First Commands Every Network Troubleshooter Should Know

The first commands every network troubleshooter should know are ping, ipconfig (or ifconfig/ip addr), tracert/traceroute, nslookup/dig, netstat, and arp. These six tools let you isolate whether a problem is local, on the wire, or at the destination, and they work on Windows, macOS, and Linux with minor syntax differences.

Why These Six Commands?

Network troubleshooting is a process of elimination. You start with the most basic question—can the machine talk to itself?—and work outward. Each command answers a specific layer of the OSI model:

• ping tests Layer 3 (IP) connectivity and round-trip time.
• ipconfig/ifconfig shows your own Layer 3 configuration (IP, subnet, gateway).
• tracert/traceroute maps the path packets take, revealing where they stop.
• nslookup/dig checks DNS resolution (Layer 7).
• netstat lists active connections and listening ports (Layer 4).
• arp shows the IP-to-MAC mapping, which is essential when a device is reachable but not responding to ping.

Mastering these six gives you a complete diagnostic loop: configure, resolve, connect, route, and listen.

ping: The First Test

ping sends an ICMP Echo Request to a host and waits for a reply. It confirms that the remote host is up and that packets can travel both ways. On Windows, the command is ping ; on Linux/macOS, it runs continuously unless you add -c 4 for four packets.

What to look for:

• Reply with a time in milliseconds—normal, assuming the time is reasonable.
• Request timed out—no reply, but that could be a firewall blocking ICMP, not a dead host.
• Destination host unreachable—a router along the path has no route to the target.
• TTL expired in transit—a routing loop or too many hops.

A common mistake is assuming a ping failure means the host is down. Many servers block ICMP, so a failed ping only tells you that ICMP is filtered or the host is unreachable. Always try a TCP-based test (like telnet host port) to confirm.

ipconfig / ifconfig / ip addr: Know Your Own Address

Before diagnosing anyone else, check your own network settings. On Windows, ipconfig shows IPv4 address, subnet mask, default gateway, and DNS servers. On Linux, ip addr (or older ifconfig) shows similar info, and ip route shows the routing table.

Key details:

• IPv4 Address—if it starts with 169.254 on Windows (or 0.0.0.0), your machine failed to get an address from DHCP.
• Subnet Mask—/24 (255.255.255.0) is typical for small networks; a wrong mask can make you think a host is on a different subnet.
• Default Gateway—this is the router you send packets to when the destination is not local. If it’s wrong, you can’t reach the internet.

On Windows, ipconfig /flushdns clears the DNS cache, which is a quick fix for stale records.

tracert / traceroute: See the Path

When ping fails, tracert (Windows) or traceroute (Linux/macOS) shows each hop your packets take. It works by sending packets with increasing TTL values; each router that decrements the TTL to zero sends back an ICMP Time Exceeded message, revealing its IP.

How to read it:

• Each line is a hop, numbered 1, 2, 3…
• Three time values per hop represent three probes. A * means no response—often a router that doesn’t reply to ICMP, not necessarily a failure.
• The first hop should be your default gateway. If hop 1 fails, your local network is the problem.
• If the trace stops at a certain hop and never reaches the destination, that’s where packets are being dropped or filtered.

On Windows, tracert -d skips DNS lookups, speeding things up. On Linux, traceroute -n does the same.

nslookup / dig: DNS Resolution

DNS translates hostnames to IPs. If you can ping an IP but not a hostname, DNS is the culprit. nslookup is built into Windows and macOS; dig is the more powerful tool on Linux and macOS (if installed).

Basic usage:

• nslookup example.com returns the IP and the DNS server used.
• nslookup example.com 8.8.8.8 queries a specific DNS server, bypassing your configured one.
• dig example.com gives more detail, including the TTL and the answer section.
• dig -x 8.8.8.8 performs a reverse lookup (IP to hostname).

A common issue: your machine uses a DNS server that has a stale record. Querying a public DNS like 8.8.8.8 (Google) or 1.1.1.1 (Cloudflare) tells you if your own DNS is the problem.

netstat: Who’s Listening and Connected

netstat shows active TCP/UDP connections, listening ports, and routing tables. It’s invaluable for checking if a service is running and if any unexpected connections exist.

Key flags:

• netstat -a shows all connections and listening ports.
• netstat -n shows IP addresses and port numbers numerically (no DNS lookups).
• netstat -o (Windows) shows the owning process ID, letting you match a port to an app.
• netstat -p tcp (Linux) filters to TCP only.

For example, if a web server isn’t responding, netstat -an | grep :80 (Linux) or netstat -an | findstr :80 (Windows) will show if anything is listening on port 80. If not, the service is down or misconfigured.

arp: The Link Layer Map

ARP (Address Resolution Protocol) maps IP addresses to MAC addresses on a local network. When you ping a local device, your machine checks its ARP cache. If the entry is wrong, packets go nowhere.

Commands:

• arp -a displays the current ARP table.
• arp -d deletes a specific entry, forcing a fresh lookup.
• On Linux, ip neigh shows the neighbor table.

If you can’t reach a local device but know its IP, check the ARP table: if the entry shows an incomplete MAC, the device isn’t responding to ARP, meaning it’s off, on a different VLAN, or has a firewall blocking ARP (rare).

Putting It All Together: A Diagnostic Sequence

When a user says “the internet is down,� follow this order:

1. ipconfig (or ip addr)—verify you have an IP, subnet, and gateway.
2. ping 127.0.0.1—tests your own TCP/IP stack. If this fails, the stack is corrupt (rare).
3. ping —tests local connectivity to the router.
4. ping 8.8.8.8—tests internet routing without DNS.
5. nslookup example.com—tests DNS resolution.
6. tracert 8.8.8.8—if step 4 fails, trace to see where it stops.
7. netstat -an—if you’re trying to reach a specific service, check if it’s listening.

This sequence isolates the problem in minutes. If step 3 fails, the issue is local (cable, Wi-Fi, router). If step 4 fails but step 3 works, the problem is upstream (ISP, firewall). If step 5 fails but step 4 works, it’s DNS.

Common Pitfalls and Misconceptions

• Ping is not always reliable—ICMP can be blocked, so a timeout doesn’t mean the host is down.
• Don’t ignore IPv6—many systems prefer IPv6; if your IPv6 is broken, ping to a hostname may fail even though IPv4 works. Use ping -4 or ping -6 to force a version.
• TTL values differ—Windows defaults to TTL 128, Linux to 64. A reply with TTL 127 means the host is one hop away, not that it’s misconfigured.
• Traceroute can be slow—each hop waits for a timeout, so a full trace can take minutes. Use -w to set a shorter timeout (e.g., tracert -w 1000 for 1 second).
• ARP cache can be stale—after a device’s IP changes, the old MAC lingers. Delete the entry with arp -d to force a refresh.

Frequently Asked Questions

What if ping works but the website won’t load?

That usually points to DNS or a firewall blocking the specific port (80/443). Check DNS with nslookup, then test the port with telnet 80 or Test-NetConnection on PowerShell. If the port is blocked, the server or a firewall is the issue.

Why does traceroute show * * * for a hop?

Asterisks mean the router didn’t reply to the ICMP probe. Many routers are configured to drop ICMP for security or performance. If later hops respond, the trace is still valid; the missing hop just doesn’t answer.

How do I find my IP address on Windows?

Open Command Prompt and type ipconfig. Look for “IPv4 Addressâ€� under your active adapter (Wi-Fi or Ethernet). If it starts with 169.254, you’re not getting a DHCP address.

What’s the difference between tracert and traceroute?

They’re the same command; tracert is the Windows name, traceroute is the Unix/Linux name. Functionally identical, though the flags differ slightly.

Can I use these commands on macOS?

Yes. macOS has ping, ifconfig, traceroute, nslookup, dig, netstat, and arp. The syntax is closer to Linux, so use ping -c 4 instead of ping -n 4.

What does “Request timed out� mean exactly?

It means your machine sent the ping but received no reply within the timeout (default 4 seconds on Windows). It could be a network issue, a firewall, or the host being offline. It does not definitively prove the host is down.

Related

• Retro Computer Looks: Ranking the Classics by Design
• Old TV Christmas Decor Hacks You Need to See
• SSD Long Term Storage: Don’t Use It, Do This Instead