Don't guess
Changing things at random until it works wastes time, and often adds new faults. Use a cycle:
- Define the problem: who is affected, what exactly fails, since when, what changed?
- Gather facts: show commands, logs, pings, what the users see.
- Form a theory about the cause, and test it.
- Fix one thing at a time, and verify that the original problem is gone (and nothing else broke).
- Document the cause and the fix.
Choosing where to start
| Approach | How | Good when |
|---|---|---|
| Bottom-up | Start at layer 1 (cables, interfaces) and work up | Several things fail, or a physical change was made |
| Top-down | Start at the application and work down | One application fails while others work |
| Divide and conquer | Start in the middle (ping), then go up or down | You have experience and no clear clue: the usual choice |
| Follow the path | Check each device hop by hop from source to destination | You know the path (traceroute helps) |
| Compare | Compare with a working device or a saved config | One of many similar devices fails |
Commands by layer
| Layer | Ask | Commands |
|---|---|---|
| 1 Physical | Cable in, link up, no errors? | show interfaces status, show interfaces (errors, CRC), show power inline |
| 2 Data link | Right VLAN, trunk up, STP forwarding, channel bundled? | show vlan brief, show interfaces trunk, show spanning-tree, show etherchannel summary, show mac address-table, show cdp neighbors |
| 3 Network | Addresses, gateway, routes, DHCP? | ipconfig / ip addr, show ip interface brief, show ip route, show ip dhcp binding, ping, traceroute |
| 4-7 | Application reachable, port open? | Application tests, ACLs (later), DNS |
Remember: Most LAN faults are at layers 1-3: a cable, a port that's down or in the wrong VLAN, a trunk that doesn't carry the VLAN, or a wrong address, mask or gateway.