5.5.1. Network Problem Symptoms and Causes
💡 First Principle: Network symptoms are often described imprecisely by users ("the server is broken," "I can't access anything"). Your job is to convert vague symptom descriptions into specific, testable hypotheses. The scoping questions from 5.1 are critical: does the problem affect one user, one server, one site, or everyone?
Common Network Problems and Their Causes
| Symptom | Most Likely Cause | Layer |
|---|---|---|
| No link light on NIC | Cable unplugged, bad cable, switch port failure | Physical (L1) |
| APIPA address (169.254.x.x) | DHCP server unreachable, DHCP scope exhausted | Logical (L3) |
| Destination host unreachable | No route to host, firewall blocking, host down | Routing (L3) |
| Unknown host | DNS failure, mistyped hostname | DNS (L7) |
| Can reach by IP, not hostname | DNS failure, hosts file problem | DNS (L7) |
| Can reach local, not remote | Missing/incorrect default gateway | Routing (L3) |
| Receiving incorrect DHCP info | Rogue DHCP server, DHCP misconfiguration | DHCP (L7) |
| Cannot reach remote subnets | Routing table problem, missing static route | Routing (L3) |
| Service provider failure | ISP outage | External (L1/L2) |
| Cannot reach by FQDN | DNS, domain suffix search, DHCP option 15 | DNS (L7) |
Root Causes
| Cause | Symptom | How to Confirm |
|---|---|---|
| Improper IP configuration | Cannot communicate | ipconfig / ip addr — wrong IP, mask, or gateway |
| IPv4/IPv6 mismatch | Some hosts reachable, others not | Check addressing on both sides |
| VLAN misconfiguration | Can reach some hosts, not others on same network | Verify VLAN membership on switch port |
| Network port security | NIC connected but no network access | Check switch port security violations |
| Bad cable | Intermittent connectivity, CRC errors | Replace cable, check link speed |
| DNS failure | Name resolution fails | nslookup / dig — confirms DNS cause |
| DHCP server misconfigured | Wrong addressing, wrong options | Check DHCP server scope and options |
| Misconfigured hosts file | Specific hostnames resolve incorrectly | Check /etc/hosts or C:\Windows\System32\drivers\etc\hosts |
| Firewall misconfiguration | Port-specific failures | Port scan to confirm which ports are open |
⚠️ Exam Trap: APIPA and a physical link failure both result in "no network connectivity" to the user — but the cause and fix are completely different. The distinguishing diagnostic: if the NIC link light is on and the server has an IP address, it's DHCP. If there's no link light, it's physical.
Reflection Question: A server is configured with a static IP address. After moving to a new rack, users cannot reach it. The NIC link light is solid green. Ping to its IP address times out from other hosts on the same VLAN. What is the most likely cause, and what command would you run first?
