5.3 Command-Line Troubleshooting Utilities: traceroute, netstat, dig & iperf
Explains core OS command-line utilities for path discovery, DNS resolution, socket inspection, packet capture, and throughput benchmarking.
🎯 Key CompTIA Network+ Exam Takeaways
- traceroute increments IP Time-to-Live (TTL) fields to trigger ICMP Time Exceeded messages from intermediate hops.
- netstat -ano (or ss -tulpn) displays active listening ports, socket states, and corresponding Process IDs (PIDs).
- iperf3 measures maximum synthetic TCP/UDP bandwidth, throughput saturation, and jitter between two endpoints.
Command-line diagnostics provide rapid visibility into network protocol behavior. `traceroute` manipulates the IP Time-to-Live (TTL) header field, sending packets with sequentially incrementing TTLs to discover each routed hop via ICMP Time Exceeded replies.
`nslookup` and `dig` query DNS nameservers directly. An NXDOMAIN error confirms that the DNS server responded authoritatively but lacks a record for the queried hostname.
To audit active sockets, `netstat -ano` (or Linux `ss -tulpn`) correlates listening ports with local process identifiers. For performance validation, `iperf3` streams synthetic TCP or UDP traffic to benchmark actual network throughput.
⚠️ Common Pearson VUE Exam Traps
- Mistaking an NXDOMAIN DNS response for a network connection timeout; NXDOMAIN proves the DNS server was reached successfully.
- Using ping to test 10 Gbps link throughput; ping only measures latency and packet loss, not bandwidth saturation.
Knowledge Checkpoint
A network administrator uses the traceroute (or tracert) command to troubleshoot path latency to a remote server. How does traceroute discover the IP addresses of intermediate layer-3 routers along the path?