Troubleshooting LAN and WAN networks: methods, tools and common faults
In short: Good troubleshooting is a process, not guesswork: define the problem, gather facts, test likely causes one at a time, fix, verify and document. Choose a method (bottom-up, top-down or divide-and-conquer), use the right tools, and learn the common faults at each layer.
A structured process
Start by asking good questions: What exactly doesn't work? For whom? Since when? What changed? A clear problem statement such as "Users on floor 3 can't reach the internet since 09:00" already narrows the search.
Choosing a method
| Method | How it works | Use when |
|---|---|---|
| Bottom-up | Start at the cable (Layer 1) and work upwards | Physical problems are likely, such as a new install |
| Top-down | Start at the application and work down | One application fails but others work |
| Divide and conquer | Start in the middle (often ping, Layer 3) and go up or down | You have experience and want speed |
| Follow the path | Trace the route hop by hop from source to destination | Traffic stops somewhere along a path |
| Compare and swap | Compare with a working device or swap a part | A known-good reference exists |
Tools
- Hardware: cable testers and certifiers, optical power meters, a spare laptop and console cable.
- Commands:
ping,traceroute/tracert,show ip interface brief,show interfaces,show vlan brief,show interfaces trunk,show spanning-tree,show ip route,show access-lists,show logging. - Software: Wireshark for packet capture, monitoring systems for history and trends, syslog for events.
- Documentation: current diagrams, IP plans and configuration backups. Without them every fault takes longer.
Common LAN faults
| Symptom | Likely causes |
|---|---|
| Link down or flapping | Bad cable or patch lead, wrong transceiver, port shut down or err-disabled |
| Slow link with many errors | Duplex mismatch, damaged cable, interference |
| Works on one switch, not across switches | VLAN missing on the trunk, native VLAN mismatch, trunk not formed |
| Whole network slow, high CPU everywhere | A Layer 2 loop or broadcast storm: check spanning tree |
| Device gets a 169.254.x.x address | DHCP server unreachable, missing relay (helper address), exhausted pool |
| Websites by IP work, by name don't | DNS server wrong or unreachable |
Common WAN and routing faults
| Symptom | Likely causes |
|---|---|
| Can reach the gateway but not remote sites | Missing or wrong route, no default route, routing neighbour down |
| Only certain traffic blocked | An ACL or firewall rule in the path; check hit counters |
| Serial or PPP link down | Encapsulation or authentication mismatch, provider fault |
| VPN tunnel won't come up | Mismatched IKE or IPsec settings, wrong pre-shared key, NAT or firewall blocking UDP 500/4500 |
| Calls choppy at busy times | Congestion with no QoS, or jitter on the WAN |
Golden rules: change one thing at a time, keep a rollback ready, and write down what you found and fixed so the next person is faster.
Real-world example: the printer nobody on the third floor could reach
Staff on the third floor of an office reported that they could not print to their new floor printer, while everyone else could. The engineer defined the problem precisely: only the third-floor printer, only since it was installed that morning. Because the symptom was limited to one device, a bottom-up approach made sense.
The printer's link light was on, so the cable was fine. The printer had an address from the wrong range, and show interfaces status on the switch showed its port in the guest VLAN rather than the printer VLAN. The installer had used a port configured for a meeting room. The engineer moved the port to the correct VLAN, renewed the printer's address, printed a test page from two PCs and recorded the cause and fix in the ticket, along with a note to label meeting room ports clearly.
Practice
A new office has no network at all on any PC. Which method would you start with?
A PC has the address 169.254.10.5. What does that suggest?
Ping by IP works but a website by name fails. What do you check?
Key takeaways
- Follow a process: define, gather, analyse, test, fix, document.
- Pick a method: bottom-up, top-down, divide-and-conquer or follow-the-path.
- Use the right show commands, ping and traceroute, and packet captures.
- Know common faults: cabling, duplex, VLAN/trunk, loops, DHCP, DNS, routes, ACLs.
- Change one thing at a time and record the fix.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.