Host Connectivity Troubleshooting

Objective 1.6 starts on the host

CCNA v2.0 objective 1.6 is host connectivity: wired and wireless clients on Windows, macOS, and Linux. The user says the Internet is down, the share is gone, or Wi-Fi will not connect. The facts behind that sentence are still network facts. Does the NIC have a link? Did DHCP finish? Is the address in the right subnet? Is the default gateway the router on that LAN? Can a name become an address? On wireless, do the SSID and the security parameters match what the AP is actually offering?

Exam trap: a populated IP address does not mean the client works, and an empty lease does not mean the NIC is dead. Read the address, the mask, the gateway, and the DNS servers before you touch hardware.

One ladder for three operating systems

Memorize the order, then map it onto whatever OS the stem shows. Link or association. Address, prefix, and gateway. ARP or neighbor entry for the gateway. Ping the gateway. Ping a far IP that should not depend on DNS, such as the DNS server itself. Resolve a name. Open the application port. Stop at the first rung that fails and work that rung until it passes. Skipping ahead is how a DHCP problem becomes a three-hour routing redesign.

The same rung has different commands. Windows likes `ipconfig /all`, `route print`, `arp -a`, `ping`, `tracert`, and `nslookup`. macOS likes the Network panel plus `ipconfig getpacket`, `route -n get default`, `arp -an`, `ping`, `traceroute`, and `dig`. Linux likes `ip addr`, `ip route`, `ip neigh`, `resolvectl` or `nmcli`, `ping`, `tracepath`, and `dig`. The nouns change. The decision does not.

Exam trap: success at a lower rung does not certify the rungs above it. Ping to the gateway proves the gateway answered ICMP from this host. It says nothing about DNS, about a firewall on TCP 443, or about a proxy the browser is forced to use.

Windows: read ipconfig before you renew

`ipconfig /all` is the Windows exhibit. Check the adapter name so you are not diagnosing a disconnected Ethernet NIC while the user is on Wi-Fi, or a Hyper-V vEthernet that grabbed the default route. DHCP Enabled, the IPv4 address, the mask, the default gateway, the DHCP server, the lease times, and the DNS servers are the block you recite. A description of “Media disconnected” means there is no link. An address in 169.254.0.0/16 with a 255.255.0.0 mask is APIPA: the stack gave up on DHCP and invented a link-local IPv4 address. APIPA has no default gateway. That host will not route anywhere.

`ipconfig /release` and `ipconfig /renew` only help a DHCP client. They do nothing useful for a static misconfiguration, and they do nothing if the NIC is disabled or the cable is dark. `route print` shows the 0.0.0.0/0 route, the interface it uses, and the metric. A VPN client often installs a more preferred default route and black-holes corporate traffic that used to work on the LAN. `arp -a` should show the gateway’s MAC. If the gateway IP is missing, the host is not hearing ARP replies. If the MAC is not the router’s MAC, think duplicate IP or ARP spoofing and go to the switch CAM table.

Name resolution is `nslookup`. Ask for the name, then ask the same name against a specific server (`nslookup files.example.com 192.0.2.53`) so you can separate “my configured resolver is dead” from “the record is wrong.” `ping -4` forces IPv4 when Windows prefers an IPv6 destination that has no working path. `tracert` is the Windows traceroute. For Wi-Fi, `netsh wlan show interfaces` reports state, SSID, BSSID, radio, channel, signal, authentication, and cipher. `netsh wlan show profiles` lists the saved networks. Those two commands are how you prove the laptop joined Guest with WPA2-Personal instead of Corp with WPA2-Enterprise.

Exam trap: `ipconfig` without `/all` hides the DHCP server, the DNS list, and whether the address is static. “Unidentified network” is often APIPA or a missing gateway, which you confirm in the address block. A host firewall can drop inbound echo requests while the user’s outbound sessions still work, so “I cannot ping this PC” is a poor test of whether that PC can reach a server.

macOS: the panel, then the packet

System Settings, Network, then the active service (Wi-Fi or Ethernet) shows IP address, subnet mask, router, and DNS in one place. A status of Self-Assigned IP is the macOS face of APIPA, the same 169.254.0.0/16 story as Windows. Option-click the Wi-Fi menu for the live radio facts: RSSI, noise, channel, PHY mode, security type, and BSSID. That panel is enough to answer “which SSID, which security, which AP” without a packet capture.

The interface name is not a universal constant. On many laptops `en0` is Wi-Fi and `en1` is a dock or Ethernet; on some desktops it is the reverse. Trust the Network panel’s service name, or `networksetup -listallhardwareports`, before you configure the wrong device. `ipconfig getifaddr en0` prints the address. `ipconfig getpacket en0` prints the DHCP lease: yiaddr, the router option, and the domain-name-servers option. If `getpacket` fails and the GUI shows Self-Assigned IP, DHCP never completed. `route -n get default` names the gateway and the interface that owns the default route. `netstat -rn` is the full table when a VPN or a second adapter is also installed. `arp -an` is the neighbor cache.

Exam trap: memorizing “en0 means Wi-Fi” fails on the machine where it does not. A link-local IPv6 address beginning with fe80:: is normal on a healthy Mac. It becomes evidence only when it is the only address and the user needed a global unicast or an IPv4 lease.

Linux: address, route, resolver, radio

`ip -br addr` is the short exhibit. `UP` means the admin state is up. `NO-CARRIER` means the driver is up and the link is down: cable, switch port, err-disable, or a radio that is not associated. An address of 169.254.0.0/16 again means IPv4 autoconfig because DHCP failed. `ip route` must show a default route (`default via …`) out the interface the user is actually using. `ip neigh` is ARP and Neighbor Discovery in one table. A gateway stuck at `FAILED` or missing means you have not proved L2 to the router yet.

DNS on modern Linux is easy to misread. `/etc/resolv.conf` often contains only `nameserver 127.0.0.53`. That is the systemd-resolved stub, and it is healthy. The upstream servers are in `resolvectl status`. `resolvectl query files.example.com` tests the path the host really uses. Editing resolv.conf and deleting the stub breaks resolution until the next reboot or NetworkManager rewrite. `dig @192.0.2.53 files.example.com` still talks to a chosen server directly when you want to bypass the stub.

Wi-Fi is usually NetworkManager. `nmcli device status` shows which device is connected to which SSID. `nmcli device wifi list` shows visible BSS, signal, and security flags. `nmcli connection show` reveals the saved profile: SSID, key management (`wpa-psk` versus `wpa-eap`), and the static-versus-auto address method. `iw dev` gives the low-level interface. `tracepath` is useful beside `traceroute` because it reports the path MTU when a large transfer fails and a small ping works. `journalctl -u NetworkManager --since '10 min ago'` is where DHCP timeouts and 802.1X failures get written when the GUI only says “activation failed.”

Exam trap: installing a static address in `/etc/network/interfaces` on a host that NetworkManager still owns will look configured and will not be the address in `ip addr`. Confirm the process that owns the interface before you edit a second config file. `ping` to a name tests DNS and ICMP together. Ping the gateway by IP first so a missing A record does not get blamed on routing.

Wired: the link, the VLAN, and the mask

A link that is up with APIPA means DHCP Discover never produced a usable Offer. On a switched LAN that is usually the VLAN, the SVI or relay, an exhausted pool, or a DHCP snooping drop. The client cannot tell those apart. What the client can tell you is the negative fact: no lease, no server address in `ipconfig /all` or `ipconfig getpacket`. Take that fact to `show vlan brief`, `show interfaces status`, `show ip dhcp snooping binding`, and the relay configuration. A static address in the wrong VLAN looks similar from the user’s chair and different in the exhibit: the address is present, it is not 169.254, and a ping to the gateway times out because the gateway the human typed is not on this broadcast domain.

The mask decides whether the host ARPs or routes. If the mask is too short, distant addresses look local, the host ARPs for them, and the real gateway is never used. If the mask is too long, the real gateway can look remote and the host refuses to use it, or on-link servers look off-link. A duplicate address causes intermittent reachability and “IP conflict” warnings; the ARP cache flips between MACs. Check the switch CAM for the same IP claimed by two ports only after the host evidence says the address is unstable.

Exam trap: “I can ping some hosts on my subnet and not the gateway” is often a mask or a wrong gateway address, and it is sometimes a host firewall on the gateway’s ICMP. “I can ping the gateway and 8.8.8.8, and the browser still fails” moves you to DNS, proxy, or the application port. Do not re-address a host that is already proving L3.

Wireless: association is not a lease

A strong signal and no association is a parameter mismatch or a radio the client cannot use. WPA3-only SSIDs reject WPA2-only clients. A 6 GHz BSS rejects a radio that only speaks 2.4 and 5 GHz. A hidden SSID requires the profile to contain the exact name; hiding the name is not an access-control feature, and a mistyped profile looks like “the network disappeared.” A weak RSSI or a noisy 2.4 GHz channel associates and then drops, which users describe as “it connects and kicks me off.” That pattern is RF or roaming, and it is a different ticket from “wrong password,” which fails before a lease.

Captive portals sit in the middle. The client associates to an open or PSK guest network, gets an address, and the controller intercepts HTTP until someone taps Accept. ICMP to the gateway may succeed while HTTPS to the Internet fails, or the OS may show a portal login and the user may call that “no Wi-Fi.” Ask whether a browser redirect appears. That single question separates a portal from a missing default route.

Security parameters the client must match

WPA2-Personal uses a pre-shared key and a 4-way handshake after open-system association. The passphrase is case-sensitive and is mixed with the SSID to build the key, so the same passphrase on a renamed SSID does not work. A wrong PSK fails during the handshake. The user sees “cannot connect” or an authentication error, and DHCP never starts. WPA3-Personal uses SAE instead of the WPA2 handshake. A WPA3-only SSID will not accept a WPA2-only profile. Transition mode (WPA2/WPA3 on one SSID) lets both clients on, and a stem that says older scanners cannot join after a “security upgrade” is pointing at WPA3-only or at protected management frames those clients cannot do.

Enterprise is 802.1X. The SSID does not have a single PSK. The client runs an EAP method inside 802.1X, the AP or WLC proxies it, and a RADIUS server accepts or rejects the user. PEAP with MSCHAPv2 is username, password, and a trusted server certificate. EAP-TLS is a client certificate plus a trusted server certificate. Failures that look like a “bad password” to the user include an untrusted RADIUS certificate, an expired client certificate, a clock skew that makes a valid certificate look not-yet-valid, a wrong outer identity, or an EAP method the server does not allow. The laptop’s 802.1X log or NetworkManager journal names the EAP failure. The RADIUS log names the reject reason. Check both before you reset the user’s password for the third time.

After enterprise authentication the server can assign a VLAN. The client then requests a DHCP lease in that VLAN, not in the VLAN of the AP’s management subnet. A user who authenticates and lands in a quarantine VLAN has a lease, a gateway, and no path to the file server. That is policy, and the client security profile did its job. Wired 802.1X uses the same EAP ideas on a switch port; the symptom is “no lease until the user signs in,” and the exhibit is the switch authentication session plus the same client profile.

Traps and a self-check

Before you leave the day, answer these from memory. You are handed a Windows `ipconfig /all` showing 169.254.12.8, mask 255.255.0.0, blank gateway, media state connected. What failed, and what do you check on the switch? A Mac shows a solid Wi-Fi icon, a Self-Assigned IP, and a security type of WPA2 Personal. Which rung failed? A Linux `nmcli` printout says the device is connected to SSID Guest with `wpa-psk`, `ip route` has a default, and `dig` of the intranet server returns NXDOMAIN. Where is the break? An enterprise user “changed nothing,” the RADIUS log says success, and the client landed in VLAN 99 instead of VLAN 20. What do you inspect next, the PSK or the authorization VLAN?