A real-life situation
On Monday morning, a manager calls: "The network is down!" You could start rebooting things. But after a few questions, you learn that only the three people on the second floor are affected, they can still print, and the problem started after a new switch was installed on Friday. In two minutes, the "whole network" problem has become one switch on one floor. That is what a method does for you.
What a troubleshooting method is
A troubleshooting method is a fixed list of steps you follow every time, so you find the cause instead of guessing. Most methods used by network teams look like this:
| Step | What you do | Example |
|---|---|---|
| 1. Define the problem | Write one clear sentence: who, what, where, since when. | "3 PCs on floor 2 can't reach the file server since Friday." |
| 2. Gather facts | Ask questions and run commands. What works? What doesn't? | Printing works. Pinging the gateway fails. |
| 3. Form a hypothesis | Pick the most likely cause. This is your hypothesis: an idea you can test. | "The new switch has these ports in the wrong VLAN." |
| 4. Test it | Run a check that proves or disproves the idea. Change one thing at a time. | show vlan brief on the new switch. |
| 5. Fix | Apply the smallest change that solves it. Have a way to undo it. | Move the ports to VLAN 10. |
| 6. Confirm | Test again from the user's side. Ask the user too. | All 3 PCs reach the file server. |
| 7. Document | Write down the cause, the fix and how you proved it. | Ticket note and updated switch notes. |
- 1. Define and gather: turn "it's broken" into one clear sentence, then collect the facts.
- 2. Test one idea: pick the most likely cause and run a check that proves or disproves it.
- 3. Idea was wrong? that is still progress, because you have ruled out one cause. Go back with the new facts.
- 4. Idea was right: apply the fix, confirm it from the user's side and write down what you did.
Why it works this way
- A clear problem sentence limits the search. "The network is down" could mean anything. "Floor 2 can't reach the file server" points to a few devices.
- One change at a time. If you change three settings and it starts working, you don't know which one fixed it. You may also have broken something else.
- Ask "what changed?" Most outages follow a change: new equipment, a config edit, a software update or a moved cable.
- Confirm from the user's side. A green status on your monitoring screen doesn't prove that the user can work.
💡 Good questions to ask the user: When did it start? Does it affect only you, or others too? Does anything still work? Did anything change? Can you show me?
The troubleshooting path: six checks in order
Step 2 of the method, "gather facts", is where most of the work happens. To gather facts without missing anything, follow the same path every time, from the bottom up. Each step depends on the one below it: a PC can't get an IP address over a broken cable, and a browser can't load a site the PC can't reach. This order is the bottom-up approach. The lesson Bottom-up, top-down, divide and conquer explains when another order is faster.
| Step | OSI layer | The question it answers | Typical tools |
|---|---|---|---|
| 1. Physical | Layer 1 | Is there a working connection at all? | Your eyes, link lights, Wi-Fi icon |
| 2. Ethernet | Layer 2 | Is the network card communicating correctly on the link? | Get-NetAdapter, ip link, ethtool |
| 3. IP settings | Layer 3 | Does the PC have the right address, mask and gateway? | ipconfig, ip addr, ip route |
| 4. Reachability | Layer 3 | Can packets get there and back? | ping, tracert / traceroute |
| 5. Services | Layer 7 (helpers) | Do names resolve? Did DHCP hand out the right settings? | nslookup, dig, ipconfig /all |
| 6. Application | Layers 4 to 7 | Does the actual program work end to end? | Browser, netstat / ss, firewall logs |
This lesson uses one example PC throughout: IP address 192.168.10.25/24, default gateway 192.168.10.1 and DNS server 192.168.10.5. The remote web server is 203.0.113.10.
- 1. Steps 1–2, physical and Ethernet: the cable and network card between the PC and the switch.
- 2. Steps 3–4, IP and reachability: check the settings, then ping the gateway and beyond.
- 3. Step 5, services: DNS translates names into IP addresses; DHCP gave the PC its settings.
- 4. Step 6, application: the browser talks to the web server through any firewalls on the way.
Step 1: Physical
The physical layer is the real, touchable connection: the cable, the socket, the network card and the radio signal. A surprising number of tickets end here: a cable knocked loose, a laptop with Wi-Fi turned off or a dead port on a wall socket.
Physical checklist
- Is the cable plugged in firmly at both ends (the PC and the wall socket or switch)? Does the clip click into place?
- Is the link light on, at the PC and at the switch port? No light usually means no connection.
- Does the operating system show the interface as connected and enabled, not "Network cable unplugged" or "Disabled"?
- On Wi-Fi: is Wi-Fi on, is aeroplane mode off, and is the PC connected to the right network name (SSID)?
- Is the Wi-Fi signal strong enough? One bar, far from the access point, means dropped connections and slow speeds.
- Try a known-good cable or another port. Does the problem move with the cable, the port or the PC?
C:\> ipconfig Windows IP Configuration Ethernet adapter Ethernet: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . :
Learn more: Copper CablingWi-Fi BasicsLayer 1 and 2 Problems
Step 2: Ethernet
Once the link is up, check that the network card is communicating properly over it. Ethernet (Layer 2) problems are less common, but they cause the confusing "it works, but badly" tickets.
Ethernet checklist
- Does the network card have a normal MAC address? (It should not be all zeros, and two devices should never share one.)
- What link speed did it negotiate? A gigabit PC showing 100 Mbps often means a damaged cable with a broken wire pair.
- Is it full duplex? Half duplex on a modern switch port points to a duplex mismatch: slow, with errors and retries.
- Do the interface counters show errors or drops that keep increasing?
- Is the switch port in the right VLAN (virtual LAN)? A PC on the wrong VLAN ends up on the wrong network, or on no working network at all.
PS C:\> Get-NetAdapter | Format-Table Name, Status, MacAddress, LinkSpeed Name Status MacAddress LinkSpeed ---- ------ ---------- --------- Ethernet Up 02-00-00-00-00-25 100 Mbps Wi-Fi Disconnected 02-00-00-00-00-26 0 bps
Step 3: IP settings
Next, check what the PC believes about the network. Four settings decide almost everything: the IP address, the subnet mask, the default gateway and the DNS server.
IP checklist
- Does the PC have an IP address in the right network (here
192.168.10.x)? - Is it not a
169.254.x.xaddress? That kind of address means DHCP failed (step 5). - Is the subnet mask the same as other PCs on that network (here
255.255.255.0)? - Is a default gateway set, and is it inside the PC's own subnet?
- Is a DNS server listed? (
ipconfig /allshows it.) - Is another device using the same IP address? Windows warns of an address conflict.
C:\> ipconfig Ethernet adapter Ethernet: Connection-specific DNS Suffix . : office.example IPv4 Address. . . . . . . . . . . : 192.168.10.25 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.1.1
192.168.1.1 is in a different subnet. The PC can't reach it, so it can talk to local devices but not to anything beyond its subnet. Someone typed the wrong gateway by hand.Step 4: Reachability (the ping ladder)
Ping sends a small test message (an ICMP echo request) and waits for a reply. Ping in this order, with each test reaching one step further. The first rung of the ladder that fails tells you where to look.
- 1. 1. ping 127.0.0.1: the loopback address never leaves the PC. It tests that the TCP/IP software works.
- 2. 2. ping own IP: tests that the network card has its address. This still doesn't leave the PC.
- 3. 3. ping the gateway: the first real trip across the LAN: cable, switch, ARP and the router's interface.
- 4. 4. ping a remote IP: tests routing past the gateway, out to another network and back.
Reachability checklist
- Does
ping 127.0.0.1(localhost) get replies? If not, the PC's network software is broken. Restart the PC or repair the network stack. - Does
ping 192.168.10.25(its own IP address) get replies? If not, the address isn't really configured on the card. Recheck step 3. - Does
ping 192.168.10.1(the default gateway) get replies? If not, the problem is on the local network: the cable, the switch port, the VLAN, or a wrong address or mask. - Does
ping 203.0.113.10(a remote IP address) get replies? If not, look beyond the gateway: the router, the internet link or a firewall (remember that some hosts block ping). Use traceroute to find where it stops.
C:\> ping 192.168.10.1 Pinging 192.168.10.1 with 32 bytes of data: Reply from 192.168.10.25: Destination host unreachable. Reply from 192.168.10.25: Destination host unreachable. Reply from 192.168.10.25: Destination host unreachable. Reply from 192.168.10.25: Destination host unreachable. Ping statistics for 192.168.10.1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
⚠️ A failed ping is not always a fault. Many servers and firewalls block ping on purpose. If the remote ping fails but the website opens, the network path is fine. Always confirm with the real service in step 6.
Step 5: Services (DNS and DHCP)
Two helper services support almost everything users do. DHCP hands out the settings you checked in step 3. DNS translates names such as routelearn.net into IP addresses. When DNS fails, users say "the internet is down", even though the network itself works perfectly.
Services checklist
- Did the PC get its address from DHCP? If so,
ipconfig /allshows "DHCP Enabled: Yes" and a DHCP server address. - Is the lease current, and are the gateway and DNS server values it handed out correct?
- Does a name resolve?
nslookup routelearn.netshould return an address. - Does ping by IP address work while ping by name fails? Then the problem is DNS, not the network path.
- Is the DNS server address correct, and can you reach it (ping it)?
- Could an old cached answer be the problem? Clear the cache with
ipconfig /flushdns.
C:\> nslookup routelearn.net DNS request timed out. timeout was 2 seconds. Server: UnKnown Address: 192.168.10.50 DNS request timed out. timeout was 2 seconds. *** Request to UnKnown timed-out
192.168.10.50, but the real DNS server is 192.168.10.5, and every request times out. This is a typo in a static DNS setting: pings by IP address work, but names don't resolve.Learn more: DNS Problems
Step 6: Application
If names resolve and the remote host is reachable, but the user still can't work, the problem is in the application itself, the server, or a firewall between them.
Application checklist
- Browser: does another website open? Does the same site work in a private window or another browser? (Rules out cache, cookies and extensions.)
- Error message: read it carefully. "Connection refused", "timed out", "certificate error" and "404 not found" point to different causes.
- Server: is the server or service running? Do other users have the same problem? Check a status page or the Website Status Checker.
- Port: is the right port open, for example TCP 443 for HTTPS? Try the Port Checker.
- Firewall: is a firewall (on the PC, the server or the network) blocking this program or port? Did a rule change recently?
- Proxy or VPN: is the PC set to use a proxy or VPN that is down?
| Browser message | Usually means |
|---|---|
| "Server not found" / DNS_PROBE | Name resolution failed: go back to step 5 |
| "Connection timed out" | Packets get no answer: a firewall is dropping them, or the server is down |
| "Connection refused" | The server answered, but nothing is listening on that port: usually the service is stopped |
| Certificate warning | HTTPS problem: wrong clock on the PC, expired certificate, or interception |
| 404 / 500 errors | The network is fine; the web application has the problem |
The whole path on one card
Copy this table into your notes. It shows the full path, the first command to run at each step and where to look if that step fails.
| Step | Windows | Linux / macOS | If it fails, look at… |
|---|---|---|---|
| 1. Physical | Link light, ipconfig | ip link | Cable, port, Wi-Fi |
| 2. Ethernet | Get-NetAdapter | ethtool eth0 | Cable quality, duplex, VLAN |
| 3. IP | ipconfig /all | ip addr, ip route | Static typos, DHCP |
| 4a. Localhost | ping 127.0.0.1 | ping -c 4 127.0.0.1 | The PC's network software |
| 4b. Own IP | ping 192.168.10.25 | ping -c 4 192.168.10.25 | Address not on the card |
| 4c. Gateway | ping 192.168.10.1 | ping -c 4 192.168.10.1 | LAN: cable, switch, VLAN, mask |
| 4d. Remote IP | ping, tracert | ping, traceroute | Router, ISP, firewall |
| 5. DNS / DHCP | nslookup | dig, nslookup | DNS server, DHCP server |
| 6. Application | Browser, netstat -ano | Browser, ss -tulpn | Server, port, firewall |
Learn more: Essential Windows Network CommandsEssential Linux Network Commands
A worked example
A user reports: "Since this morning I can't open any websites. Teams chat still shows old messages." Here is the path, step by step:
- Physical: cable in, link light green. ✓
- Ethernet: 1 Gbps, full duplex. ✓
- IP:
192.168.10.25, mask255.255.255.0, gateway192.168.10.1. ✓ - Reachability: localhost, own IP, gateway and
203.0.113.10all reply. ✓ - Services:
nslookup routelearn.nettimes out. ✗ The DNS server is192.168.10.50, not.5.
The hypothesis is "wrong DNS server". The user had set it by hand while following an online guide. The fix is to set DNS back to automatic. To confirm, open a few websites: they load. Then document it: "Static DNS typo; reset to DHCP." Total time: about five minutes, with no guessing.
How to use it: the decision tree
The tool below follows the same method for the most common complaint, "the internet isn't working". Each yes/no answer is a fact you have gathered, and each "no" points to one likely cause.
Internet not working?
Does the device have a valid IP address?
Check with ipconfig (Windows) or ip addr (Linux/macOS). A 169.254.x.x address counts as "no."
When troubleshooting goes wrong
The method itself can fail when it isn't followed. These are the mistakes that turn a five-minute fix into a lost afternoon:
Reinstalling the browser when the cable was loose. Start at the bottom unless you have facts that rule out the lower layers.
A blocked ping doesn't prove there is a fault, and a working ping doesn't prove the application works. Test the real service.
You lose track of the cause and may add a second fault. Make one change, then run one test.
A new switch, an update or a moved desk is often the whole answer.
Always test the IP address as well as the name. This splits the problem in two.
The same fault comes back next month, and nobody remembers the fix.
- Define the problem in one sentence: who, what, where, since when, and what still works.
- Work bottom-up: physical → Ethernet → IP → reachability → services → application.
- Ping in order: localhost, own IP, gateway, remote IP. The first failure shows where to look.
- Ping by IP address works but by name fails? Suspect DNS. A
169.254.x.xaddress? Suspect DHCP. - Change one thing at a time, confirm from the user's side, and document the fix.
Check yourself
You change the VLAN, the speed setting and the gateway at the same time, and the problem goes away. What is wrong with this?
A manager says the CRM system isn't working. After a few questions, which problem definition gives you the best starting point?
The switch shows the port is up and the fix is applied. What is the last step before closing the ticket?
A PC pings 127.0.0.1 and its own IP, but pinging the default gateway fails. Where should you look next?
ping 203.0.113.10 works, but ping www.example.com says it could not find the host. Which step of the path has the fault?
Where to go next
Next, learn three ways to work through the layers in Bottom-up, top-down, divide and conquer. Then build your toolkit with Essential Windows network commands and Essential Linux network commands, and practise on a real scenario in Lab: fix a broken office network. To see what a working network does end to end, revisit What happens when you open a website?