This objective covers the technical tools, software utilities, and hardware diagnostic appliances you will use to gather evidence and fix real-world networking problems.
CompTIA tests this by presenting a specific technical symptom and asking, “Which tool or switch command should the technician use next to isolate the root cause?”
1. Software Tools & Command Line Utilities
When troubleshooting from a workstation or management console, command-line utilities provide immediate visibility into system parameters, configuration details, and packet data.
Core CLI Utilities
- ipconfig / ifconfig / ip: Displays the device’s current network interface settings.
ipconfig(Windows) reveals your local IPv4/IPv6 address, subnet mask, and default gateway. Runningipconfig /flushdnsclears out the local DNS cache.ifconfig(Legacy Linux/Unix) orip address(Modern Linux) provides identical interface states and hardware configuration statistics.
- ping: Uses ICMP (Internet Control Message Protocol) Echo Requests and Echo Replies to verify baseline network Layer 3 availability. It tells you whether a remote target is online and reports the round-trip latency.
- traceroute (Linux) / tracert (Windows): Maps out the exact hop-by-hop physical path a packet takes to reach a remote destination. It increments the Time-to-Live (TTL) counter in packet headers to force every intermediate router along the path to drop the packet and send back an ICMP Timeout message, helping you pinpoint exactly which upstream ISP router is dropping traffic or introducing high latency.
- arp: Displays or modifies the operating system’s local Layer 2-to-Layer 3 address cache (
arp -a). You use this to verify whether your computer has learned the correct physical MAC address for a local gateway or server IP, which is vital for spotting ARP spoofing attacks. - netstat: Displays all active network connections, listening ports, and routing statistics on the local computer host. Running
netstat -anwill show you exactly what external malicious or internal authorized IP addresses are established onto your local system ports.
Name Resolution (DNS) Tools
- nslookup: The classic, universal command-line utility for querying DNS servers to test name resolution. You can specify a hostname to find its IP address, or input an IP address to test a reverse lookup.
- dig (Domain Information Groper): The modern, robust alternative to
nslookupon Linux/Unix systems. It returns highly granular, detailed text outputs from DNS zone records, including precise query response times, flags, and TTL metrics.
Deep Packet & Vulnerability Sweepers
- Protocol Analyzer (Wireshark): A graphical software tool that captures raw, granular packet frames crossing a network interface down to the individual binary bits of the payload data. It is used for advanced troubleshooting, protocol debugging, and deep security analysis.
- tcpdump: A lightweight, command-line packet capture utility natively built into Linux/Unix systems. It performs identical functions to Wireshark but runs directly inside a text terminal, making it ideal for capturing traffic remotely on headless servers or firewalls before exporting the
.pcapfile for visual analysis. - Nmap (Network Mapper): A highly powerful network scanner used for security auditing and asset discovery. It sweeps entire subnets to find active hosts, identifies which TCP/UDP ports are open or closed, detects the operating system version a server is running, and flags known configuration vulnerabilities.
Automated Layer 2 Discovery & Speed Tests
- LLDP / CDP (Link Layer Discovery Protocol / Cisco Discovery Protocol): Neighbor discovery protocols that operate at Layer 2. If you plug a server or router into an unknown switch port, running
show cdp neighborsorshow lldp neighborsallows the device to talk to the adjacent port and display the exact hardware model, port number, management IP, and software version of the switch on the other end of the cable without requiring any IP configuration.- CDP: Cisco proprietary.
- LLDP: Open IEEE 802.1AB standard.
- Speed Tester: Web-based or command-line execution utilities (like
iperfor Speedtest CLI) that flood a link with data to measure real-world throughput capacity, upload/download speed parameters, jitter values, and packet loss rates.
2. Hardware Diagnostic Tools
When software utilities fail because a link is dead, physical hardware tools are used to test cables, light paths, and radio frequencies.
- Toner Probe (Fox and Hound): Used to trace an unidentified wire through walls or find where it terminates inside a massive patch panel. You clip the Tone Generator onto one end of the copper line, which injects an audible electrical signal. You then wave the handheld inductive Amplifier Probe across the patch panel ports; when it gets close to the matching wire, it plays a loud, high-pitched buzz.
- Cable Tester: A hardware tool used to check the structural integrity of a cable. It verifies that the pinouts match perfectly on both ends (e.g., detecting a split pair or crossed wires) and reports whether an individual copper strand within the sheath is snapped, shorted, or broken.
- Taps (Network Tap): A physical hardware box spliced directly into a live network cable link. It duplicates 100% of the raw physical traffic passing between two devices and mirrors it via a third diagnostic interface to feed a protocol analyzer. Unlike port mirroring, a hardware tap is completely invisible to the network and guarantees zero packet drops, even if the link reaches saturation.
- Wi-Fi Analyzer: A handheld hardware device or a specialized mobile software suite used to audit wireless environments. It scans the airwaves to chart active SSIDs, map wireless signal strength (RSSI), measure local signal-to-noise ratios, and flag channel-overlap anomalies.
- Visual Fault Locator (VFL): A high-power, specialized laser flashlight used to test fiber optic lines. You clip it to one end of a delicate glass fiber strand. If the core is bent too sharply or broken inside the jacket, the bright red laser light will bleed through the protective plastic shielding at the exact point of failure, showing you exactly where the strand is damaged.
3. Basic Networking Device Commands (Switch/Router CLI)
CompTIA expects you to recognize the precise output of these fundamental Cisco-style interface validation commands used during a diagnostic session.
show mac-address-table- What it reveals: The Layer 2 mapping database of the switch. It lists every physical MAC address the switch has learned along with the exact physical port number (
Gig0/1,Fast0/5) it is communicating through. Essential for isolating MAC flooding attacks or verifying VLAN assignments.
- What it reveals: The Layer 2 mapping database of the switch. It lists every physical MAC address the switch has learned along with the exact physical port number (
show route(orshow ip route)- What it reveals: The active Layer 3 routing table of the router or Layer 3 switch. It displays the default gateway (
0.0.0.0/0), directly connected networks, static routes, and dynamically learned protocol maps (OSPF/EIGRP paths).
- What it reveals: The active Layer 3 routing table of the router or Layer 3 switch. It displays the default gateway (
show interface- What it reveals: The physical operational vitals of a specific port. It reports whether the interface is line-up/protocol-up, its speed and duplex state, and tracks real-time interface error counters (CRC errors, runts, giants, and dropped packets).
show config(orshow running-config)- What it reveals: The active configuration file currently running in the device’s volatile RAM. Shows active firewall rules, port assignments, administrative accounts, and protocol configurations.
show arp- What it reveals: The device’s current Layer 3-to-Layer 2 mapping table. Shows what local IP addresses correspond to what physical MAC addresses.
show vlan- What it reveals: The active VLAN database status. It lists every configured VLAN ID number and its text name, and shows exactly which physical switch ports are assigned to which specific access VLANs.
show power(orshow power inline)- What it reveals: The Power over Ethernet (PoE) status dashboard. It shows the switch’s total wattage budget capacity, exactly how many watts each plugged-in IP phone or camera is actively drawing, and tracks whether any port has failed to boot due to an exceeded power budget.
Tools & Protocol Selection Study Matrix
| Scenario / Troubleshooting Need | Best Tool to Use | Operational Core Focus |
| Trace an unlabeled cable back to an IDF rack. | Toner Probe | Physical Layer line tracking via audible signals. |
| Find which ISP router is dropping packets. | traceroute / tracert | Layer 3 path auditing via incremental TTLs. |
| Determine whether port 443 on the server is open. | Nmap | Port scanner and vulnerability discovery. |
| Verify if a glass fiber cable is fractured. | Visual Fault Locator | Optical laser leakage diagnostic testing. |
| Identify what switch model is on a wire. | LLDP / CDP | Layer 2 neighbor protocol discovery. |
| Check if a switch port has high CRC packet errors. | show interface | Hardware interface statistic counter validation. |
| Isolate random, erratic drops between two IPs. | show arp / arp -a | Verifying Layer 2-to-Layer 3 address cache integrity. |