How to choose configuration, reachability, naming, cable, wireless, log, flow, and packet tools for the next diagnostic question.
The right diagnostic tool is the simplest one that can answer the next useful question. A packet capture is powerful, but it is not the first choice when local configuration, DNS, an interface counter, or cable test can resolve the uncertainty faster.
| Question | Useful tools |
|---|---|
| What address, gateway, DNS server, and interface state does this host have? | ipconfig, ip, ifconfig, platform interface commands |
| Can this host reach a specific address? | ping and interface counters |
| Where does a routed path change or stop responding? | traceroute or tracert, routing tables, and path telemetry |
| Does a name resolve as expected? | nslookup, dig, resolver logs |
| Is a copper run damaged or incorrectly terminated? | Cable tester, tone generator, or time-domain reflectometer (TDR) |
| Is Wi-Fi coverage or channel use contributing? | Wi-Fi analyzer, controller telemetry, site survey data |
| Which devices are exchanging the most traffic? | Flow records and interface telemetry |
| What occurs in a specific protocol conversation? | Packet capture or protocol analyzer |
| What did a device report over time? | Syslog, event logs, and monitoring history |
A protocol analyzer captures and decodes traffic for packet-level inspection. A TDR estimates the location of a fault along a copper cable by analyzing reflected signals. Both tools are valuable when their specific evidence is needed; neither replaces basic configuration and reachability checks.
1Named application fails
2→ inspect local address, gateway, and DNS configuration
3→ compare direct-IP and name-based reachability
4→ check resolver response and logs
5→ capture packets only if the protocol exchange still needs explanation
Correlate rather than over-trust a single command. A failed ping can reflect policy, host firewall behavior, a route problem, or loss; a traceroute may be incomplete because routers do not always respond as expected. Combine tool output with scope, counters, logs, documentation, and recent-change history.
When collecting packet captures or logs, follow access, privacy, and retention rules. They can contain credentials, personal data, application content, and topology details.