1. LAN Fault Classification
Network issues can be categorized based on their nature into physical failures and logical failures. Additionally, they can be classified by their targets into line failures, routing failures, and host failures. LAN fault classification and troubleshooting is essential for effectively managing these issues.
1.1. Classification according to the different nature of network failures
Physical failure: Physical failure refers to situations such as damage to the equipment or line, loose plugs, or severe electromagnetic interference on the line.
Logical failure: The most common logical failure is configuration error, which refers to network anomalies or failures caused by the configuration of network devices. Another type of logical failure is the closure of some important processes or ports, and excessive system load.
1.2 Classification based on different fault objects
(1) Line failure : The most common situation is that the line is blocked. To diagnose this situation, first check whether there is traffic on the line, use ping to check whether the router port at the far end of the line responds, and use traceroute to check whether the router configuration is correct, find out the problem and solve it.
(2) Router failure : In fact, many line failures involve routers, so some line failures can be attributed to router failures. It is necessary to use the MIB variable browser to collect data such as the router’s routing table , port traffic data, billing data, router CPU temperature, load, and router memory margin. Usually, the network management system has a special management process that continuously detects the key data of the router and issues an alarm in a timely manner.
(3) Host failure : A common phenomenon is improper host configuration. Another host failure is security failure. It is generally difficult to detect host failures, especially malicious attacks. Generally, possible vulnerabilities can be prevented by monitoring the host’s traffic, scanning host ports and services.
2. LAN Troubleshooting Steps
Step 1: Identify the fault phenomenon
When analyzing a network fault, you must first understand the fault phenomenon. You must determine the specific phenomenon of the fault, and then determine the cause and type of the fault phenomenon. For example, if a host does not respond to a client’s request for service, possible causes may be host configuration problems, interface card failures, or router configuration command loss.
Step 2: Describe the fault phenomenon
Collect information about the cause of the fault. Ask users, network administrators , managers, and other key personnel questions related to the fault. Collect useful information extensively from network management systems, protocol analysis traces, output reports of router diagnostic commands, or software manuals.
Step 3: Develop a diagnostic plan and list possible causes of the error
Analyze the causes of the faults based on the collected fault information. You can exclude certain causes of the faults based on the relevant circumstances. For example, based on certain data, you can exclude hardware faults and focus on software causes.
Step 4: Establish a diagnostic plan based on the analyzed cause of the fault
Starting diagnostic activities with only one possible cause of the fault makes it easier to recover to the original state of the fault. If multiple causes of the fault are considered at the same time, trying to return to the original state of the fault is much more difficult.
Step 5: Troubleshooting
Execute the troubleshooting plan and carefully perform each step of testing, observation and processing until the fault symptoms disappear.
Step 6: Confirm the results of each parameter change
Analyze the results to determine whether the problem is solved. If not, continue until the problem is completely solved.
3. Physical layer diagnostics
The physical layer is the most basic layer in the OSI layered structure system. It is built on the basis of communication media, realizes the physical interface between the system and the communication media, and provides transparent transmission between data link entities .
The physical layer failure is mainly manifested in whether the physical connection method of the device is appropriate; whether the connection cable is correct; whether the configuration and operation of the MODEM, CSU/DSU and other devices are correct. The best way to determine whether the physical connection of the router port is intact is to use the show interface command, check the status of each port, and interpret the screen output information.
4. Data link layer diagnostic technology
The main task of the data link layer is to enable the network layer to obtain reliable transmission without knowing the characteristics of the physical layer. The data link layer packs and unpacks the data passing through the link layer, performs error detection and certain correction capabilities, and coordinates the shared medium.
To find and troubleshoot data link layer problems, you need to check the router configuration and the encapsulation of the connected ports that share the same data link layer . Each pair of interfaces must have the same encapsulation as the other devices that communicate with it. Check the encapsulation by checking the router configuration, or use the show command to check the encapsulation of the corresponding interface.
5. Network layer diagnostic technology
The network layer provides the means to establish, maintain and release network layer connections, including routing, flow control , transmission confirmation, interruption, error and fault recovery.
The basic method of troubleshooting network layer problems is to follow the path from source to destination, check the router routing table, and check the IP addresses of the router interfaces. Check static routes , default routes, or dynamic routes.
6. Analysis and troubleshooting of common LAN faults
6.1. Network card settings problem
This problem is one of the most common problems in the local area network. When the system starts and logs in, the network immediately prompts: “The network adapter is not working properly.” This is because the network adapter is not installed correctly. If there is a yellow exclamation mark in front of the network adapter in the system device, it proves that the network card is not installed correctly, or there is a conflict with other devices in the system on the interrupt. At this time, manual adjustment is required.
For some ISA network cards, such as NE2000 network card, the yellow exclamation mark will appear only when the I/O address range is set incorrectly. If only the interrupt number is wrong, it will be displayed as normal in the Windows system device status. If this happens, the computer will never be able to connect to the network. At this time, please check the interrupt of the network card, find out the actual interrupt number it uses, and then change the corresponding interrupt in the system resources.
6.2 Unable to connect to the network
If you can only see the local computer in ” My Network Places ” and cannot see other computers on the same network segment , it means that the network adapter is installed correctly. First, confirm whether the network cable is properly plugged in and whether the relevant network devices are working properly.
If everything is normal, but you still can’t connect to the network, check whether there are computers in the same workgroup with the same name. If both conditions are normal, check the protocol. Generally speaking, the LAN uses the TCP/IP protocol. Use the command ping 127.0.0.1 to confirm whether the local TCP/IP configuration is correct.
In a peer-to-peer network with only a few machines, there may be no host to provide the required services, so TCP/IP needs to be specially set up: specify the IP address of each computer and make it in the same network segment; specify the gateway of each computer as a server in the LAN; specify the DNS; bind file, printer sharing and Microsoft network client ; keep other settings as Windows defaults. In addition, add “Microsoft Network Client” and “File and Printer Sharing on Microsoft Networks”.
6.3. Abnormal network speed
1) Unable to access the server or a service: If these problematic workstations appear in the same network segment or are connected to the same HUB, then it is necessary to analyze whether the HUB is working properly and whether the subnet mask of the network segment is correct.
2) Problems related to the server: Whether the network traffic is high or low, the network response speed is too slow. It may be that the server cache is set too small, the reserved buffer is insufficient, the server memory is insufficient, the server hard disk has limited space, etc. It may also be another type of software problem that causes insufficient server memory. In this case, it is necessary to stop some unused services, or share some services with another server, or even upgrade the existing server.
3) Packet Errors: Sometimes the computer may receive erroneous data or malfunction due to received datagrams. Although TCP/IP can tolerate these types of errors and automatically resend packets, if the cumulative number of errors accounts for a considerable percentage of the received IP packets, or its number is increasing rapidly, you should use Netstat to check why these situations occur and find solutions.
4) Collision problem: Add up the local and remote collision losses. If the average collision value is greater than 5-10%, further troubleshooting is required. For example: incorrect termination (RJ45 connector is not pressed tightly), BNC impedance discontinuity, broken cables, bad network cards, and crosstalk caused by network cables and power cables being parallel when wiring.
5) Excessive utilization and overloaded network segments: If the network bandwidth utilization is too high (average value greater than 40%, instantaneous peak value greater than 60%), then the network segment is overloaded. You should consider installing a router to reduce the traffic in the network segment or using a switch to divide the network segment into several smaller segments.
6) Viruses: Some viruses not only slow down the computer, but also block the network, causing network congestion. To deal with these viruses, most virus manufacturers, such as Rising , kv3000, etc., have ways to deal with them. Antivirus software must be updated regularly, and some viruses cannot be completely killed by direct detection and need to be deleted manually.
6.4 The client in the LAN cannot access the Internet
- First, check if there are other computers (including the host) that can access the Internet. If no other computers can access the Internet, it may be a problem with the ISP. If there is no problem with the ISP, you need to handle it according to the actual situation.
- If you are using a LAN proxy server to access the Internet, you should confirm that the client can access the proxy server and that the proxy server address and port are set correctly in the browser. Since there are many different types of proxy servers , you should consult the network administrator for specific settings.
- Ping is a very useful network tool found in various operating systems. It can test whether your system can reach a remote host. This simple function is very useful for testing Internet connections.
- After the host successfully pings the remote host, use the ping command to test the host. If it is successful, ping the remote host again. If it is also successful, it means that the network communication is normal.
- If the host’s ping command is executed successfully and the user’s ping command fails, the user’s system configuration file can be tested centrally.
If both your ping command and the user’s ping command fail, the error message displayed by the ping command is very helpful and can guide the next test plan. The following are several basic types of errors:
1) Unknown host: The name of the remote host cannot be converted into an IP address by the DNS ( Domain Name Server ). The DNS may be faulty, the name may be incorrect, or the network between your system and the remote server may be faulty. If you know the IP address of the remote host, you can try the ping command again. If you can reach the host using its IP address, the problem may be with the DNS.
2) Network unreachable: The remote host is unreachable. If you use an IP address in the ping command, re-enter the ping command using the host name, which eliminates the possibility of entering an incorrect IP address. If you use a routing protocol, make sure it is running and use netstat or tracert to see which router the problem is on, and then check its routing table.
3) Request time out: The remote host did not respond. There are many reasons for this problem. The remote host may not be working (powered on), the local or remote host may be improperly configured, the line between the local and remote hosts is abnormal, etc. The reasons can be found using the methods mentioned above.
6.5. Other inspection methods
Usually, you can judge the working status of the network by the status of the LED lights of the network card, HUB or switch. A network card that is working properly should have at least one LED light flashing; the link/act or Transmit/Receive lights on the switch should also be like this. If they do not move for a long time, you should first consider the problem of the network cable, then the network card and switch.
The basic method of troubleshooting should start with the simplest error, first check the network cable, network card configuration, network connection device HUB/switch connection; then software settings; and finally some other network hardware failures, because whether it is a network card, HUB or switch, it may fail after being used for a period of time. In order to effectively solve the problem, you need to have network documentation. It is best to equip yourself with reasonable tool software to help understand the parameters when the network is working normally, and find out the network fault through analysis.