Fluke Networks: first-line Network Fault Diagnosis

When the network client goes down, the technician's job is to restore it to normal. In today's business environment, their primary task is to make the network work economically and efficiently. Providing appropriate training, tools, and reliable methods for technicians in any network environment can help them troubleshoot network faults faster and save time, it also enables network users to resume efficient work as soon as possible.

Troubleshooting mentality and Methods

The key to a technician's successful troubleshooting is to understand the normal network operation. In this way, technicians can quickly find exceptions, and other methods are tantamount to blind conjecture.

Unfortunately, many network products do not provide adequate performance descriptions, operating principles, or refined technical data to guide fault diagnosis. Successful technical personnel should thoroughly investigate all available data and gain an in-depth understanding of the functions and operation methods of all components. Finally, he or she will realize that the root cause of some serious faults is often improper use and configuration methods or misoperations.

This kind of insight comes from formal training and becomes more acute as practical experience grows. Technical personnel who are really good at fault diagnosis are good at learning in practice. Through repeated tests and comments with others, they find that there are no practical methods in textbooks. The following information helps you avoid detours and provides some pertinent suggestions on how to find and solve network problems.

Successful Fault Diagnosis personnel should quickly master the following basic concepts: Simple Evaluation of fault symptoms, so as to avoid wasting a lot of time on tracing errors. All information and reported fault symptoms must be taken into account, and the relationship between them and the operation of the entire network must be taken into account. Only in this way can technicians truly understand the meaning of the fault symptoms. After collecting fault symptom data, check the data to verify or eliminate some problems.

Five steps for successful troubleshooting

In the process of solving and handling network problems, successful technical staff will adopt the same method:

1. file the network

Learn the latest documents in real time, such as physical and logical diagrams, performance benchmarks and audits, device inventory, configuration, and host address tables ), in this way, the "Search" process time of the troubleshooting process will be greatly reduced, so as to easily find the position of the PC in the entire network.

2. Collect all available information and analyze fault symptoms

Consider whether you understand these symptoms. Can the user demonstrate the fault, or can you reproduce the fault? Determine whether the workstation or network has changed before a fault occurs.

3. Search for and analyze problems

Narrow down the scope of the problem. Is the problem related to a CIDR block or a client? For a client, we can further refine it to the network, physical wiring, or workstation range. You will find that information collection and query problems are often performed at the same time.

4. Solutions for fault rectification and fault confirmation

After finding the problem, you can easily identify and correct the specific fault. The simplest and most effective way for network hardware is to replace components, such as replacing damaged jumpers, Hub/switch ports, or client NIC ). When the user detects a fault and uses the first solution to the problem), this step must be completed to ensure that the fault has been repaired.

5. file the documents for the measures taken

Go back to step 1. Record faults and their solutions, as provided by many fault-specific applications), can build an internal enterprise knowledge base for future reference in the case of similar faults. This information can quickly eliminate future faults.

Is this step really necessary?

Despite the continuous improvement in the reliability of operating system software, "Restarting the computer" is still a "stunt" of professional technical service personnel ". Restarting cold start can solve many problems that cannot be explained, so it is indeed an irreplaceable step. The advantage of this operation is that technicians can solve the problem without leaving their seats.

In addition to restarting the machine, you can call the user to learn more before going to the workstation.

Most users can open a command prompt and report the result of IPCONFIG command execution to technicians. In this way, you can tell the technical staff whether the IP address of the PC in the connected subnet is correct.

If the PC is configured as a Dynamic Host Control Protocol DHCP), but returns the Windows default IP address 169.254.x.x), it indicates that the client is not correctly connected to the DHCP server.

The laptop can properly address the connected network, but sometimes it retains the DHCP lease of another subnet after it leaves the network. Ask the user to enter two commands at the command prompt to make a new request:

C: \> ipconfig/release
C: \> ipconfig/renew

After receiving the new IP address, ask the user to try the network. If the IPCONFIG Command reports that DHCP cannot be executed, the user may be using static IP configuration. Verify the reported IP address according to the network document.

If the user reports a valid IP address, PING the address from your machine. If your PC has a response, try other networking operations, such as opening a webpage or pinging a local router to confirm basic connectivity. If these tests cannot solve the problem, they should be resolved at the user's site.

On-site inspection of client Problems

After arriving at a workstation that may be faulty, various information should be collected carefully. Ask the user about any behavior or activity that may affect network performance. Because users may not notice that many conventional operations related to workstation or Workspace affect network performance, or they do not want to admit that they are aware of improper operations, sometimes this approach is of little significance. Ask your questions in detail. Be sure to ask about all recent changes, including moving office furniture or installing new screen saver.

Repeat the detection that you asked the user to perform on the phone. If the network server or offline device can be successfully pinged, it indicates that the connection between the workstation and the network has reached the third layer. At this time, it can be determined that there is no need to perform all low-level detection, technical staff can also focus on other aspects.

If the layer-3 connection cannot be verified, detection must start from the level-1.

If the fault is caused by a disconnection or intermittent connection, the PING command continuously sends a response packet to the target device. The response time or no response time of each successfully executed PING command is displayed.

C: \> ping-t x. x

You can use the trace path TRACERT or PATHPING that connects to the target device to further investigate timeout responses or unexecuted PING commands. Path tracing can tell the network where data packets are delayed or lost. The first layer of troubleshooting should start from this location.
C: \> tracert x. x or C: \> pathping x. x

Do I need to expand the scope of troubleshooting?

If the fault report of the user cannot identify the problem, a detailed investigation is required for a long time. However, fast detection before on-site inspection is possible to quickly solve this problem.

Since the user report shows that you cannot log on to the network, the primary concern of technicians is whether the fault is related to the network or the user's PC. Next, determine whether the client and the network are correctly connected and working properly, and whether the client can access the network. Ensure that these features can solve many problems and lay the foundation for solving more complex problems. To solve network problems in a timely and efficient manner, first-line technicians are required to have a tool that can quickly check the status of key network functions, such as the LinkRunner link of fluke network.

Quick Detection for first-line troubleshooting ":
1. Detection Link
2. Check the activity of the entire network segment
3. Use DHCP as a diagnostic tool
4. Ping the local and remote targets

Detection Link

Many Network Technicians believe that the leeching lights on the network card indicate that there is a link pulse. Although people trust certain devices, many link LEDs are controlled by software in the host system, and they are also "enabled" when detecting high-level network activity. Some NICs also make active indicators shine, indicating network traffic. As evidence of networking, these are more reliable than Link LEDs. However, none of these LEDs can indicate transmission speed or duplex settings, which need to be further investigated and confirmed.

The automatic negotiation process can be used to determine the link conditions. During this process, both parties exchange information about the transmission speed and duplex performance. After the information is exchanged, the two sides of the link compare the performance, and then start to communicate with each other at the highest speed and duplex matching. If either of the links is incorrectly configured or the driver function is abnormal, this process cannot be set together and communication may be interrupted.

LinkRunner successfully sends and receives signals through a single line segment to check whether a link exists.

After connecting to the network interface, LinkRunner first tries to establish a connection with the "link partner" that can be found at the other end, and the "link partner" can be a network connector hub or switch ), it can also be the NIC of a PC. LinkRunner follows the automatic negotiation process stipulated by IEEE 802.3, which is a link indicator for hardware control rather than software control. After the automatic negotiation is successful, the LinkRunner's LED is light green, and the transmission speed and duplex settings are displayed in the upper left corner of the LinkRunner screen.

The LinkRunner screen displays the successful link status, transmission speed, duplex settings, and usage.

Check the activity of the entire network segment

If you can see network traffic on the cable, the LinkRunner will indicate the traffic level on the "utilization Bar Chart" on the main screen. However, you must note that if you connect to a single vswitch port that is not a shared medium, you can only see the traffic of the broadcast frame, which is intermittent and incoherent on the low-traffic network.

If you are detecting a shared Ethernet environment that is still using a hub rather than a switch, your network is likely to run in half duplex mode. Half-duplex Ethernet is limited by the number of workstations trying to transmit signals simultaneously and the size of frames to be transmitted. If too many workstations are trying to transmit signals at the same time, the performance of Ethernet may be significantly reduced due to conflicts. If the network you are testing is that each workstation is connected to a separate switch port, you do not need to consider the site excess.

Although conflict occurs during the operation of half-duplex Ethernet, when the number of conflicts increases with the increase of network traffic, network Traffic will also begin to increase significantly due to necessary re-transmission operations. In this way, the network performance will suddenly "decrease in line", which is caused by the soaring number of frames, conflicts, and re-transmission operations and the rapid growth of the speed. Due to performance degradation, the user will feel the delay and submit a fault ticket.

In most networks, the Ethernet traffic level is not important. You should find other problems. By providing statistical information on network segment usage, LinkRunner can provide users with key clues about network performance exceptions.

Use DHCP as a diagnostic tool

If you can create a link and use it properly, the user will press the corresponding button for the PING test. Then, LinkRunner tries to obtain the IP address from the DHCP server. Generally, DHCP is a broadcast-based technology. Therefore, it requires that each subnet use an individual DHCP server to be expensive and difficult to manage) or use a DHCP relay proxy server. When the client and server are in the same physical subnet, the proxy server can send requests and replies between the two. These targeted broadcast aids on routers are a common tool for large enterprises that want to run DHCP servers in a central location. If the automatic DHCP configuration of the client or LinkRunner fails, the DHCP relay system will fail.

Although LinkRunner can accept manual or static IP configuration when necessary, most networks can now use DHCP. The process of obtaining the DHCP address reflects the durability of the local cable, local hub or switch port, and the network infrastructure connected to the DHCP server. In simple operations, most nearby network infrastructure reaches the third layer.

The successfully assigned DCHP Address indicates that the client's network communication is normal and the IP address can be obtained successfully. Step 1 to Layer 3 check is completed.

PING local and remote targets

In the network history, the PING operation has become one of the most common methods to eliminate network faults. In each common Internet available operating system, PING is the first step for most network technicians to take in the Process of troubleshooting network faults. Why is this simple tool so useful?

In the operation, PING is like the SONAR used in the marine system. The PING tool sends a signal that can respond to the request from the target device. The signal "reflected" is usually an ICMP "Request Response" frame ), this "reflection" signal informs the sender of the existence of the target system, and the time when the signal reaches the target device and returns.

After configuring the IP address provided by the DHCP server, LinkRunner will immediately send a PING test to the DNS domain name service) server and the default router. Both addresses are provided by the DHCP configuration process. You can pre-configure up to four additional target IP addresses for LinkRunner and use one of them as the addresses for automatic PING tests. If some key network services, such as WEB applications and user authentication, are successfully pinged, the client service itself is valid.

The PING operation succeeds, indicating that there is an end-to-end Layer-3 link between the two devices. If further analysis is required, you only need to take the round-trip time of the request as a known value to perform a helpful diagnosis for more detailed analysis data. However, ICMP requests are low-priority network traffic, and when a vro or target device on the link is busy, the request will be abandoned. This is why a series of PING requests are sent, giving more response opportunities to the target device.

The external server of the enterprise network can also be the target device for PING operations to check the connectivity between the WAN and the remote site from the client or local site. If the server that has installed the firewall responds to the PING operation, but the server that has not installed the firewall does not respond, the network technician should check whether the router or other network border infrastructure is faulty. If some servers respond but others do not, network technicians should find out the causes of faults in these special network segments. If the PING operation is effective for both external and internal servers, including applications and servers, but the client does not respond to the PING operation, that is, to accept the services ), it indicates that there is a fault at a level other than physical transmission. If the PING succeeds, other network traffic can reach the target server. If you still cannot access those services, the problem may be related to the login account of the server or user.

PING the local system or all systems on the Internet.

What should I do next?

If the initial "Quick Detection" fails to determine or solve the problem, the next step should be clear.

If the check indicates that an Ethernet connection cannot be established, check whether the network cable has serious problems.

If the detection succeeds, the link and reasonable network segment traffic are displayed, the IP address is obtained through DHCP, and the key network servers are successfully pinged,

The problem can be solved at a higher technical level at other network levels, or the user account administrator or personal computer technician can find the problem of workstation configuration.

Cable Detection

First, check the jumper that connects the workstation or device to the network wall interface. Therefore, you only need to insert one end of the cable into the network interface of LinkRunner, and insert the other end into the wire sequence adapter outlet for fast cable connectivity and correctness detection. If the jumper is normal, insert it into the wall or floor interface again and use it as a component for further detection.

The next step for finding a cable problem is to check the cables in the wiring room and the local switch. In a cable-filled wiring room, it is difficult to correctly pick out the bad cables from many cables, which also takes time, but LinkRunner provides two functions, it makes it easy and fast to find broken cables. First, LinkRunner can send an audio signal to the cable, and then use the audio Detector for tracking. Using a standard audio detector, You can systematically check the cable until you hear the music from bad cables. This method is useful when you are not sure whether the cable is connected to a vswitch or if there is no documentation indicating which wiring or vswitch the cable is connected.

LinkRunner can provide excellent jumper tests...

Cross jumper...

And severely damaged Jumpers

After finding the remote location of the user cable, you can use the LinkRunner wire sequence adapter or an optional LinkRunner cable number attachment (LinkRunner
Cable ID Accessories) disconnect the link and check whether the connection and line pairs of all horizontal cables are normal.

At the same time, LinkRunner sends an audio signal and tries to make the switch port Link shine every three seconds. With this function, you can easily find the port connected to the cable. After finding the Port location, connect the cable to other unused ports. Generally, the adjacent port or faulty port still shows that the link is normal, so switching to different ports may solve the problem.

If the detection result of the hub or switch port is normal, it may be a problem with the workstation. You can directly connect the LinkRunner to the network card of the workstation for detection. Like connecting a hub or vswitch, LinkRunner can indicate the network adapter's link status, transmission speed, and duplex settings. If the link is normal, restart the PC or use command line tools such as PING to trigger network traffic and use LinkRunner for monitoring. If LinkRunner reports no traffic, check the bound parts and other configuration parameters on the PC even if the PC displays that the data is being transferred. If LinkRunner reports the link and PC traffic at the same time, you need to further diagnose the PC network configuration.

Advanced Diagnosis

If the workstation establishes a network connection, it is necessary to confirm that the addressing of the workstation is consistent with the subnet to which it is connected. Make sure that the workstation uses the appropriate protocol stack and is correctly configured. Finally, the technician must check that all necessary program components and databases are normal. In general, you must first Delete the Protocol or network card from the workstation configuration, and then reinstall it for inspection. If the location and configuration of all these components are normal, and the workstation still shows a network and application connection error, You need to gradually locate the problem outside the regional technical level.

Extraordinary tools for outstanding performance

LinkRunner is a widely used tool that is cost-effective and easy to use. It is suitable for technical staff of the Department to hold or stick on the belt. Only well-known network devices can eliminate the inherent uncertainty of laptop testing.

As network technicians have said, if it is a client device that is "widely known", it brings far more problems than it can solve, in addition, when network support and desktop clients belong to different groups, it will not only lead to technical problems, but also political or organizational problems. When the device mentioned in the fault ticket is not a desktop computer but a network infrastructure component, this is a tough technical problem, although there are simple political factors ).

In this case, even if there is no diagnostic screen for a conventional device, the fault of the link itself will be quickly located. When the problem can be solved within a department or group without reporting each problem to IT professional technical personnel, the problem will be solved faster and more effectively. Advanced tools can be used in a small scope among technicians and engineers trained in advanced fault diagnosis. The purpose of the fault diagnosis solution is to make full use of the advantages of advanced personnel and technical resources.

Fluke NetworkLinkRunnerChain Link is a cost-effective, ultra-portable tool that helps technicians in the early stages of the network fault diagnosis process.

LinkRunner is a simple tool suitable for the overall deployment of the organization. It helps frontline technicians find basic connection faults and report fault tickets to higher-level technicians, solve problems at the physical level.

LinkRunner is an ideal choice for field detection of basic network connections. It can solve many network problems and is also a prerequisite for solving more complex problems. When a technician uses LinkRunner for on-site fault detection, it can determine important network operation parameters and provide basic information for solving faults caused by higher levels of the ISO 7 stack.

When network managers continue to migrate or upgrade their infrastructure to "switch to desktop", they will see the benefits of fully-switched infrastructure: splitting network traffic and avoiding the spread of Ethernet errors in the network. However, this switch Infrastructure "hides" lower-layer problems that affect the performance of each link, so that frontline technicians can only guess the connection status.

To learn more about the basic situation of automatic Ethernet negotiation, problems that cause abnormal work, and methods for detecting and repairing link failures, log on to our website: Workshop.

Tel: Beijing: 010-65123435 Guangzhou: 020-38795800 Shanghai: 021-63548829 CHENGDU: 028-85268810
Webpage: www.flukenetworks.com.cn