Network Troubleshooting

Troubleshooting at Physical Layer

Objectives

• Identify the characteristics of a physical layer

failure problem
• Identify the characteristics of a physical layer
optimization problem
• Identify end-system commands and applications
that gather physical layer component information
• Identify the Cisco commands and applications
that gather physical layer component information
• Recognize possible causes of common physical
layer problems
• Isolate a problem at the physical layer
CHARACTERISTICS OF PHYSICAL
LAYER FAILURE PROBLEMS
Critical characteristics – connectivity
• Anytime that there is a physical layer failure,
a loss of connectivity will be experienced.
• If a technician can log in to one of the
affected devices and start gathering
information, it will be evident that no
component above the physical layer is
operating.
• Unlike network failures, all cable failures are
approached in approximately the same
manner, whether the link is newly installed or
has failed during operation.
• Include visible damage to the cable, new
electrical noise sources near the cable, or
Critical characteristics – upper layer component
operation
• Depending on the location of
the fault, the following types
of communication
components may fail:
– All pings to external devices
would timeout.
– The user would not be able
to telnet into any other
device.
– The user would not be able
to access network drives.
– E-mail messages would not
be sent or received and
there may be an
undeliverable message to
this effect when attempting
to send.
– “Page cannot be displayed”
messages occur when
attempting to gain intranet
Noncritical characteristics – equipment indicators
• The Light Emitting Diodes (LEDs) on a device
can give feedback for diagnosing the
operational status of the device.
– When there is a physical problem with equipment,
the LEDs of the failing device are usually off,
flashing, or a different color than usual.
– Most LED link lights are now software controlled,
so they are no longer reliable as a sole indicator of
connectivity. If the link light is illuminated, it may
or may not mean that a valid link is present. If the
port is faulty, it may be possible to disconnect the
cable and still have the link light illuminated.
– If the link light is off however, then it is still a fairly
good indication that no link is present.
Noncritical characteristics – power failures
• Power failure
A power failure is characterized by a loss of power. Incoming
power is subject to blackouts, which are complete power outages,
often caused by downed power lines or electrical failures.
• Power spike
A power spike is a short burst of excessive power, usually lasting
less than 1/60 of a second. Unprotected electronic equipment is
vulnerable to this sudden, potentially massive, increase in
voltage. Power spikes are similar in nature to power surges, which
can last as long as several seconds.
• Brownouts
Brownouts are in-line power reductions of ten percent or more.
They are usually caused by utility company problems or a sudden
drain of electricity from a particular part of the power grid.
• Dirty power
Dirty power is caused by electrical circuits experiencing
transients and noise. Transients are brief high-speed electrical
fluctuations caused by lightning or improper grounding. Noise is
electromagnetic or radio frequency interference in the power
signal caused by disruption from the external power grid or by
feedback from local mechanical devices such as printers and
copiers.
Noncritical characteristics – console messages
• With a physical layer failure
problem, sometimes a
problem is discovered when a
device shows console
messages indicating that an
interface is not functioning.
– interface is down, line
protocol is down
(FastEthernet)
– initialized, down state
(Token Ring)
• An unattached Ethernet LAN
interface can be spoofed to an
interface is up, line protocol is
up state by issuing the no
keepalive command.
– Therefore, this command
should not be used in a
live network as a
substitute for testing at
the physical layer.
CHARACTERISTICS OF PHYSICAL
LAYER OPTIMIZATION PROBLEMS
Performance lower than baseline
• If there is a problem with sub-optimal operation at the
physical layer, the network will be operational, but
performance will be consistently or intermittently lower
than the level specified in the baseline.
• If performance varies and is not always unsatisfactory,
then the problem is probably related to an error condition
or is being affected by traffic from other sources:
– Unstable routing due to a marginal port or link somewhere
beyond the broadcast domain, possibly the result of a bad cable
– Excessive traffic across a low speed LAN or WAN link, possibly
causing traffic to be discarded or buffer capacity to be exceeded
– Overloaded server or service
• A physical layer optimization problem occurs when the
physical properties of the connection are substandard,
causing data to be transferred at a rate that is constantly
less than the rate of data flow established in the baseline.
Performance lower than baseline

• A number of factors can be involved in

decreasing the rate at which data is
transmitted across media. Major causes of
networks performing below baseline are:
– Exceeding the design limits of the media in terms
of cabling distance or of network devices
– Large collision domains in shared media networks
such as CSMA/CD Ethernet
– Electromagnetic Interference (EMI) effects
– Faulty media or hardware
Exceeding cable design limits, poor quality cabling and
connections
• Attenuation
A common issue of exceeding the design limits of a
media type is the attenuation of the bit-stream
transmitted along the media. Attenuation depends on
the media over which the traffic is being transmitted.
Attenuation may occur to such an extent that the
receiving device cannot always successfully distinguish
the component bits of the stream from each other.
• Each network media is rated for a specific distance.
Category 5 media has a maximum rated cabling
distance of 100m. Beyond that distance, the signal
must be regenerated or it may degenerate and be
unreadable by the receiving end. To get an accurate
measurement of the length of a cable, use a cable
tester.
Exceeding cable design limits, poor quality cabling and
connections
• Return Loss
Return loss is a measure of all
reflections that are caused by the
impedance mismatches at all
locations along the link. It
indicates how well the
characteristic impedance of the
cable matches its rated
impedance over a range of
frequencies. The characteristic
impedance of links tends to vary
from higher values at low
frequencies to lower values at
the higher frequencies. Return
loss is expressed in decibels.
– The termination resistance at
both ends of the link must be
equal to the characteristic
impedance of the link to avoid
reflections. A good match
between characteristic
impedance and termination
resistance in the end equipment
provides for a good transfer of
power to and from the link and
minimizes reflections. Return loss
results vary significantly with
Noise
• Local Electromagnetic Interference (EMI) is
commonly known as noise. There are four types of
noise that are most significant to data networks:
– Impulse noise - voltage fluctuations or current spikes
induced on the cabling
– Random (white) noise distributed over the frequency
spectrum
– Alien cross talk
– Near End Cross Talk (NEXT)
• The default threshold level for the detection and
registration of impulse noise is 270 mV (determined
by 10BASE-T specification in the IEEE 802.3i
standard). For high-speed network applications such
as 1000BASE-T (Gigabit Ethernet), the recommended
threshold value for impulse noise detection is 30 or
40 mV.
Collisions
• They typically result from the following problems:
– Bad cables
– Marginal or intermittent workstation NICs
– Marginal or intermittent ports on hubs or switches
– Errors or excessive traffic on the local collision domain
– Duplex mismatches
– Electrical noise and other environmental disruptions
• Collisions are normally a more significant problem on
shared media than on switch ports.
• If the average utilization is high (sustained peaks in
excess of 60 percent for shared media, and in excess
of 80-90 percent for switched links) and collision
counts are acceptable (average is below 5 percent
for shared media, and below 1 percent for switched
links), then the network may simply be saturated.
Collisions
• Late Collisions
A late collision is counted when a collision is detected
by a device after it has sent the 512th bit of its frame.
No more than a few late collisions should ever occur in
any environment. If a device is incrementing a collision
counter, further investigation is needed as a
significant problem is occurring. If the number of late
collisions is occurring at a steady rate, performance
degradation may be noted.
• Any of the following conditions may be causing late
collisions:
– Incorrect configuration
– Duplex mismatch (one host operating at half-duplex
while another host is operating a full-duplex)
– Faulty cabling
– Faulty hub or shared media device
– Faulty NIC or switch port
– Excessive network traffic beyond the limitations of the
Collisions
Other data transmission issues
• Short Frames
The most likely cause of a short frame is a faulty card, or an
improperly configured or corrupt NIC driver file.
• Jabber
Jabber, is often defined as the condition in which a network device
continually transmits random, meaningless data onto the network.
IEEE 802.3 defines a jabber as a data packet whose length exceeds
the standard. These packets are called long frames. Cyclically lock
the port out, then check later to see if it is ok. The standard says
that after the jabber timer expires (20,000 to 50,000 bit times)
then the hub should close the port for awhile before reopening the
port to see if the attached device has stopped transmitting.
• Ghosts
Ghosts are easily created by a variety of causes on coaxial
Ethernet. They may also be caused by something as simple as
installing a second crossover cable between two hubs on half
duplex 10BASE-T. The parallel path sometimes causes very strange
symptoms.
– Lock one port out, sometimes requiring a power cycle or SNMP
management intervention to reopen the port. This is fortunately the
most common result.
– Allow the error to continue uninterrupted. This is not permitted by the
standard.
Other data transmission issues
Resources
• If network resources are operating at or are near maximum
capacity, this can be the cause of physical layer problems.
– In some instances of sub-optimal network performance, data may
flow at expected rates, but it will start and stop unexpectedly.
– In other instances the data will flow continuously, but not at a
desirable rate.
• The following procedures assume that this connection has been
operating properly prior to this problem, and the following have
already been checked:
– Verified that nothing has been recently changed on the problem
station, or on the server or service that may have caused this
problem, such as reconfiguring or adding new software or
hardware.
– Eliminated potential station memory allocation problems and
software conflicts on the station by unloading all but the minimum
software required to operate a test application across the network.
For this test disable any virus checking or security software, but re-
enable it immediately after the test.
– Tested the user’s station for viruses and look for applications that
are consuming disproportionate amounts of the microprocessor
resources or hanging the system long enough to exceed connection
timers.
Resources
• The most common reasons for slow or poor
performance include overloaded or underpowered
servers, unsuitable switch or router configurations,
traffic congestion on a low capacity link, and chronic
frame loss.
Utilization
• A component may be operating sub-optimally
at the physical layer because it is being utilized
at a higher average than it is configured to
operate.
– Gathering symptoms reveals excessive runts, late
collisions, or an increase in the number of buffer
failures. The output from a ping or traceroute
command results in excessive packet loss or latency.
• How Much Utilization is ok?
Shared Ethernet networks are believed to suffer
from throughput problems when average traffic
loads approach a maximum average capacity
level of 40 percent. This percentage is actually
conservative. Higher average percentages are
certainly possible.
Utilization
• Another problem can occur when access to servers or
services is reached through a single switch uplink
path. Unless the bandwidth of the uplink path is
bigger than the total of simultaneous station
requests, the uplink itself becomes a bottleneck.
– This scenario arises when a network is designed with all
servers collected in a server farm, separated from the
VLANs they serve.
• Network bottlenecks or congestion typically
manifests itself to users with the following
symptoms:
– Highly variable response times
– Network time-outs or server disconnects
– Inability to establish network connections
–
Console messages
• All error messages begin with a percent sign,
and are displayed in the following format:
– %FACILITY-SEVERITY-MNEMONIC: Message-text
– FACILITY is a code, consisting of two to five
uppercase letters, indicating the facility to which the
message refers. A facility may be a hardware
device, a protocol, or a module of the system
software.
– SEVERITY is a single-digit code from 0 to 7 that
reflects the severity of the condition.
– MNEMONIC is a code, consisting of uppercase letters
that uniquely identify the message.
– Message-text is a text string describing the
condition. This portion of the message sometimes
contains detailed information about the event being
Console messages
 WINDOWS AND CISCO COMMANDS
FOR PHYSICAL LAYER INFORMATION
GATHERING
End-system commands – common commands
• The ping {host | ip-address} command is used to
verify connectivity between hosts by sending an
ICMP echo request to the target IP address. T
• The Arp –a is a very useful interrogatory command
because it establishes whether there is Layer 2 and
Layer 3 connectivity within a LAN segment.
End-system commands – Windows only
• The ipconfig /all command is a simple way
to check connectivity on a Windows system.
It will identify the host MAC address, DNS,
DHCP, NT and WINS servers that the host is
attached to if it has physical connectivity.
• The tracert command can be used to test
connectivity to a destination device. It will
enable a user to map the route taken on the
way to the destination.
• The winipcfg command is used in older
version of 9x Windows up to Me. As the name
suggests winipcfg will show the Windows IP
configuration information.
End-system commands – UNIX/Mac OS

• The ifconfig –a command performs the same

function that the ipconfig command
performs for Windows systems. It will list the
IP address information for a Mac OS X and
UNIX hosts.
• The traceroute command can be used to
show the path a packet takes through the
network. It is useful to identify at what point a
link is broken, or sub-optimal, in the network.
Common Cisco IOS commands
Cisco IOS show commands
IDENTIFYING PHYSICAL LAYER
PROBLEMS
Power related
• If a power related issue is suspected,
a physical inspection of the power
module is often carried out. Initially,
with the power switch on, does the
blower operate?
– If yes, the AC input checks out.
– If no, suspect the AC input, AC
source, router circuit breaker, or the
power supply cable.
– With the power switch on and
system LEDs lit, do the fans
operate?
– If no, suspect the fans.
– Does the system shut down after
being on a short time?
– Suspect an environmentally induced
shutdown.
– Check the environmental site
requirements in device
documentation and ensure that the
chassis intake and exhaust vents are
clear.
– Suspect a power supply failure, have
other devices in the area powered
down?
– System partially boots, but LEDs do
not light.
– Suspect a 5-volt (V) power supply
Power related
• To help isolate a power subsystem problem, follow
these steps:
• Check whether the power supply LED labeled GOOD
is on or the LED labeled FAIL is on.
• If the LED labeled GOOD is off or if the LED labeled
FAIL is on, take the following steps:
– Step 1
Ensure that the power supply is flush with the back of the
chassis.
– Step 2
Unplug the power cord, loosen and reinstall the power
supply, tighten the captive installation screws, and then
plug in the power cord.
– If the LED labeled GOOD remains off, there might be a
problem with the AC source or the power cable. Connect the
power cord to another power source if one is available.
– If the LED labeled GOOD fails to light after the power supply
is connected to a new power source, replace the power cord.
Cabling faults – CAT5
• Many problems can be corrected by simply
reseating cables that have become partially
disconnected. When performing a physical
inspection, look for damaged cables,
improper cable types, and poorly crimped RJ-
45s. Suspect drop cables should be subject to
a simple cable test, and exchanged with a
known-good cable.
– Do not assume that just because a cable is
new, just out of the package, that it will
work. Test it first.
• Anyone can have a bad day and miswire the
termination. Also test for simple cable faults
such as shorts, opens, and split pairs.
Cabling faults – fiber and coax
• All fiber links are crossed
over. The connectors are
always the same on stations
and infrastructure
equipment, so the TX output
is connected to the RX input
through careful attention to
the cable polarity.
• Check fiber for swapped
RX/TX connections when
polarized or small form factor
multi-fiber connectors are
not used.
• Someone may have
reconnected the cable
incorrectly after
disconnecting for some
Hardware

• When Layer 1 or Layer 2 hardware

components fail, a system will experience a
sudden loss of physical connectivity. There
are various occurrences in frames
transported over shared access media that
indicate a faulty NIC or interface in Layers 1-3
equipment.
• Check for link lights at both the station and
the hub or switch end. However, due to
increased software control the presence of a
link light is not a guarantee that the port
works. The absence of a link light is still a
Collision based problems – shared media
• Excessive collisions are most often caused by a
problem with the physical media, such as missing or
incorrect terminators, impedance discontinuities (bad
connectors, cable stubs, crushed cables, and so on),
and bad network interface cards.
• There are several things to watch for in relation to
collisions:
– Does the detected collision level track approximately with the
utilization level?
• If changes in utilization and collision levels track
together reasonably closely, then there may simply be
too many stations transmitting on the collision domain,
assuming that there is a collision problem at all.
– Are there spikes of detected collisions that do not follow the
utilization level?
Collision based problems – shared media
• One or more stations set to full duplex within
a collision domain will also cause this sort of
collision problem, as well as other errors.
– Are there collisions when there is no apparent
utilization to cause them?
• If there are abnormal numbers of collisions
taking place when there is little or no
utilization to cause them, then suspect a noise
source near a cable or hub.
– Use divide and conquer troubleshooting to isolate
the location of the fault, adding traffic to the
network from the monitoring tool while
troubleshooting.
– Are there approximately 33 percent or 100 percent
Collision based problems – shared media
• Some media-related problems are traffic-level
dependent. Try gradually raising the traffic level to
more than 50 percent, and at the same time
watching the error and collision levels.
– Many monitoring tools offer LED indicators for both, which
makes it much easier to vary the traffic level while watching
for resulting errors or elevated collision levels.
– Be careful when doing this because it can easily saturate the
network. Solving collision-related problems can be very
tricky because the measurements are largely dependent
upon the observation point.
• For UTP cable, test the entire cable path between the
hub and the station connection. Substitute a known-
good patch cable before testing, as patch cables are
the most likely source of the problem.
Collision based problems – shared media

• For coaxial cable, try a DC continuity test. About 25

ohms should be seen if both terminators are present
and testing occurs from a BNC T connection, or 50
ohms if testing from an end.
• For fiber-optic cable, check to see if the connections
are fully seated and clean. A loose connection or a
dirty connection can result in the receiver
misinterpreting input signals as a result of poor
signal quality, and usually results in other errors in
addition to collisions.
External interference
• One of the most notable causes of
Electromagnetic Interference (EMI) is
lightning. When electrical disturbances occur
in the environment they impact radio and
television broadcast signals.
• Noise
On any line, even in the absence of a data
signal, random fluctuations of the line voltage
and current will occur. This effect is known as
Line Noise Level, or simply Background Noise.
There are three main causes of this noise:
– Cross-talk
– Impulse Noise
External interference

• Cross-talk – Occurs when a signal on one

line is picked up by adjacent lines as a small
noise signal. Particularly troublesome is Near-
End Cross talk (NEXT) caused when a strong
transmitter output signal interferes with a
much weaker incoming receiver signal.
• Impulse Noise – This noise is caused by
external activity or equipment and generally
takes the form of electrical impulses on the
line. These impulses can cause large signal
distortion for their duration and can bring the
entire network down whenever they occur.
External interference
• Proper common-mode line terminations must be
used for the unused Category 5, UTP cable pairs 4/5
and 7/8. Common-mode termination reduces the
contributions to EMI and susceptibility to common-
mode sources. Wire pairs 4/5 and 7/8 are actively
terminated in the RJ-45, 100BASE-TX port circuitry in
the FE-TX port adapter
Configuration script errors
• Many things can be misconfigured on an interface to
cause it to go down. This will cause a loss of
connectivity with attached network segments.
Changing the subnet of an interface to a different
one from the directly attached network segment is
an obvious way to shut down their connection, but
this is not a physical layer problem.
• Other misconfigurations which are directly related to
the physical layer are:
– Serial links re-configured as asynchronous instead of
synchronous
– Incorrect clock rate
– Incorrect clock source
– Interface shutdown
• Switchport duplex configuration mismatches can
cause collisions or port shutdown to occur.
CPU overload
• The following list describes
common symptoms of high
CPU utilization. If any of these
symptoms are noticed, follow
the troubleshooting steps
below to alleviate the problem.
– High percentages in the show
processes cpu command
output
– Input queue drops
– Slow performance
– Services on the router fail to
respond, for instance:
1. Slow response in Telnet or
unable to telnet to the
router
2. Slow or no response to
ping
3. Router does not send
routing updates
CPU overload
• There are several reasons for high CPU utilization due to
interrupts:
– Voice ports are configured on the router, even if there is no
traffic, software continues to monitor channel associated
signaling (CAS).
– There are active Asynchronous Transfer Mode (ATM) interfaces
on the router, the ATM interfaces continually send out null cells
(per ATM standards) and continue to use CPU resources.
– An inappropriate switching path is configured on the router.
– The CPU is performing memory alignment corrections, if
%ALIGN-3-CORRECT messages are logged, then the high CPU
utilization is caused by memory alignment corrections, which
indicates that bugs in the version of the Cisco IOS used.
• If the router is overloaded with traffic, the show
interfaces and show interfaces switching
commands provide information about which interfaces
CPU overload
• Output from the show
interfaces switching command
can be used to see what kind of
traffic, protocol, and switching
path, is going through the
overloaded interface. If some
interfaces are too overloaded with
traffic, consider redesigning the
traffic flow in the network or
upgrading the hardware.
• A single device may be
generating packets at an
extremely high rate and
overloading the router. In this
case the Media Access Control
(MAC) address of that device can
be isolated by adding the ip
accounting mac-address
{input|output} interface
configuration command to the
configuration of the overloaded
interface.
– The show interfaces [type
number] mac-accounting or
show interfaces mac
commands display the collected
IDENTIFYING PHYSICAL LAYER
PROBLEMS
Methodology
• To isolate problems at the • Ensure the cable is correctly wired.
physical layers do the following: • Check to make sure that all cables
• Check for bad cables or connections. are connected to their correct ports
• Verify that the cable from the source or interfaces.
interface is properly connected and • Make sure that any cross-connects
is in good condition. When doubting are properly patched to the correct
the integrity of a cable, swap location.
suspect cables with a known working • Verify proper interface
cable. configurations.
• If in doubt that the connection is • Check that all switch or hub ports
good, remove the cable, do a are set in the correct VLAN or
physical inspection of both the cable collision domain, and that Spanning
and the interface, and then reseat Tree, speed, and duplex settings are
the cable. Use a cable tester with correctly configured. Confirm that
suspect wall jacks to ensure that the any active ports or interfaces are not
jack is properly wired. A glowing link shut down.
light will also be an indicator of a
successful connection. • Check operational statistics and data
error rates.
• Check that the correct cabling
standard is adhered to throughout • Use Cisco show commands to check
the network. for statistics such as collisions, input,
and output errors. The
• Verify that the proper cable is being characteristics of these statistics will
used. A crossover cable may be vary depending on the protocols
required for direct connections used on the network.
between some devices.
Methodology
Tools for the job
• There are two primary
categories of physical
layer analyzer products.
– Cable testers
– Handheld network testers
(hybrid)
• Other common tools
that are used for trouble
shooting at OSI Layers 2
to 7 are Protocol
Analyzer and Network
Management Tools.
Bad cabling
• Before troubleshooting a failing cable, verify the tester
configuration.
– This step is critical to obtaining accurate test results, as
testers capable of Category 5e and higher performance utilize
a wide selection of cable interface adapters and may have
somewhat complicated test configurations.
– At a minimum, verify that the correct test specification and
link type has been selected.
• Most wiremap failures occur at cable terminations,
either at the RJ-45 (plug or jack), or at an intermediate
crossconnect or patch panel. Faults at the RJ-45 can
usually be seen by checking the wire colors carefully
against T568A or T568B pinout colors, or by checking
the RJ-45 plug for wires that did not seat fully to the
end of the connector when it was crimped.
Bad cabling
• Propagation Delay and Delay Skew
TIA/EIA-568-B permits up to 498 ns of propagation
delay for the Permanent Link and up to 555 ns of
propagation delay for the Channel Link, for all
Categories. It is unlikely that this parameter could fail
without other parameters failing as well. Failing
propagation delay suggests an inappropriate or bad
cable in the link.
• Delay Skew
Delay skew occurs as a result of different wire pairs
within a cable being insulated with different materials.
This could occur if there is an industry supply problem
for a favored insulating material.
– TIA/EIA-568-B permits up to 44 ns of delay skew for the
Permanent Link and up to 50 ns of delay skew for the
Bad cabling
Cabling incorrect
• Check for wires that were not fully seated in
the crimping process.
• Also check to see if the correct type of RJ-45
was used, stranded or solid wire pins. This is
difficult once the end has been crimped.
• Cabling length is also a major issue.
– Do not install long cables. Make all runs as short
as possible, certainly no longer than is permitted
by the media access protocol being used. For
example, never install UTP runs longer than 100
meters.
– Whether building cables onsite or buying pre-
made cables, be sure to test them with a reliable
cable tester before use, especially if already in
Cabling incorrect
Interface configuration
• Prior to examining the interface configurations on
network devices, it is important to discount the
physical causes first:
– Verify cable connectivity.
– Verify that the power supply is on and running.
– Verify the router LED status. If all LEDs are down, it is most
likely an issue with the power supply of the device, or with
incorrectly seated modules in a modular router or switch.
Interface configuration
• When examining interfaces on a Layer 2 switching
device:
– Start by looking for duplex and speed mismatches.
– Ensure that the correct VLAN encapsulation method has
been applied if the port is a trunking port, and that the
port has been designated for trunking rather than
access.
– Ensure that individual ports have been assigned to the
EtherChannel group for trunking ports combined to form
an EtherChannel.
– Ensure that the port has not been accidentally assigned
an IP address. On 3550 and 6500 series switches, the no
switchport command and an IP address converts the
switch port to a routing port.
– Look under port configuration to make sure it has not
Interface configuration
• When examining a Layer 3 device:
• Ensure that the IP addressing on both sides of the
link is within the same subnet.
• Ensure that the interface is not administratively shut
down.
• Ensure that serial ports designated as Data Clocking
Equipment (DCE) end are assigned the correct clock
rate for the link.
• Console Not Responding
Console problems occur when the router becomes
unresponsive to input at the console port. If the
console is not responsive, it means that a high
priority process prevents the console driver from
responding to input. If traffic is still flowing through
the device, try disconnecting network interfaces and
see if the router starts responding.
– Many times the router thinks it is doing something too
Operational statistics

• Operational statistics can also be gained from

centrally located network analysis software or
even dedicated hardware.
• Simple Network Management Protocol (SNMP)
can be used to get each SNMP capable
network device to report back to a central
monitoring host which is loaded with software
to interpret input from network devices.
• Similarly the Network Analysis Module (NAM),
designed for Cisco 6500 series devices can
become the nerve center for analysis of
network function.
IMPLEMENTING PHYSICAL LAYER
SOLUTIONS
Solving common problems – methodology
• Make initial configuration • The network should be returned
changes. to the baseline operation and no
• If the correction requires more new or old symptoms should be
than one change, make only one present. If the problem is not
change at a time. solved, undo all the changes
made. If new or additional
• Evaluate and document the problems are discovered during
results of each change made. trouble-shooting and problem
• If the problem-solving steps are correction, step back and modify
performed and the results are the correction plan.
unsuccessful, immediately undo • If necessary, get input from
the changes. If the problem is outside resources.
intermittent, it may be
necessary to wait to see if the • If none of the attempts to
problem occurs again before correct the problem are
evaluating the effect of any successful, take the problem to
changes. another person. This may be a
coworker, consultant, or Cisco
• Stop making changes when the Technical Assistance Center
original problem appears to be (TAC). On rare occasions it may
solved. be necessary to perform a core
• Verify that the changes made dump, which creates output that
actually fixed the problem a specialist at Cisco Systems
without introducing any new can analyze.
problems. • Once the problem is resolved,
Solving common problems – methodology
ARP commands
• The address resolution protocol is used by the IP network layer
protocol to map IP network addresses to the hardware
addresses used by the data-link protocol. The protocol operates
below the network layer as a part of the OSI data-link layer, and
is used when IP is used over the Internet.
• A protocol known as the Address Resolution Protocol (ARP) is
therefore used to translate between the two types of address.
• An end-station will construct an Address Resolution Table when
it is connected to a network and attempting to communicate
with devices on its LAN segment. To reduce the number of
address resolution requests, a client normally caches resolved
addresses for a (short) period of time.
• The ARP cache is of a finite size, and would become full of
incomplete and obsolete entries for computers that are not in
use if it was allowed to grow without check.
Solving common problems – Windows, UNIX/MAC OS
end-system commands
• On Windows systems the
ipconfig command can be
used to establish if a NIC has
successfully bound to the
required IP address.
• Sometimes a NIC will not
release an old IP address.
Using the ipconfig /release
command option forces the
NIC to release the currently
held address.
– Following with the
ipconfig /renew command
causes the NIC to attempt to
bind to an address supplied
by a DHCP server, or to a
manually configured IP
address.
• For UNIX and Mac OS X end-
systems the ifconfig –a
command can be used to
establish if a NIC has bound
Solving common problems – Cisco IOS
commands
• Interface configuration is a
common source of physical layer
problems. If an interface
configuration does not match
the corresponding configuration
of a port on an attached device
then the interface status will be
either:
– interface is down, line
protocol is down
– interface is up, line protocol
is down
• Commonly on serial interfaces
lack of physical connectivity
could occur because the
interface at the clocking end has
not been set with a clock rate,
or it has been set incorrectly.
Also the no shutdown
command must be applied to
the interface; otherwise it will
remain in an administratively
down state, which means that it
has effectively been turned off.
Redundancy
• When installing or maintaining a network it is important to have
contingencies in place to counter physical layer problems. The
presence of an Uninterruptible Power Supply (UPS), surge
protectors, or line filters can protect a network from short term
power interruptions, brownouts, and power spikes.
• Core layer hardware should have replacement units on hand. It
is a good idea to install modular hardware wherever possible. In
that way the failure of a single module will not result in the
entire device being taken off line. Having replacement modules
in store is also cost effective.
Solving common problems – support resources
• Online resources represent an invaluable tool for the network
troubleshooter.
• The Cisco systems web site reached at http://www.cisco.com/
incorporates customer support, press-release information and a
free knowledge base tool on all things Cisco.
• Other highly useful resource sites are as follows:
– Microsoft website: http://www.microsoft.com
– Apple website: http://www.apple.com
– Sun website: http://www.sun.com
– Linux website: http://www.linux.org
– Protocols in general: http://www.protocols.com
• Vendor websites also contain a wealth of information and
support resources.
– http://www.dell.com
– http://www.gateway.com
– http://www.ibm.com
– http://www.toshiba.com
Solving common problems – support resources
Summary
Summary
• Characteristics of physical layer problems
• Characteristics of physical layer optimization problems
• End-system and Cisco commands and applications for
gathering information about physical layer components
• Common physical layer problems
• Guidelines for isolating problems at the physical layer
• End-system and Cisco commands and applications for
configuring physical layer components
• Common physical layer problem resolutions
• Support resources for troubleshooting physical layer
components
• A procedure for correcting physical layer problems