Network administration and troubleshooting

In short

Network administration is the day-to-day work of planning, configuring, securing, monitoring and documenting a network - switches, routers, firewalls, wireless controllers, addressing, naming and user access - so that users and applications get reliable connectivity. Troubleshooting is the disciplined part of that work: isolating a fault to a layer, a device, a link or a configuration line using a repeatable method and standard tools (ping, traceroute, ARP/MAC tables, packet capture, logs, SNMP graphs). It is examined in Computer Networks, Network Management and System Administration papers, in GATE questions on ARP/DHCP/NAT behaviour and command output, and in vendor certifications (CCNA, CompTIA Network+, RHCSA networking). Every Indian IT services employer (TCS, Infosys, Wipro, HCLTech, Tech Mahindra, LTIMindtree), every ISP and telco (Jio, Airtel, BSNL, ACT), and every NOC/managed-service provider hires for exactly this skill set at entry level. Indian practice is also shaped by law - CERT-In directions on log retention and incident reporting, TRAI quality-of-service rules, and TEC/BIS equipment certification.

Explained

What a network administrator actually does

• Planning and addressing: allocate IP blocks and VLANs, maintain an IPAM sheet or tool, plan DHCP scopes and reservations, assign static addresses to infrastructure.
• Device configuration: switch ports (access/trunk), routing (static, OSPF, BGP at the edge), NAT, DHCP relay, ACLs, QoS, VPN tunnels, wireless SSIDs and controllers.
• Operations: firmware/patch management, configuration backups, change windows, capacity reviews, licence and AMC tracking.
• Monitoring and alerting: SNMP polling, NetFlow/IPFIX, syslog collection, uptime and threshold alerts, bandwidth and error-counter graphs.
• Security hygiene: port security, 802.1X, management-plane hardening (SSH not Telnet, AAA/TACACS+ or RADIUS), firewall rule review, segmentation.
• Documentation: logical and physical topology diagrams, port/patch-panel records, IP register, change log, runbooks and escalation matrix.
• SLA and reporting: availability (uptime %), MTTR, ticket trends; the commercial measure on which managed-service contracts are paid.

Structured troubleshooting methodology

1. Define the problem precisely: who, what, since when, how many users, what exactly fails (name resolution? connectivity? slowness?). "Internet not working" is not a problem statement.
2. Establish scope: one user, one VLAN, one site, or everyone - scope immediately narrows the suspect list.
3. Check what changed: configuration change, firmware upgrade, new device, power event, ISP maintenance. Most faults follow a change.
4. Form a hypothesis and test the cheapest check first - physical link LED and cable before reconfiguring routing.
5. Isolate by layer using one of three approaches: bottom-up (Layer 1 upward - best for suspected physical faults), top-down (application downward - best when one app alone fails), divide-and-conquer (start at Layer 3 with ping, move up or down based on result - the usual field choice).
6. Fix, verify, and confirm with the user; then document the root cause and resolution in the ticket.
7. Escalate with evidence - captures, traceroutes, timestamps, device logs - not just a complaint.
8. Follow-the-path principle: trace the packet's journey - host NIC → access switch → distribution/core → router/firewall → WAN → server - and test at each hop.
9. Swap test and split-half: replace a suspect cable/SFP/port with a known-good one; or test the midpoint of a path to halve the search space.

Layer-by-layer fault catalogue

• Layer 1 (physical): dead cable, bent/dirty fibre connector, wrong SFP type, exceeded cable length (100 m for Cat 5e/6 copper), damaged RJ45, no PoE budget, mains/UPS failure. Symptoms: no link light, port down, high CRC/FCS errors.
• Layer 2 (data link): duplex or speed mismatch (late collisions, slow transfer), wrong VLAN on an access port, missing VLAN on a trunk, native-VLAN mismatch, spanning-tree loop (broadcast storm, 100% CPU, flapping MAC addresses), MAC table overflow, port security shutdown (err-disable), bad NIC driver.
• Layer 3 (network): wrong IP/mask/gateway, duplicate IP, missing or wrong route, asymmetric routing, ACL deny, NAT misconfiguration, MTU/fragmentation black hole, exhausted DHCP scope, overlapping subnets after a VPN merge.
• Layer 4 (transport): blocked port on a firewall, service not listening, port exhaustion on a NAT device, TCP window/retransmission problems.
• Layers 5-7 (session to application): DNS failure or stale cache, expired TLS certificate, wrong proxy setting, authentication (AD/LDAP/RADIUS) failure, application server overloaded, captive portal.
• Rule of thumb: "can ping IP but not name" = DNS; "can ping gateway, not beyond" = routing/NAT/firewall; "nothing at all, no link light" = Layer 1; "works but slow" = congestion, duplex mismatch, errors, or Wi-Fi interference.

Core tools and what each proves

• ping (ICMP echo): reachability + round-trip time + loss. Options: -t continuous (Windows), -c count (Linux), -l/-s size, -f/-M do don't-fragment for MTU tests. A ping failure alone does not prove unreachability - ICMP is often filtered.
• traceroute / tracert / mtr / pathping: per-hop path and latency. Linux traceroute uses UDP by default, Windows tracert uses ICMP; both rely on incrementing TTL and ICMP Time Exceeded replies. A * * * hop may simply be a router not replying, not a break.
• ipconfig /all, /release, /renew, /flushdns, /displaydns (Windows); ip addr, ip route, ip neigh, nmcli, ifconfig (Linux, where ip has replaced the deprecated ifconfig).
• ARP: arp -a / ip neigh - maps IP to MAC on the local segment; proves Layer 2 adjacency and reveals duplicate IPs (same IP, changing MAC).
• DNS: nslookup, dig (dig +trace, dig @8.8.8.8 name A), host. Test by IP first, then by name, to separate DNS from connectivity.
• Sockets and ports: netstat -ano (Windows), ss -tulpn (Linux, replaces netstat), lsof -i; telnet host port, nc -zv host port, Test-NetConnection -Port (PowerShell) to prove a TCP port is open.
• Packet capture: tcpdump -i eth0 -nn host 10.1.1.5 and port 443 -w cap.pcap; Wireshark for analysis (display filters ip.addr==, tcp.flags.syn==1, dns, tcp.analysis.retransmission). A port mirror/SPAN session is needed to capture another device's traffic on a switch.
• Switch/router CLI: show interface status, show interfaces counters errors, show mac address-table, show ip arp, show vlan brief, show ip route, show spanning-tree, show log, show cdp/lldp neighbors, show running-config.
• Cable and physical testers: continuity/wiremap tester, Fluke-class certifier, OTDR and power meter for fibre, PoE tester.
• Monitoring platforms: Nagios, Zabbix, LibreNMS, PRTG, SolarWinds, Grafana+Prometheus; NetFlow/IPFIX collectors for who-used-the-bandwidth questions.

Protocols and services the admin must understand operationally

• ARP: broadcast "who has this IP" within a broadcast domain; proxy ARP and gratuitous ARP (used in failover and in ARP-spoofing attacks, countered by DHCP snooping + Dynamic ARP Inspection).
• DHCP: DORA - Discover, Offer, Request, Ack; lease time, scope, exclusions, reservations, options (3 gateway, 6 DNS, 15 domain, 66/67 TFTP boot); DHCP relay / ip helper-address when the server is on another subnet; rogue DHCP servers blocked by DHCP snooping on trusted ports.
• NAT/PAT: inside-local to inside-global translation; show ip nat translations; symptoms of exhaustion and of hairpinning failures; breaks inbound connections unless port-forwarded.
• VLANs and trunking: 802.1Q tagging, native VLAN, inter-VLAN routing by router-on-a-stick or an L3 switch SVI; VLAN mismatch is among the most common access-layer faults.
• STP/RSTP (802.1D/802.1w): elects a root bridge and blocks redundant links to prevent loops; PortFast on access ports, BPDU Guard, root guard; a physical loop without STP causes an immediate broadcast storm.
• First-hop redundancy: HSRP/VRRP virtual gateway IP; link aggregation (LACP, 802.3ad) for bandwidth and failover.
• Routing operations: administrative distance, longest-prefix match, static vs dynamic, OSPF neighbour states stuck in EXSTART (MTU mismatch) or INIT (one-way hello/ACL).
• Management and logging: SNMP v2c community strings vs SNMPv3 (authentication + encryption - the only version to use), syslog severity 0-7 (0 emergency to 7 debug), NTP for time-synchronised logs (without NTP, correlation across devices is impossible), configuration backup via TFTP/SCP.
• Wireless specifics: channel overlap (use 1, 6, 11 in 2.4 GHz), co-channel interference, low SNR, sticky clients, PoE budget, controller-AP tunnel (CAPWAP) down, DFS radar events on 5 GHz.

Performance troubleshooting and capacity

• Four metrics: throughput (bps), latency (ms RTT), jitter (variation in latency), packet loss (%). Voice and video need low jitter and loss far more than high bandwidth.
• Diagnose slowness by elimination: check interface error counters and duplex, then utilisation graphs, then end-to-end with iperf3, then a capture for retransmissions and zero-window events.
• Common throughput killers: duplex mismatch (half/full), bad cable raising CRC errors, saturated uplink, high-latency path with a small TCP window (bandwidth-delay product), MTU black hole blocking large packets while small pings succeed, Wi-Fi retries.
• QoS basics: classification/marking (DSCP EF 46 for voice, CS3/AF31 for signalling), queuing and shaping on the WAN link, where a 2 Mbps leased line must not let a backup starve voice.
• Capacity rule used in practice: plan for peak, not average; investigate a link sustaining above roughly 70-80% utilisation.

Indian standards, law and practice

• Cabling: structured cabling to TIA/EIA-568 and ISO/IEC 11801; India also follows IS 15611 / IS 14700 series for EMC and allied requirements; horizontal copper limited to 90 m permanent link + 10 m patch = 100 m channel.
• Equipment approval: telecom equipment needs TEC certification (MTCTE scheme under the Department of Telecommunications); electronics fall under BIS compulsory registration; Wi-Fi spectrum (2.4 GHz, 5 GHz and the delicensed lower 6 GHz band, 5925-6425 MHz, notified in 2025) is governed by WPC/DoT rules - check current notifications, as spectrum rules change.
• CERT-In Directions, 28 April 2022: reportable cyber incidents must be reported to CERT-In within 6 hours of noticing; service providers, intermediaries, data centres and body corporates must enable and securely maintain logs for 180 days within India; ICT system clocks must be synchronised to NIC or NPL time servers. This directly drives NTP and syslog retention design in Indian networks.
• Data protection: the Digital Personal Data Protection Act, 2023 governs personal data handling, including breach notification duties; the DPDP Rules, 2025 were notified in November 2025 with obligations phased in over 12-18 months, so verify what is currently in force.
• TRAI sets broadband quality-of-service benchmarks for ISPs; ISO/IEC 20000 and ITIL define incident/change/problem processes, and ISO/IEC 27001 the security management system that NOC procedures are audited against.
• IPv6: mandated in Indian government and telecom roadmaps (NIXI/DoT push); administrators must handle dual-stack, SLAAC, NDP (which replaces ARP) and ping6/ipconfig IPv6 output.

Key points

• Network administration - configuring, securing, monitoring and documenting network infrastructure so services stay available.
• Troubleshooting method - define, scope, check recent changes, hypothesise, test cheapest first, isolate by layer, fix, verify, document.
• Three isolation approaches - bottom-up (physical suspected), top-down (single application), divide-and-conquer (start at Layer 3).
• ping - proves Layer 3 reachability and RTT; silence may mean ICMP is filtered, not that the host is down.
• traceroute - uses increasing TTL and ICMP Time Exceeded to list hops; * means no reply, not necessarily a break.
• ARP table - IP-to-MAC on the local segment; a changing MAC for one IP indicates a duplicate IP or spoofing.
• DHCP DORA - Discover, Offer, Request, Ack; a 169.254.x.x address means DHCP failed (APIPA).
• Duplex mismatch - works but is very slow, with late collisions on the half-duplex side; fix by matching or using autonegotiation on both ends.
• VLAN mismatch - the single most common access-layer fault: wrong access VLAN, or VLAN not allowed on the trunk.
• STP - blocks redundant Layer 2 paths; without it a loop causes a broadcast storm; PortFast and BPDU Guard protect access ports.
• MTU black hole - small pings succeed, large transfers hang; test with don't-fragment pings and reduce MSS/MTU.
• DNS vs connectivity - if the IP works and the name does not, the fault is name resolution, not the network path.
• SNMPv3 over v2c - v2c sends community strings in clear text; v3 adds authentication and encryption.
• NTP - mandatory for log correlation; CERT-In requires Indian ICT clocks to sync to NIC/NPL sources.
• Syslog severity 0-7 - 0 emergency to 7 debug; central collection is the basis of the 180-day log retention requirement.
• Four performance metrics - throughput, latency, jitter, loss; real-time traffic is hurt most by jitter and loss.
• Availability and MTTR - the SLA numbers an administrator is measured on; uptime % and mean time to repair.
• Documentation - topology, IP register, port records and change log; an undocumented network cannot be troubleshot quickly.

Formulas and examples

Example 1 - SLA downtime budget. A managed-service contract promises 99.9% availability per month (30 days).

• Period = 30 × 24 × 60 = 43,200 minutes.
• Allowed downtime = 0.001 × 43,200 = 43.2 minutes per month.
• At 99.95% it halves to 21.6 minutes; at 99.99% it is 0.0001 × 43,200 = 4.32 minutes.
• If the link was actually down 95 minutes, availability = (43,200 − 95)/43,200 = 99.78% - the SLA is breached, and 95 − 43.2 = 51.8 minutes of credit-bearing downtime must be explained.

Example 2 - MTBF, MTTR and availability. A branch router ran 8,760 hours (one year), failed 4 times, with total repair time 10 hours.

• MTBF = 8,760/4 = 2,190 hours; MTTR = 10/4 = 2.5 hours.
• Availability = 2,190/(2,190 + 2.5) = 0.99886 → 99.886%.
• Reducing MTTR to 0.5 h (on-site spare) gives 2,190/2,190.5 = 99.977% - the cheapest availability gain is faster repair, not more reliable hardware.

Example 3 - ping statistics, loss and jitter. A branch sends 200 pings to the data centre; 194 reply, with RTTs cycling 40, 48, 42, 50, 44 ms.

• Loss = (200 − 194)/200 × 100 = 3% - well above the ≈1% limit tolerable for voice.
• Successive differences: |48−40| = 8, |42−48| = 6, |50−42| = 8, |44−50| = 6 → jitter ≈ (8+6+8+6)/4 = 7 ms (acceptable; voice typically wants under 30 ms jitter and under 150 ms one-way delay).
• Conclusion: the 3% loss, not the delay, is the voice-quality fault - chase interface errors and WAN congestion.

Example 4 - throughput, BDP and a slow transfer. A 100 Mbps link between Mumbai and Bengaluru has RTT 40 ms, and a 2 GB file takes far longer than expected.

• BDP = 100 × 10⁶ × 0.040 = 4 × 10⁶ bits = 4,000,000/8 = 500,000 bytes ≈ 500 kB.
• A host limited to a 64 kB window achieves at most 65,536 × 8 / 0.040 = 13,107,200 bps ≈ 13.1 Mbps, only 13% of the link - so enable TCP window scaling.
• At 13.1 Mbps, 2 GB (2 × 1,024 × 1,024 × 1,024 × 8 = 17,179,869,184 bits) takes 17,179,869,184/13,107,200 ≈ 1,311 s ≈ 21.8 minutes; with the full 100 Mbps it would be about 172 s ≈ 2.9 minutes.

Example 5 - MTU black hole test. Small pings succeed but a VPN-tunnelled file share hangs.

• ping -f -l 1472 10.10.5.1 (Windows) succeeds: 1,472 + 28 = 1,500 bytes - the LAN path is fine.
• The same test to the remote server fails at 1,472 but succeeds at 1,372 (1,372 + 28 = 1,400 bytes), so the tunnel path MTU is about 1,400 after IPsec overhead.
• Fix: set tunnel MTU to 1,400 and TCP MSS clamp to 1,400 − 40 = 1,360 bytes, or allow ICMP type 3 code 4 so Path MTU Discovery works.

Where it is used

• IT services and managed network operations: TCS, Infosys, Wipro, HCLTech, Tech Mahindra and LTIMindtree run 24×7 NOCs for global clients; entry roles are Network Engineer L1/L2 and NOC Analyst, measured on SLA and MTTR.
• Telecom and ISPs: Jio, Airtel, BSNL, Vodafone Idea, ACT and Hathway - access network faults, BNG/CGNAT issues, customer bandwidth complaints against TRAI QoS benchmarks.
• Enterprise and campus IT: banks (SBI, HDFC, ICICI), hospitals, manufacturing plants and universities - VLAN segmentation, Wi-Fi coverage, branch WAN/SD-WAN links, AD-integrated access.
• Data centres and cloud operations: colocation and hyperscale sites in Mumbai, Chennai, Hyderabad and Noida; fabric troubleshooting, VPC/VNet routing, security-group and load-balancer faults.
• Government and public networks: NIC, NKN, state data centres, railway and defence networks, with CERT-In logging, NTP synchronisation and audit requirements.
• Certifications and job roles: CCNA/CCNP, CompTIA Network+, JNCIA, AWS/Azure networking; roles such as Network Administrator, NOC Engineer, Network Security Engineer, Site Reliability/Infrastructure Engineer.

Interview questions

• Q: A user says "the internet is not working" - what do you check first? A: Scope it (one user or many), then check link light and IP configuration with ipconfig /all; ping the gateway, then a public IP, then a public name, which tells you whether it is Layer 1-2, routing, or DNS.
• Q: What does a 169.254.x.x address mean? A: APIPA self-assignment - the client could not reach a DHCP server, so suspect the port VLAN, a down relay/ip helper-address, an exhausted scope, or a dead DHCP service.
• Q: Ping to a server fails but the website loads - is the server down? A: No. ICMP is often blocked by firewalls or host policy; prove the service with telnet/nc -zv or Test-NetConnection on the actual TCP port.
• Q: How do you tell a DNS problem from a connectivity problem? A: Ping or browse the IP address directly; if the IP works and the name fails, it is DNS - verify with nslookup/dig against a known resolver and flush the cache.
• Q: What causes * * * in a traceroute? A: A hop that does not send ICMP Time Exceeded replies (rate-limited or filtered). If later hops still answer, the path is fine.
• Q: What is a duplex mismatch and how does it show up? A: One end at full duplex and the other at half; the connection works but is extremely slow, with late collisions and FCS errors on the half-duplex side. Fix by matching settings or autonegotiating both ends.
• Q: A whole VLAN goes down and switch CPU hits 100% - what do you suspect? A: A Layer 2 loop causing a broadcast storm; check show spanning-tree, look for MAC flapping and err-disabled ports, remove the redundant/looped link and enforce BPDU Guard and PortFast correctly.
• Q: Small pings work but large file transfers hang - why? A: A path MTU black hole: oversized packets are dropped and ICMP "fragmentation needed" is filtered. Find the MTU with don't-fragment pings and clamp MSS or lower tunnel MTU.
• Q: Explain DORA and where you would use a DHCP relay. A: Discover, Offer, Request, Ack is the DHCP lease exchange; a relay (ip helper-address) forwards client broadcasts as unicast when the DHCP server sits on a different subnet.
• Q: Why is SNMPv3 preferred over v2c? A: v2c authenticates only with a clear-text community string; v3 adds user authentication and payload encryption, which is required for any device exposed beyond a strictly isolated management network.
• Q: Why is NTP critical in network administration, especially in India? A: Without synchronised clocks, logs from different devices cannot be correlated during an incident; CERT-In's 2022 directions require Indian ICT systems to synchronise to NIC or NPL time sources and retain logs for 180 days.
• Q: Two devices have the same IP - how would you detect and fix it? A: Intermittent connectivity and an ARP entry whose MAC keeps changing; find both MACs via arp -a/show ip arp, trace them in the switch MAC table to physical ports, then correct the static address or add a DHCP reservation.
• Q: How would you capture traffic that is not passing through your own machine? A: Configure a SPAN/port-mirror session on the switch (or a TAP) and capture with Wireshark/tcpdump on the destination port, filtered to the hosts and ports of interest.

Common mistakes

• Changing configuration before isolating the fault - and changing several things at once, so the actual cause is never learned.
• Treating a failed ping as proof a host is down, ignoring that ICMP is routinely filtered.
• Skipping Layer 1: debugging routing for an hour on a link whose patch cord or SFP is faulty.
• Not recording the baseline (normal latency, utilisation, error counts), leaving nothing to compare an "abnormal" reading against.
• Confusing a mask/gateway error with a routing fault - or forgetting that two hosts in the same subnet never need the router at all.
• Leaving default credentials, SNMP v2c "public", and Telnet on management interfaces; or exposing management to the user VLAN.
• Closing a ticket without root cause, verification with the user, or a configuration backup and change-log entry.
• Writing exam answers that list commands without saying what each command proves - marks and interviews both reward the inference, not the syntax.

Related topics

• OSI and TCP/IP models · IP addressing and subnetting · TCP, UDP, HTTP and DNS · Windows Server and Active Directory · Data centres, storage and backup · IT support and help desk operations