4.3 DNS, Network Protocols, Ports, and CLI Troubleshooting Tools

4.3 DNS, Network Protocols, Ports, and CLI Troubleshooting Tools

Quick Summary: Resolving client connectivity issues requires mastering the Domain Name System (DNS), recognizing core transport port numbers, and executing command-line diagnostics. Support technicians use a structured command sequence—ipconfig, ping, tracert, nslookup, netstat, and arp—to pinpoint whether a failure stems from the local OS stack, physical cabling, gateway routing, or name resolution.

---

The Domain Name System (DNS)

While network equipment routes traffic using numerical IP addresses, humans interact with networks using memorable domain names (e.g., www.cisco.com). The Domain Name System (DNS) is an internationally distributed, hierarchical database that translates Fully Qualified Domain Names (FQDNs) into routable IP addresses (and vice versa).

The Hierarchical DNS Structure

DNS is structured like an inverted tree:

                                    [ Root Domain: . ]
                                      /     |      \
                              [ .com ]   [ .org ]   [ .edu ]  (Top-Level Domains)
                                /           |
                        [ cisco.com ]  [ wikipedia.org ]      (Second-Level Domains)
                          /       \
                 [ www.cisco.com ] [ vpn.cisco.com ]          (Subdomains / Hosts)

1. Root Zone (.): The apex of the hierarchy, managed by 13 physical root server IP clusters positioned globally. When a local resolver does not know an address, it begins queries at the root.
2. Top-Level Domain (TLD) Servers: Manage extensions such as generic TLDs (.com, .org, .net, .edu, .gov) and country-code TLDs (.uk, .ca, .de). TLD servers point queries to the authoritative servers for specific registered domains.
3. Authoritative Name Servers: The ultimate source of truth for a specific organization's domain. Holds the master DNS zone files and published resource records.
4. Recursive Resolvers: Systems (typically hosted by the ISP or corporate IT) that accept DNS queries from client workstations, traverse the DNS hierarchy, cache the retrieved answers, and return results to clients.

Core DNS Resource Record Types

---

Essential Protocols and Standard Port Numbers

Network services rely on port numbers (ranging from 0 to 65535) to multiplex communications across a single IP address. Ports 0–1023 are Well-Known Ports reserved for privileged system services.

---

Windows CLI Diagnostic Utilities

Command-line utilities provide technicians with rapid, verifiable data to isolate network faults without relying on graphical interfaces.

1. ipconfig (IP Configuration)

Displays all current TCP/IP network configuration values, refreshes DHCP leases, and manages DNS caches.

C:\> ipconfig /all

Windows IP Configuration
   Host Name . . . . . . . . . . . . : DESKTOP-TECH4
   Primary Dns Suffix  . . . . . . . : corp.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No

Ethernet adapter Ethernet0:
   Connection-specific DNS Suffix  . : corp.local
   Description . . . . . . . . . . . : Intel(R) Ethernet Connection I219-LM
   Physical Address. . . . . . . . . : 00-1A-2B-3C-4D-5E
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.10.4.112(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Monday, September 7, 2026 8:15:00 AM
   Lease Expires . . . . . . . . . . : Tuesday, September 8, 2026 8:15:00 AM
   Default Gateway . . . . . . . . . : 10.10.4.1
   DHCP Server . . . . . . . . . . . : 10.10.1.10
   DNS Servers . . . . . . . . . . . : 10.10.1.10, 10.10.1.11

• ipconfig: Quick summary of IPv4/IPv6 address, subnet mask, and default gateway for active adapters.
• ipconfig /all: Full detailed diagnostic view, including Physical Address (MAC), DHCP lease timestamps, DHCP server IP, and DNS server IPs.
• ipconfig /release: Sends a DHCPRELEASE message to the DHCP server, surrendering the current IP address and clearing network settings (IP becomes 0.0.0.0).
• ipconfig /renew: Transmits a DHCPREQUEST to obtain a fresh lease from the DHCP server.
• ipconfig /flushdns: Empties and resets the contents of the local client DNS resolver cache. Crucial when a server IP has changed but the client continues connecting to a stale cached IP address.

2. ping (Packet Internet Groper)

Tests Layer 3 network connectivity using Internet Control Message Protocol (ICMP) Echo Requests (Type 8) and listens for Echo Replies (Type 0).

C:\> ping 10.10.4.1

Pinging 10.10.4.1 with 32 bytes of data:
Reply from 10.10.4.1: bytes=32 time=1ms TTL=64
Reply from 10.10.4.1: bytes=32 time<1ms TTL=64
Reply from 10.10.4.1: bytes=32 time=1ms TTL=64
Reply from 10.10.4.1: bytes=32 time=1ms TTL=64

Ping statistics for 10.10.4.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 1ms, Average = 0ms

• Continuous Ping (ping -t <host>): Pings the target continuously until interrupted with Ctrl + C. Used to monitor network recovery while re-seating cables or rebooting switches.
• Packet Count (ping -n <count> <host>): Specifies the number of echo requests to send.

The Systematic 5-Step Ping Troubleshooting Hierarchy

When a user reports complete loss of network and Internet access, the technician executes ping tests in a strict logical sequence to isolate the exact point of failure:

[ Step 1: ping 127.0.0.1 ]  --> Verifies local TCP/IP protocol stack & OS driver
          │ (Success)
[ Step 2: ping Local IP ]    --> Verifies local NIC hardware & adapter binding
          │ (Success)
[ Step 3: ping Default GW ]  --> Verifies local physical cable, switchport, & LAN link
          │ (Success)
[ Step 4: ping 8.8.8.8 ]     --> Verifies router forwarding, NAT, & external WAN routing
          │ (Success)
[ Step 5: ping hostname ]    --> Verifies DNS name resolution

1. ping 127.0.0.1: If loopback fails, the operating system TCP/IP stack is corrupt (remedy: netsh int ip reset).
2. ping <Host's Own IP> (e.g., 10.10.4.112): If this fails, the local network interface card is disabled, unseated, or has a driver failure.
3. ping <Default Gateway> (e.g., 10.10.4.1): If this fails, the issue is on the local segment (bad patch cord, dead wall jack, unpatched switch port, wrong VLAN, or router interface down).
4. ping <External Public IP> (e.g., 8.8.8.8): If this fails but the gateway responded, the local LAN is fine, but the border router, NAT engine, or ISP connection is down.
5. ping <Hostname> (e.g., ping google.com): If pinging 8.8.8.8 succeeds but pinging google.com fails with "could not find host", the IP network is completely functional, but DNS name resolution is failing.

3. tracert (Windows) / traceroute (macOS/Linux)

Determines the exact hop-by-hop path packets travel to reach a destination. tracert works by sending packets with incrementing TTL (Time to Live) values (starting at TTL=1). Each router along the path decrements the TTL by 1; when TTL hits 0, the router drops the packet and sends back an ICMP Time Exceeded (Type 11) message, revealing its IP address and round-trip latency.

C:\> tracert 8.8.8.8

Tracing route to dns.google [8.8.8.8] over a maximum of 30 hops:
  1    <1 ms    <1 ms    <1 ms  10.10.4.1
  2     1 ms     1 ms     1 ms  192.168.100.1
  3     8 ms     7 ms     8 ms  198.51.100.254
  4     *        *        *     Request timed out.
  5    12 ms    11 ms    12 ms  dns.google [8.8.8.8]

Trace complete.

• Three response times are measured for each router hop.
• Asterisks (* * * Request timed out) indicate a router that drops ICMP traffic or represents the exact point where a connection drops.

4. nslookup (Name Server Lookup)

Queries DNS servers directly to verify name resolution and inspect specific DNS resource records.

C:\> nslookup intranet.corp.local
Server:  dc01.corp.local
Address:  10.10.1.10

Name:    intranet.corp.local
Address:  10.10.3.50

• Query Specific Server: nslookup hostname 8.8.8.8 directs the query to a specific DNS server (e.g., Google Public DNS), bypassing local DNS to verify whether an issue is local to the internal server.
• Interactive Mode: Entering nslookup without arguments enters interactive mode, where technicians can specify query types (e.g., set type=mx to find mail records, or set type=txt to inspect SPF records).

5. netstat (Network Statistics)

Displays active TCP connections, ports on which the computer is listening, Ethernet statistics, and routing tables.

C:\> netstat -ano

Active Connections
  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       844
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       1220
  TCP    10.10.4.112:51420      52.96.166.130:443      ESTABLISHED     3816

• -a: Displays all active connections and listening ports.
• -n: Displays addresses and port numbers in numerical format (prevents slow DNS name lookups).
• -b: Displays the executable binary file involved in creating each connection (requires running command prompt as Administrator).
• -o: Displays the Process ID (PID) associated with each connection (can be matched in Task Manager to isolate rogue applications or malware).

6. arp -a (Address Resolution Protocol Table)

Displays the host's current ARP cache table, showing mapped Layer 3 IPv4 addresses to physical Layer 2 MAC addresses learned on the local network segment. Useful for detecting IP conflicts and identifying hardware MAC addresses of connected routers and local servers.

---

IPv6 and Linux Connectivity Commands

Exam topic 3.3 names eight commands explicitly, and the IPv6 and Linux members of that list are the ones technicians most often overlook. A dual-stack host can have a perfectly healthy IPv4 path and a broken IPv6 path at the same time, so the IPv4 tools alone cannot prove connectivity.

ping6 — ICMPv6 Reachability

ping6 is the IPv6 counterpart to ping, sending ICMPv6 Echo Requests instead of ICMPv4. On modern Windows and on many current Linux builds, ping auto-selects the protocol from the address family, but macOS and older Linux distributions keep ping6 as a separate binary, and Cisco lists it as its own command.

# Reach an IPv6 host by name
ping6 -c 4 ipv6.example.com

# Ping a link-local address - the interface MUST be specified after %
ping6 -c 4 fe80::1a2b:3c4d:5e6f:7a8b%en0

The link-local trap is the exam-relevant detail. Link-local addresses (fe80::/10) are only unique within a single link, so the host cannot know which interface to use. A ping6 to an fe80:: address without a zone index — %en0 on macOS, %eth0 on Linux, %12 on Windows — fails with "no route to host" even though the neighbour is perfectly reachable. This connects directly to the DHCPv6 troubleshooting in the addressing section: a host holding only a link-local address received no global address from DHCPv6 or router advertisements, which is the IPv6 equivalent of an APIPA address.

traceroute6 — IPv6 Path Discovery

traceroute6 maps the IPv6 hop sequence, incrementing the Hop Limit field (the IPv6 name for IPv4's TTL) to elicit an ICMPv6 Time Exceeded from each router along the path. Its output is read exactly like traceroute: consecutive timeouts starting at a given hop localise the fault to that segment, while timeouts at a single intermediate hop followed by successful later hops usually mean that one router simply deprioritises ICMP.

traceroute6 ipv6.example.com

Running traceroute and traceroute6 to the same dual-stack destination is the fastest way to prove the problem is protocol-specific: if the IPv4 path completes and the IPv6 path dies at the first hop, the fault is the local IPv6 gateway or router advertisement, not the remote site.

iproute2: ip add, ip route, and ss

Modern Linux distributions ship the iproute2 suite, which replaces the deprecated net-tools commands. Technicians who only know ifconfig and netstat will find them missing on a current minimal server install.

# Interface state and both address families
ip add

# Just one interface, brief output
ip -br add show eth0

# Routing table - the "default via" line is the default gateway
ip route

# Listening TCP and UDP sockets with numeric ports and owning process
ss -tulnp

How to read ip add for a support call. The flags in angle brackets carry the diagnosis. <BROADCAST,MULTICAST,UP,LOWER_UP> means the interface is administratively up and has physical link. UP without LOWER_UP means the OS enabled the interface but there is no carrier — an unplugged or dead cable, or a disabled switch port. No inet line at all means the interface never obtained an IPv4 address, pointing at DHCP; an inet6 fe80::… line with no global inet6 means IPv6 autoconfiguration failed.

ss is the direct replacement for netstat and is substantially faster on busy hosts because it reads kernel socket data directly. ss -tulnp is the standard "what is listening, and which process owns it" query — the Linux equivalent of netstat -abno on Windows, and the first command to run when a service is reachable locally but refuses external connections.

---

Help Desk Scenario: The "Website Not Loading" Ticket

A customer service agent calls the help desk stating: "The entire Internet is down on my computer. I cannot open our cloud CRM system."

1. Triage & Isolation: The technician establishes a remote command session and executes the ping sequence:
   • ping 127.0.0.1 -> Replies in <1ms (TCP/IP stack healthy).
   • ping 10.10.4.1 (Default Gateway) -> Replies in 1ms (Physical link and local switch operational).
   • ping 8.8.8.8 (Public Internet IP) -> Replies in 14ms (WAN routing and Internet uplink functional).
   • ping crm.cloudapp.com -> Returns: "Ping request could not find host crm.cloudapp.com. Please check the name and try again."
2. DNS Verification: The technician runs nslookup crm.cloudapp.com and observes that the local DNS server (10.10.1.10) fails to respond with a query timeout.
3. Resolution: The technician inspects ipconfig /all and notices the primary DNS server was misconfigured to an decommissioned domain controller (10.10.1.10). The technician points the adapter to the active DNS server (10.10.1.15), runs ipconfig /flushdns, and re-tests. The browser loads the cloud application immediately.