CompTIA's structured seven-step process for identifying, theorizing, testing, resolving, and documenting network problems.
CompTIA’s seven-step troubleshooting methodology structures network problem-solving in a repeatable, defensible order: identify the problem, establish a theory of probable cause, test the theory to determine cause, establish a plan of action, implement the solution or escalate, verify full system functionality, and document findings, actions, outcomes, and lessons learned. The N10-009 exam tests this sequence precisely, so the ordinal position of each step matters. A common trap is placing documentation anywhere but last, or skipping verification after a fix. Verification differs from testing the theory: testing confirms the root cause, while verifying confirms the broader system works correctly afterward.
A tool that sends ICMP echo requests to test reachability and round-trip time to a host.
Ping sends ICMP Echo Request packets to a target IP or hostname and waits for ICMP Echo Reply packets. The output reports round-trip time in milliseconds and packet loss percentage, useful for diagnosing latency and reachability. Windows defaults to four packets; Linux and macOS run continuously until interrupted. The key exam distinction: a host can answer ping yet still have a broken application, so ping confirms only Layer 3 connectivity, not service health. Conversely, no reply does not always mean the host is down — security policies routinely drop ICMP without affecting TCP/UDP traffic.
A tool that maps the hops a packet takes to a destination, exposing where delays or failures occur.
Traceroute works by sending packets with incrementally increasing Time-to-Live (TTL) values, starting at 1. Each router along the path decrements the TTL by 1; when it reaches 0, the router discards the packet and returns an ICMP Time Exceeded message, revealing its IP address and round-trip time. This builds a hop-by-hop map of the path to a destination, making it a go-to tool for isolating where latency spikes or packet loss begins. On the exam, note the platform difference: Windows uses tracert (ICMP echo requests), while Linux and macOS use traceroute (UDP probes to high ports by default). A key nuance is that an asterisk (*) does not always mean a failed router — many devices silently drop ICMP or UDP probes while still forwarding normal traffic.
Command-line tools that query DNS servers to diagnose name-resolution problems.
Both nslookup and dig query DNS servers and display the returned records — A, AAAA, MX, CNAME, PTR, and others — along with which resolver answered. This makes them indispensable when a hostname resolves incorrectly or fails despite connectivity being intact. The key exam distinction is that nslookup ships on Windows and supports an interactive mode, while dig is the Linux/macOS standard and gives more detailed output, including query flags and TTL values. Watch for scenarios where aiming the lookup at a specific server — nslookup hostname <server-IP> — reveals a misconfigured forwarder rather than a bad record.
Commands that display and manage a host's IP configuration, including address, mask, and gateway.
On Windows, ipconfig displays a host’s IP address, subnet mask, and default gateway for each active adapter. The /all switch adds the MAC address, DHCP server, DNS servers, lease obtained/expires timestamps, and whether DHCP is enabled — critical when chasing addressing or name-resolution failures. A 169.254.x.x (APIPA) address signals that DHCP failed. On Linux and macOS the equivalent is ip addr (modern) or the older ifconfig. Use ipconfig /release and /renew to force a DHCP cycle on Windows; Linux uses dhclient. Do not confuse ipconfig, which reads local interface state, with nslookup, which queries DNS.
A command that displays active connections, listening ports, and network statistics on a host.
The netstat command displays active TCP and UDP connections, listening ports, routing tables, and per-interface statistics on the local host. Network+ troubleshooting uses it to verify whether a service is bound to the expected port and to spot unexpected outbound connections that may signal malware. A key distinction: netstat shows connections from the host’s perspective—including TCP states like ESTABLISHED, TIME_WAIT, and LISTEN (UDP is connectionless and has no such states)—while nmap scans ports from the network. When a service fails to start, netstat -an reveals whether another process already occupies that port, which ping or tracert cannot.
A Windows tool that combines ping and traceroute to measure per-hop latency and packet loss.
Pathping is a Windows command-line utility that merges ping and traceroute into one diagnostic session. It first maps the route to the destination (like traceroute), then sends repeated ICMP echo requests to each hop, computing per-hop round-trip latency and packet-loss percentages over a sampling period (about 25 seconds per hop by default).
The key exam distinction is that traceroute (tracert) reveals only the path and approximate latency in a single pass, while pathping exposes sustained packet loss at intermediate routers — useful for isolating a flaky WAN link that passes a quick ping but drops traffic under load.