Tools that assist with network troubleshooting include:
Network Diagrams and Documentation
Network Documentation and Baseline Tools
Network Management Systems
Knowledge Bases
Protocol Analyzers

Sometimes failures in the lower layer of the O S I Model cannot be easily identified with software tools. In these instances, it may be necessary to use hardware troubleshooting tools, such as cable testers, multimeters, and network analyzers.

The Physical and the Data Link Layers encompass both hardware and software functions.
The Physical Layer, or Layer 1, is responsible for the physical and electrical specifications for the transmission of bits from one host to another over the physical medium, either wired or wireless.
Layer 1 Problems include:
Cable type, length and termination problems
Duplex mismatches
Interfaces and noise that disrupts transmissions
Device hardware and boot errors
Router interface errors are often the first symptom of Layer 1 and Layer 2 cabling or connectivity errors.
Devices L E D’s provide valuable troubleshooting information that can be used to identify the cause of connectivity issues.

The Data Link Layer, or Layer 2, specifies how the data is formatted for transmission over the network media. It also regulates how access to the network is granted. Layer 2 provides the link between the Network Layer software functions and the Layer 1 hardware for both LAN and WAN applications.
Layer 2 Problems include:
Encapsulation mismatches
No keepalives generated or received
Timing problems on WAN connections
The show version , show interfaces and show interface brief commands provide troubleshooting information to isolate and identify Layer 1 and Layer 2 issues.

The primary functions implemented at Layer 3 of the O S I Model are network addressing and routing.
Poorly designed and configured IP addressing schemes, especially overlapping subnet addresses, account for a large number of network performance problems.
Overlapping subnets can be caused by careless address assignment or by improperly configured subnet masks on devices.
Problems obtaining an IP address from a DHCP server can cause PC clients to automatically configure an address on the 169.254.0.0 network.
NAT configuration and operation issues can cause Internet sites to be unreachable from the privately addressed LAN.

Most networks have a number of different types of routes, including a combination of static, dynamic, and default routes.
Problems with routing can be the result of manual route entry errors, routing protocol configuration and operation errors, or failures at lower layers of the O S I Model.
The primary tool to use when troubleshooting Layer 3 routing problems is the show IP route command. The routing table consists of route entries from the following sources:
Directly connected networks
Static routes
Dynamic routing protocols
Problems that occur with RIPv2 routing include:
Version not specified causing version mismatch between routers.
Misconfigured or missing network statements
Improperly configured interface IP addresses

Layer 4 is responsible for transporting data packets and specifies the port number used to reach specific applications.
Firewall and port filtering rules that permit or deny the incorrect ports can cause needed services to be unreachable from client computers.
Upper Layer services include DNS name resolution, encryption and compression. Errors occurring with these functions can cause end-user applications to be unusable.
The Windows command nslookup can provide information to assist with troubleshooting DNS failures.

The Cisco Certified Entry Networking Technician (CCENT) certification validates the skills required for entry-level network support positions, the starting point for many successful careers in networking.
To obtain CCENT certification, a candidate must pass the ICND1 (640-822) examination which tests the ability to install, operate, and troubleshoot a small branch office network.
Cisco certifications measure and validate the networking skills of an individual based on how they interact with Cisco networking devices. Many exam tasks require the interpretation of Cisco I O S command output, especially the output of the various show commands.
Just like installing a network for a customer, exam preparation is more successful if it is broken down into a series of smaller steps:
One.Making the commitment.
Two.Creating a plan.
Three.Practicing test taking.

Authentication, authorization, and accounting (AAA) is a three-step process used to monitor and control access on a network. It requires a database to keep track of user credentials, permissions, and account statistics.
Digital encryption is the process of encrypting transmitted data between the clients and servers. Many protocols offer secure versions.
As a best practice, use the secure version of a protocol whenever the data being exchanged is meant to be confidential.

There are many security threats including D o S, DD o S, D R D o S attacks.
Port Filters and Access Lists are used to help protect against security threats.
Port filtering can restrict or allow traffic based on TCP or UDP port.
Access lists define traffic that is permitted or denied based on IP addresses as well as TCP or UDP ports.

A firewall is network hardware or software that defines what traffic can come into and go out of sections of the network.
I D S is a software- or hardware-based solution that passively listens to network traffic. It does not stop the initial traffic from passing through to the destination.
I P S is an active physical device or software feature. Traffic actually passes through I P S interfaces and the I P S can block all suspicious activity in real time.
A host-based firewall and Anti-X software runs directly on a host operating system and protects the host from malicious attacks that might have made it through all other layers of defense.

A service level agreement (SLA) is an agreement between a service provider and a service user that clearly documents the expectations and obligations.
ISP’s monitor and check connectivity of devices. They accomplish this through in-band or out-of-band management. In-band management is preferred for managing servers accessible on the network.

There are several backup solutions available including: tape, optical, hard disk, and solid state media.
There are also three methods of backing up data, including: full backup, differential backup, and incremental backup. A combination of all three backup methods is generally recommended.

A disaster recovery plan is a comprehensive document that describes how to restore operation quickly and keep a business running during or after a disaster occurs.
Assess the vulnerabilities, assess the risk, ensure management awareness, establish a planning group, and prioritize needs when creating a disaster recovery plan.

The native TCP/IP naming system relies on a file called a HOSTS file and contains the name and IP address of known hosts.
DNS is a hostname resolution system that solves the shortcomings of the HOSTS file for name resolution.
The structure of DNS is hierarchical and DNS database files are distributed among root, top-level domains, second level domains, and sub domains.

Dynamic Updates enable DNS client computers to register and dynamically update their resource records with a DNS server whenever changes occur.
DNS zones can be either Forward lookup, or Reverse lookup zones. They can also be either a primary or secondary zones.
Many ISP’s offer caching-only DNS servers.
An organization may run its own DNS server that can either point to the caching-only server or directly to the root server for name resolution.

The most common services that are used on the Internet include FTP, FTPS, SMTP, POP3, I MAP4, HTTP, and HTTPS.
HTTP and HTTPS are used for web server services; HTTPS is a secure version of HTTP which uses SSL.
An ISP supports HTTPS by providing high-performance web servers to support HTTPS encryption and decryption demands.

FTP is used for file transfer services. The ISP can support active and passive FTP connections. Active connections require the server to initiate the connection. Passive connection require the host to initiate the connection
Email utilizes three different protocols. SMTP is used to send email. POP3 and I MAP are both used to retrieve email.

Distance vector routing protocols calculate the direction and distance to any network. Routing tables and updates are sent periodically to neighbors.
Link state protocols update nodes with information on the state of the link. These routing protocols reduce routing loops and network traffic.
Choose the routing protocol for an organization based on ease of management, ease of configuration, and efficiency.

The Internet is divided up into collections of networks called autonomous systems.
Within an autonomous system, interior gateway routing protocols are used, such as RIP, E I G R P and O S P F.
Between autonomous systems, exterior gateway routing functions are required. Exterior Gateway Protocols (EGP’s) run on exterior routers, or border gateways, that are located at the border of an AS. The most common EGP is Border Gateway Protocol (BGP).

Diagram 4 text
BGP functions like a distance-vector protocol. From this database, direction and distance to a destination network are determined.
Exterior protocols enable traffic to be routed across the Internet to remote destinations.
Exterior protocols provide the method by which ISP’s can set and enforce policies and local preferences for traffic flow efficiency.

The Cisco Internetwork Operating System (IOS) software provides features that enable a Cisco device to send and receive network traffic using a wired or wireless network. Cisco IOS software is offered to customers in modules called images. These images support various features for businesses of every size.

Typically, the tools required to install a new device include:

PC with a terminal emulation program, such as HyperTerminal
Cable ties and a No. 2 Phillips screwdriver
Cables for WAN interfaces, LAN interfaces, and USB interfaces

Follow these steps to power up an 1841 ISR.

1. Securely mount and ground the device chassis, or case.
2. Seat the external compact flash card.
3. Connect the power cable.
4. Configure the terminal emulation software on the PC and connect the PC to the console port.
5. Turn on the router.
6. Observe the startup messages on the PC as the router boots up.
Out-of-band Management
Out-of-band management requires a computer to be directly connected to the console port or auxiliary port (AUX) of the network device being configured. This type of connection does not require the local network connections on the device to be active. Technicians use out-of-band management to initially configure a network device, because until properly configured, the device cannot participate in the network. Out-of-band management is also useful when the network connectivity is not functioning correctly and the device cannot be reached over the network. Performing out-of-band management tasks requires a terminal emulation client installed on the PC.

In-band Management
Use in-band management to monitor and make configuration changes to a network device over a network connection. For a computer to connect to the device and perform in-band management tasks, at least one network interface on the device must be connected to the network and be operational. Either Telnet, HTTP or SSH can be used to access a Cisco device for in-band management. A web browser or a Telnet client program can be used to monitor the network device or make configuration changes.
SDM Express simplifies the initial router configuration. It uses a step-by-step approach to create a basic router configuration quickly and easily.

The full SDM package offers more advanced options, such as:

Configuring additional LAN and WAN connections
Creating firewalls
Configuring VPN connections
Performing security tasks

The Basic NAT Wizard configures Dynamic NAT with PAT, by default. PAT enables the hosts on the internal local network to share the single registered IP address assigned to the WAN interface. In this manner, hosts with internal private addresses can have access to the Internet.

Only the hosts with the internal address ranges specified in the SDM configuration are translated. It is important to verify that all address ranges that need access to the Internet are included.

Steps for configuring NAT include:
Step 1. Enable NAT configuration using SDM.
Step 2. Navigate through the Basic NAT Wizard.
Step 3. Select the interface and set IP ranges.
Step 4. Review the configuration.

Point-to-Point
A point-to-point connection is a predefined communications path from the customer premises through a TSP network. It is a dedicated circuit with fixed bandwidth available at all time. Point-to-point lines are usually leased from the TSP. These lines are often called leased lines. Point-to-point connections are typically the most expensive of the WAN connection types, and are priced based on the bandwidth required and the distance between the two connected points. An example of a point-to-point WAN connection is a T1 or E1 link.

Circuit-Switched
A circuit-switched connection functions similarly to the way a phone call is made over a telephone network. When making a phone call to a friend, the caller picks up the phone, opens the circuit, and dials the number. The caller hangs up the phone when finished and the closes the circuit. An example of a circuit-switched WAN connection is an ISDN or dialup connection.

Packet-Switched
In a packet-switched connection, networks have connections into the TSP switched network. Many customers share this TSP network. Instead of the circuit being physically reserved from source to destination, as in a circuit-switched network, each customer has its own virtual circuit. A virtual circuit is a logical path between the sender and receiver, not a physical path. An example of a packet-switched network is Frame Relay.

Static
MAC addresses are manually assigned using the switchport port-security mac-address [mac-address] interface configuration command. Static MAC addresses are stored in the address table and added to the running configuration.

Dynamic
MAC addresses are dynamically learned and stored in the address table. The number of addresses learned can be controlled. By default, the maximum number of MAC addresses learned per port is one. Addresses that are learned are cleared from the table if the port is shutdown or if the switch is restarted.

Sticky
Similar to dynamic, except that the addresses are also saved to the running configuration.
Port security is disabled by default. If port security is enabled, a violation will result in the port being shutdown. For example, if dynamic port security is enabled and the maximum number of MAC addresses per port is one, the first address learned becomes the secure address. If another workstation attempts to access the port with a different MAC address, a security violation occurs.

IP addresses are hierarchical. A hierarchy is like a family tree with parents at the top and children connected to them below. For a network, this means that part of the 32-bit number identifies the network (parent), while the rest of the bits identify the host (child). In the early days of the Internet, there were so few organizations needing to connect to the Internet, that networks were assigned by only the first 8 bits (first octet) of the IP address. This left the remaining 24 bits to be used for local host addresses.

To create more possible network designations, the 32-bit address space was organized into five classes. Three of these classes, A, B, and C, provide addresses that can be assigned to individual hosts or networks. The other two classes, D and E, are reserved for multicast and experimental use.

In addition to creating separate classes, the Internet Engineering Task Force (IETF) decided to reserve some of the Internet address space for use by private networks. Private networks have no connection to public networks. Private network addresses are not to be routed across the Internet. This allows multiple networks in various locations to use the same private addressing scheme without creating addressing conflicts.

In the original IP address hierarchy, there are two levels: a network and a host. In a classful addressing scheme, the first three leading bit values are used to determine that an IP address is either a Class A, B, or C. When an address is identified by class, the number of bits that make up the network ID and the number of bits that make up the host ID are known. The default subnet masks for the network classes are:

Class A 255.0.0.0
Class B 255.255.0.0
Class C 255.255.255.0

Subnetting solved a number of problems that existed with the original classed network address spaces. It permitted organizations that owned a class A, B, or C address to subdivide their address space into smaller local subnets to more efficiently assign addresses. However, subnetting is also important in helping to minimize traffic loads and for adding security measures between networks.

Variable length subnet masking (VLSM) helps to solve this issue. VLSM addressing allows an address space to be divided into networks of various sizes. This is done by subnetting subnets. To accomplish this, routers today must receive routing information that includes the IP address of the network, and the subnet mask information which indicates the number of bits that make up the network portion of the IP address. VLSM saves thousands of IP addresses that would be wasted with traditional classful subnetting.

In addition to VLSM, Classless Inter-Domain Routing (CIDR) was proposed in RFC 1519 and accepted. CIDR ignores network classes based on the value of the high-order bits. CIDR identifies networks based solely on the number of bits in the network prefix, which corresponds to the number of 1s in the subnet mask. An example of an IP address written using CIDR notation is 172.16.1.1/16, where the /16 represents the number of bits in the network prefix.

Network Address Translation (NAT) must be enabled on the device connecting the private network to the ISP network.

NAT allows a large group of private users to access the Internet by sharing one or more public IP addresses. Address translation is similar to how a telephone system works in a company. As a company adds employees, at some point, they no longer run a public phone line directly to each employee desk. Instead, they use a system that allows the company to assign each employee an extension number. The company can do this because not all employees use the phone at the same time. Using private extension numbers enables the company to purchase a smaller number of external phone lines from the phone company.

A site survey provides the network designer important information and creates a proper starting point for the project. It shows what is already on site, and gives a good indication as to what is needed.

Number of users and types of equipment
Projected growth
Current Internet connectivity
Application requirements
Existing network infrastructure and physical layout
New services required
Security and privacy considerations
Reliability and uptime expectations
Budget constraints

It is a good idea to obtain a floor plan, if possible. If a floor plan is not available, the technician can draw a diagram indicating the size and location of all rooms. An inventory of existing network hardware and software is also useful to provide a baseline of requirements for the upgrade.

Both the physical and logical topology of the network must be documented. A physical topology is the actual physical location of cables, computers, and other peripherals. A logical topology documents the path that data takes through the network and where network functions, like routing, occur. A technician gathers this information during the site survey to create the physical and logical topology map.

A network upgrade requires extensive planning. Just like any project, a need is identified and then a plan outlines the process from beginning to end. A good project plan helps identify any strengths, weaknesses, opportunities, or threats (SWOT). The plan clearly defines the tasks, and the order in which the tasks are to be completed.

When the existing cabling is not up to specification for the new equipment, new cabling must be planned for and installed. The condition of the existing cabling can quickly be determined by the physical inspection of the network during the site visit. When planning the installation of network cabling, there are four physical areas to consider:

There are three different types of twisted pair cables that are used in networks:

Straight-through – Connects dissimilar devices, such as a switch and a computer, or a switch and a router.
Crossover – Connects similar devices, such as two switches or two computers.
Console (or Rollover) – Connects a computer to the console port of a router or switch to do initial configuration.

Patch cable – Short cable from the computer to the wall plate in the user work area
Horizontal cable – Cable from the wall plate to the IDF in the distribution area
Vertical cable – Cable from the IDF to the MDF in the backbone area of the business
Backbone cable – Network part that handles the major traffic
Location of wiring closet – Area to concentrate the end-user cables to the hub or switch
Cable management system – Trays and straps used to guide and protect cable runs
Cable labeling system – Labeling system or scheme to identify cables
Electrical considerations – Outlets and other items to support the electrical requirements of the network equipment
When selecting a switch for a particular LAN, there are a number of factors to consider. These factors include, but are not limited to:

Speed and the types of ports and interfaces involved
Expandability
Manageability
Cost
The plan should include every device that requires an IP address, and account for future growth. The hosts and network devices that require an IP address include:

User computers
Administrator computers
Servers
Other end devices such as printers, IP phones, and IP cameras
Router LAN interfaces
Router WAN (serial) interfaces

Level 1 is for immediate support handled by junior-level help desk technicians.
Level 2 handles calls that are escalated to more experienced telephone support.
Level 3 is for calls that cannot be resolved by phone support and require a visit by an on-site technician.

When a user initially contacts the help desk to resolve an issue, the call or message is usually directed to a Level 1 support technician. Level 1 support is usually an entry-level position that provides junior technicians with valuable experience. Many customer issues are resolved by the Level 1 support technician.

Issues that cannot be resolved are sent to Level 2 support, which typically has fewer agents available. The duties and responsibilities of the Level 2 technician are similar to that of the Level 1 technician, but they are at a higher skill level. These agents are expected to solve problems that are more challenging and require more knowledge.

The help desk technician must be able to stay focused in an environment with frequent interruptions and perform multiple tasks efficiently and accurately. It can be difficult to consistently maintain a positive attitude and provide a high level of service. The help desk technician has to have excellent interpersonal skills and effective communication skills, both oral and written. The technician must be able to work independently and as part of a team.

While many issues can be handled remotely, some problems require an on-site visit to the customer premises to install and troubleshoot equipment. When a technician goes on-site, it is important to represent their organization in a professional manner. A professional knows how to make the customer feel at ease and confident in the technician’s skills.

When a network connectivity problem is reported to the help desk, many methods are available to diagnose the problem. One common method is to troubleshoot the problem using a layered approach. A layered approach requires that the network technician be familiar with the various functions that occur as messages are created, delivered, and interpreted by the network devices and hosts on the network.

The OSI model also provides a systematic basis for troubleshooting a network. In any troubleshooting scenario, the basic problem-solving procedure includes the following steps:

1. Define the problem.
2. Isolate the cause of the problem.
3. Solve the problem.

Identify and prioritize alternative solutions.
Select one alternative as the solution.
Implement the solution.
Evaluate the solution.

Step 1. Provide proper identification to the customer.
Step 2. Review the trouble ticket or work order with the customer to verify that the information is correct.
Step 3. Communicate the current status of any identified problems and the actions the technician expects to take at the customer site that day.
Step 4. Obtain permission from the customer to begin the work.

Dialup access
Dialup access is an inexpensive option that uses any phone line and a modem. To connect to the ISP, a user calls the ISP access phone number. Dialup is the slowest connection option, and is typically used by mobile workers and in areas where higher speed connection options are not available.

DSL
Digital subscriber line, or DSL, is more expensive than dialup, but provides a faster connection. DSL also uses telephone lines, but unlike dialup access, DSL provides a continuous connection to the Internet. This connection option uses a special high-speed modem that separates the DSL signal from the telephone signal and provides an Ethernet connection to a host computer or LAN.

Cable modem
A cable modem is a connection option offered by cable television service providers. The Internet signal is carried on the same coaxial cable that delivers cable television to homes and businesses. A special cable modem separates the Internet signal from the other signals carried on the cable and provides an Ethernet connection to a host computer or LAN.

Satellite
Satellite connection is an option offered by satellite service providers. The user’s computer connects through Ethernet to a satellite modem that transmits radio signals to the nearest Point of Presence, or POP, within the satellite network.

Bandwidth is measured in bits per second (bps). Higher bandwidth speeds are measured in kilobits per second (kbps), megabits per second (Mbps), or gigabits per second (Gbps).

T1 connections transmit data up to 1.544 Mbps. T1 connections are symmetrical, meaning that the upload bandwidth is the same as the download bandwidth. A medium-sized business may need only one T1 connection. E1 is a European standard that transmits data at 2.048 Mbps.
T3 connections transmit data up to 45 Mbps. Although considerably more expensive than a T1 connection, larger businesses may need a T3 connection to accommodate the number of employees. Large businesses with multiple locations might use a combination of T1 and T3 lines. E3 is a European standard that transmits data at 34.368 Mbps.
Metro Ethernet offers a wide range of high-bandwidth options, including Gbps links. Large companies with many branches in the same city, such as banks, use Metro Ethernet. Metro Ethernet connects the main office location and all the branches using switched technology. Metro Ethernet allows the transfer of large amounts of data faster and less expensively than other high-bandwidth connection options.