Network Troubleshooting Commands
Every network fault gets the same first questions: do I have an address, can I reach the gateway, can I reach beyond it, does the name resolve, is the port open. Each question has a command on each platform, and the differences between them are exactly what the exams ask about.
Network Troubleshooting Commands · firsttry.app/cheatsheets/network-troubleshooting-commands · original reference written from published exam objectives. Not affiliated with any certification body.
Addresses and interfaces
| Question | Windows | Linux | macOS |
|---|---|---|---|
| What is my address? | ipconfig | ip addr (or ip a) | ifconfig |
| Full detail, DNS and lease | ipconfig /all | ip addr; resolvectl status | ifconfig; scutil --dns |
| Renew the DHCP lease | ipconfig /release then /renew | dhclient -r; dhclient | sudo ipconfig set en0 DHCP |
| Interface state | ipconfig | ip link | ifconfig |
Reachability and path
| Question | Windows | Linux | macOS |
|---|---|---|---|
| Can I reach it? | ping host | ping host (Ctrl+C to stop) | ping host |
| Which hops does it cross? | tracert host | traceroute host | traceroute host |
| Loss per hop over time | pathping host | mtr host | mtr host (installed separately) |
| Is the path MTU too small? | ping -f -l 1472 host | ping -M do -s 1472 host | ping -D -s 1472 host |
Name resolution
| Question | Windows | Linux | macOS |
|---|---|---|---|
| Resolve a name | nslookup host | dig host (or host, nslookup) | dig host |
| Ask a specific server | nslookup host 8.8.8.8 | dig @8.8.8.8 host | dig @8.8.8.8 host |
| A specific record type | nslookup -type=MX domain | dig domain MX | dig domain MX |
| Clear the resolver cache | ipconfig /flushdns | resolvectl flush-caches | sudo dscacheutil -flushcache |
| Show the cache | ipconfig /displaydns | resolvectl statistics | Not exposed |
ARP, routes and sockets
| Question | Windows | Linux | macOS |
|---|---|---|---|
| Who has this address on my segment? | arp -a | ip neigh | arp -a |
| Routing table | route print | ip route | netstat -rn |
| Add a static route | route add 10.0.0.0 mask 255.0.0.0 192.168.1.1 | ip route add 10.0.0.0/8 via 192.168.1.1 | sudo route -n add 10.0.0.0/8 192.168.1.1 |
| Listening ports and connections | netstat -ano | ss -tulpn | netstat -an; lsof -i |
| Which process owns the port? | netstat -ano then tasklist /fi "pid eq N" | ss -tulpn (shows the process) | lsof -i :443 |
Ports, captures and throughput
| Question | Command | Note |
|---|---|---|
| Is a TCP port open? | Test-NetConnection host -Port 443 | PowerShell; nc -zv host 443 on Linux and macOS |
| Which ports are open on a host? | nmap host | Scan only what you are authorized to scan |
| Capture packets | tcpdump -i eth0 port 53 | Wireshark for the same on any platform, with a display filter |
| Measure throughput | iperf3 -s on one end, iperf3 -c host on the other | Tests the path, not the internet |
| Check a web endpoint | curl -I https://host | Headers and status without the body |
Exams covered
Try it here
Three verified practice questions on this material. Answer one, and see the official page behind the answer.
3-2Network Operations
A switch sends unsolicited alerts to the manager when a link drops. Which UDP port receives those?
6-5Automation and Programmability
Device configuration is exchanged over NETCONF. How is the configuration data encoded?
2-2Networking
A new access point offers several security modes and every client is recent. Which is the most secure for personal Wi-Fi?
Five free questions on every practice exam. No account, no card.