Systematic diagnosis at every layer — from Physical to Application
Why you always start at Layer 1
Systematic layer progression — each layer depends on the one below it:
Cable, connectors, power, and the environment
Switch# show interfaces FastEthernet 0/1 FastEthernet0/1 is up, line protocol is up Hardware is Fast Ethernet Full-duplex, 100Mb/s Input errors: 847, CRC: 203, frame: 12, overrun: 0 Output errors: 0, collisions: 1402, late collisions: 891 ^-- CRC errors = cable or connector problem ^-- Late collisions = duplex mismatch (one end full, one end half) ^-- Input errors in general = Layer 1 physical problem
VLANs, STP, MAC tables, and ARP
shutdown then no shutdown unless auto-recovery is configuredSwitch# show vlan brief VLAN Name Status Ports 1 default active Fa0/1, Fa0/2 10 Sales active Fa0/3, Fa0/4 20 Engineering active Fa0/5 ^-- Fa0/6 not listed -- unassigned port; host gets no VLAN access Switch# show spanning-tree vlan 10 Root ID Priority 24586 Address aabb.cc00.0100 This bridge is the root Port Role Sts Cost Prio Type Fa0/1 Desg FWD 19 128 P2p Fa0/3 Desg BLK 19 128 P2p <-- Port stuck in Blocking Switch# show mac address-table interface Fa0/24 VLAN MAC Address Type Ports 10 aa:bb:cc:00:01 DYNAMIC Fa0/24 10 aa:bb:cc:00:02 DYNAMIC Fa0/24 ... (8000+ entries -- MAC flood attack; CAM table exhausted)
IP addressing, routing, ACLs, and DHCP
C:\> ipconfig /all IPv4 Address: 10.10.20.147 Subnet Mask: 255.255.0.0 <-- Wrong! Should be 255.255.255.0 (/24) Default Gateway: 10.10.20.1 Router# show ip route C 192.168.1.0/24 is directly connected, Gig0/0 S 10.0.0.0/8 [1/0] via 192.168.1.1 -- No route to 172.16.0.0/16 network; traffic to that range is dropped Router# show access-lists 10 permit tcp any any eq 80 (14892 matches) 20 deny ip any any (8847 matches) ^-- Implicit or explicit deny is blocking all non-HTTP traffic
TCP/UDP ports, firewalls, NAT, and connection state
C:\> netstat -an | findstr :443 TCP 0.0.0.0:443 0.0.0.0:0 LISTENING TCP 10.0.1.50:49201 93.184.216.34:443 ESTABLISHED TCP 10.0.1.50:49202 93.184.216.34:443 TIME_WAIT $ ss -tlnp State Recv-Q Send-Q Local Address:Port Process LISTEN 0 128 0.0.0.0:22 sshd LISTEN 0 128 0.0.0.0:80 nginx <-- Port 443 NOT in the list; HTTPS not listening Quick port reachability test (no dedicated tool needed): $ telnet 10.0.5.20 443 Connected to 10.0.5.20 <-- Port is open and accepting connections $ telnet 10.0.5.20 8443 telnet: connect to address 10.0.5.20: Connection refused <-- RST received
Authentication, TLS sessions, and VPN tunnels
$ openssl s_client -connect server:443 Verify return code: 10 (certificate has expired) SSL handshake has read 0 bytes and written 0 bytes Session-ID: 3A7F... Session Timeout: 20 (seconds) <-- Very short; uploads >20s will fail Mar 27 08:22:38 mail01 postfix/smtpd: TLS session renegotiation requested SSL_accept error: session ticket expired lost connection after DATA (23 seconds) ^-- Session timed out during message delivery (DATA phase) Router# show crypto isakmp sa dst src state conn-id slot 192.168.1.254 10.0.0.1 MM_NO_STATE 1001 0 ^-- IKE Phase 1 failed; Main Mode did not complete
Encoding, encryption format, and data representation
$ curl -v https://intranet.local/image.png > Accept-Encoding: identity < Content-Encoding: gzip < HTTP/1.1 415 Unsupported Media Type curl: (61) Error while processing content unencoding: false ^-- Client declared identity encoding; server sent gzip; decode failed $ openssl verify -CAfile chain.pem server.crt error 20 at 0 depth lookup: unable to get local issuer certificate ^-- Intermediate CA certificate is missing from the chain file Re-test after adding intermediate cert to chain.pem: $ openssl verify -CAfile chain-complete.pem server.crt server.crt: OK
DNS, HTTP errors, service config, DHCP, and email authentication
C:\> nslookup app.company.local *** can't find app.company.local: Non-existent domain C:\> nslookup 10.0.5.88 Name: app-legacy.company.local <-- Reverse works; forward A record is missing or renamed $ curl -I https://intranet.local/admin HTTP/1.1 403 Forbidden Server: nginx/1.24 $ tail /var/log/nginx/error.log [error] directory index of "/var/www/admin/" is forbidden ^-- nginx has autoindex off; no index.html present; access denied $ dig company.com MX company.com. MX 10 mail.company.com. -- dig mail.company.com A NXDOMAIN <-- MX record exists but the A record for mail.company.com is missing
A systematic bottom-up decision tree — work through every question before moving up
Layer-by-layer quick reference for N10-009
| Layer | First Thing to Check | Key Command(s) | Common Exam Scenario |
|---|---|---|---|
| L1 Physical | Link lights and cable condition | show interfaces |
Late collisions = duplex mismatch; CRC errors = cable fault |
| L2 Data Link | VLAN assignment on the port | show vlan brief |
Host unreachable on same switch = wrong VLAN or STP blocking |
| L3 Network | IP address, subnet mask, and gateway | ping + traceroute |
Can reach local but not remote = wrong mask or missing route |
| L4 Transport | Port reachability from the client | netstat -an + telnet |
Service runs but unreachable = firewall blocking the port |
| L5 Session | Certificate validity and session timeout | openssl s_client |
Connects then drops = VPN IKE failure or expired certificate |
| L6 Presentation | Content-Encoding and certificate chain | curl -v |
Data arrives but is garbled = encoding or cipher mismatch |
| L7 Application | DNS resolution for the target name | nslookup + service logs |
All lower layers pass but app fails = missing DNS record or misconfigured service |
This module maps directly to the following CompTIA Network+ N10-009 exam objectives: