets and don't respond.
So as far as checking connectivity goes,
it may or may not be indicative of the absence of connectivity.
There's other ways you can ping.
You can send TCP SIM packets, TCP Act packets, UDP packets.
There's actually several ways to do
discoveries without using ECHO request, Echo replies.
Few different flavors of ICMP, and a few different flavors of TCP and UDP.
Basic network issues, destination unreachable message.
I actually cover this in the previous slide.
If a data gram cannot be forwarded to its
destination, you return a destination unreachable message indicating to the
sender that the data gram could not be properly forwarded.
And again, it's for a variety of reasons.
Fragmentation is necessary.
Don't fragment bit of set.
It can't be forwarded.
You have administrative prohibitive and so forth.
Destiny unreachable messages can also be
generated if IP related services like FTP or web services are unavailable.
So again, variety of reasons why you might get a destination unreachable message.
Time exceeded message.
Every IP packet has a death counter on it.
Call that a TTL or time to live value.
That time to live value is decremented
every time that packet changes hands, takes a hop, crosses a router.
When an IP device
routes that packet, it ticks down the death counter by one,
and when that death counter ticks down to zero, it gets discarded.
The whole idea here is to keep packets from bouncing around endlessly in
cyberspace and routing loops and just go on forever.
So eventually, that's supposed to be a PacMan sound, the packet expires, it dies.
The system that decrepited the TTL to zero sends back a time exceeded
message to the sender letting them know, Hey, your packet died in transit.
So the TTL values can actually be manipulated in things like trace routing,
which we're going to talk about here shortly.
But again, here's the layout of the message type.
Here's the header for time exceeded.
There's no port numbers in ICMP, so it doesn't get that high.
Icmp is a layer 3 protocol.
Tcps and UDPs are both layer 4, so you
don't really take into account any port numbers.
But we can use those upper layer protocols to do similar discoveries.
Basic network issues.
You might have an IP parameter problem,
not something you run into a lot, but it's a Type 12.
This error doesn't relate to the state of the destination host or network, but it
still prevents the data gram from being processed and delivered.
It's a Type 12 parameter problem message sent to the source of the data gram.
Again, that's not one you see very frequently.
Icp control messages.
Control messages, unlike error messages,
are not the result of lost packets or error conditions.
Instead, they're used to inform hosts of conditions like network congestion or
existence of a better gateway to the remote network.
This one right here, that's a little bit dangerous.
The first flavor of ICMP control message
we're going to talk about, and actually have a slide for it, is an ICMP redirect.
The ICMP redirect is used by routersto
inform a setting host, Hey, I'm not the right gateway for that.
You should really send your packets here instead.
They redirect the traffic
to another gateway or another IP address which can be used to optimize network
transmissions and just inform an unaware host that there's a better route for it.
Or they could be spoofed by an attacker to
cause packet mistreating types of attacks where they're specifying a malicious box
as the router and then using that as a man in the middle.
There's a couple of different reasons why you get ISMP redirects.
Those should generally be disregarded.
Then there's also an ISMP source quench.
Ismp source quenches can also be used to redirect traffic.
We don't have a slide that's dedicated for it, so we'll talk about it quickly.
But the redirect is definitely the more notable of the two.
Higher propensity for misuse.
Troubleshooting network issues, IP problems.
The steps for troubleshooting IP related issues are to use tools, locate the
devices that raise an issue in the path of communication, check the physical
connections between the source and the destination.
Land connectivity faults can raise network connectivity issues.
At each intermediate hop, check whether the router is working
and ensure the proper configuration of settings on the devices.
Troubleshooting network issues.
If the network cable is unplugged, it indicates the computer is not detecting
the Ethernet connection correctly, which may be a loose cable, may be a bad wire,
may be a lack of a connection on the other side.
Your potential solutions are to restart the computer, check the Ethernet network
cable, change the Ethernet adapter's duplex settings, which usually that's auto
negotiated, disable the Ethernet network adapter or update the adapter driver.
Our troubleshooting network issues.
Network path cannot be found.
The issue of network path not found may
arise because the network connection doesn't exist.
Network security settings do not allow sharing.
And with the computer, which the connection is to be established is too
long or the connection of the system is blocked by firewall or antivirus software.
Our troubleshooting, verify the shared
drive, ping the IP address of the remote machine, modify your network settings,
reinstall the network adapter drivers, enable net bios over TCPIP if it's
required, rename the computer or disable the firewall.
Physical connectivity issues.
Steps to try to troubleshoot physical
connectivity issues, check for cable connectivity, check suitable cables are
used for connections between devices, loose connections to be avoided.
If there are no loose connections, check
for old cables and replace them with new ones.
Try to connect the device.
If the problem persists, it may be a faulty port issue.
One of the best ways to check is to swap things out with a known working, known
good device, which does not mean one that's brand new out of the box, one you
have personally witnessed working on another system.
Our check for faulty ports, check for traffic overload.
Our troubleshooting network issues, local connectivity issues.
All right, ping the destination, ping the Gateway IP.
If your pings fail, check the route fault
is followed by the subject mask is defined correctly in the routing table.
If everything is fine, check if the source is pinging your hop router in the network.
If the ping fails, it could be a
configuration issue or an IP address conflict.
Resolve any IP address conflict by disconnecting the doubtful device and
pinging it with other devices on the network.
If the device is pinging, then disconnected device was using the same IP
as the ping device, modify the IP according to plan, potentially.
Steps to troubleshooting physical routing issues.
The trace route utility.
Trace route sends out sequentially incrementing TTL values starting with one
to two to three to four, and it allows you to determine exactly which router drops
the packet, builds a list of routers along the way.
When you start seeing timeouts, that's most likely your failure to make.
Use the trace route utility.
If the issue persists, investigate each
hop router to find where the problem has occurred.
When the problematic hopper routers is
detected, login using Telnet, ping the destination source.
If that's unsuccessful, reconfigure your routes.
Check for a routing loop by pinging again.
If that exists, rectify it by tracing and
reconfiguring the routing or check the routing protocol.
If the problem persists, change it according to the network.
All right, common issues in upper layer faults.
You might have restrictions based on
firewalls blocking the flow of incoming and outgoing traffic.
The fix for that might be to move the host
in the network such that it bypasses the firewall blocking the traffic.
Server or service shutdown, replace the server or rebuild it.
Authentication process issue, resulting in
inability to access the service between the host and server.
Use software to deploy checks for
authentication related issues and issues with software compatibility, upgrade the
devices so they're compatible and have the same version.
Wireless network connection issues.
Number one, check whether WiFi is enabled on the device.
If the problem persists, check and change the service set identifier and access
points to allocate the requesting device and IP address.
Use Windows network diagnostics tool to troubleshoot the network related issue.
That does a pretty good job.
Or restore the router to its factory settings and restart it.