Hey guys and welcome back. So now what I want to focus in on in this nugget right here are
some of the actual network tools that we have available to us that we can use to help us
troubleshoot our network issues. So we're not just looking at configuration files this
time we are looking at things like particular commands that we can issue to solve these
problems. Now one of the biggest commands that we can use or the biggest tools that we can use is
the ping command. Now we just discussed this command in a very recent scale. So we're not going to
revisit this although you should certainly have it in your mind that this is a primary troubleshooting
tool. Instead we're going to look at the other tools that we can use. Now one of the absolute best
tools that we can use for the purposes of diagnosing potential network issues is the trace
route tool. You may perhaps pronounce it trace routes depending on where you are say for example
if you live in the United States but in the UK this is called trace route. Okay so out with the
pronunciation what exactly does this tool do. Now this tool is honestly awesome this is going to
allow us to trace a particular path that your network packet takes. Now this doesn't just serve
your own curiosities to see how your traffic is traveling throughout the network. Obviously if
there happens to be issues with congestion or if there are issues with respect to packets being
dropped it would be very useful for us to be able to diagnose the particular traffic patterns
that are within our network. This tool trace route is going to allow us to do just that. Now the way
this actually works is again we have to talk about the TTL. Now we talked about the TTL i.e. the
time to live value. We talked about this when we discussed the ping command and I believe it was
the previous skill. Now this is one of the reasons why I always like to try to explain the time to
live value because it is a very very useful concept to understand even out with the ping command
like I say when we go and visit trace routes. Let's see how this could actually work. Let's say here
that we have our Linux machine right here okay and then we are connected to our router which
should be our default gateway and let's say within our network we have a device here another
router and a device here another router and let's just keep it simple let's just have one right here
okay so we'll connect to you and we will connect to you. So let's say that this device up here has
the ip address of 8.8.8.8 and we actually go onto our terminal window right here and we try to ping
that we say ping and for whatever reason maybe we're getting some type of congestion who knows
where it may be we actually want to find out how we are actually getting from this point right here
to this point right here. Well the tool we break out like I say is the trace route command so on
our terminal here we would just say trace routes 8.8.8.8 and what our machine would do it would
begin to craft a series of packets with a particular setting that setting is going to be
a variable value for the time to live let me show you what I mean so we would first send our packet
destined for 8.8.8.8 but we would assign it with a TTL of one i.e one hop so we first send that
packet and it gets to the first location here which is this device now this device sees it has
a time to live of one and it decrements one off as time to live does the time to live now becomes
zero and this device reports back hey the time to live has exceeded I am dropping this packet and
here is my source address so not only would it drop the packet it would actually tell us our ip
address now this is not going to be big information because we are directly connected to this device
and we know as your default gateway this is who we sent it to so we're not getting much information
here but the interesting part is is the next packet that is going to be sent is going to have
a time to live value of two we move it up one value we increment it so now we send it off packet
goes here time to live is two this device minuses it by one the new TTL is one and now this device
here is going to send this packet wherever it's going to send it is it going to send it via this
device or via this device so let's just say that it happens to send it this way right here okay so
remember the TTL started off at two it's been decremented to one here and now we send it off
this way so now once it reaches this device it sees the TTL is one it minuses one of it the TTL
value is now zero and it says hey I am dropping this send this back and what's it going to do
it's going to send its source ip address let's just say the source address here happened to be
three dot three dot three dot three whatever it may be so now we actually have some really cool
diagnostic data think about it we know no surprises that the first hop is going to be this one here
which happens to be our default gateway but we know the second hop is the ip address here which
we're going to pretend is three dot three dot three dot three so now we can actually build up a visual
path of how this packet is transiting the network it's going this direction towards this device but
trace route is not done just yet we now send in another packet what do we do we send it with a TTL
value of three we increment this and this happens once again so the value is three we send it to
the default gateway right here it says three minus one equals two it then sends it to the next address
up here this one says two minus one equals one and it sends it to its next location which is this one
here now this device here will say one minus one equals zero time to live has exceeded send the
information back with the source address and now we get the source address of this device now in
this diagram right here this happens to be the end point but you can imagine if we happen to have
10 routers we could just gradually chain together what was the first hop and what was the second and
what was the third and the fourth and the fifth all the way until the packet reaches its destination
so now we can actually get a visual path of all the locations all the routers that a packet is
going through to get to a particular endpoint destination it's no longer a mystery to us and
again it's all made possible just simply by manipulating that time to live value by incrementing
it by one every single packet so what I will do here is I will actually install trace route because
it's not automatically installed anymore so if I say so do I have to install trace route and I type
in my password and we begin the installation so now we've installed trace routes now if I just happen
to ping say for example google.com I can see here the end point is successfully responding to my pings
so I'll stop this but again I have no idea the path I am traversing so instead I can say trace
routes google.com and it's going to use this variable TTL value to help us actually see some
of the IP addresses that we are transiting when getting to this particular location now we can
actually see here we're going through 10 particular hops until we reach our end points but one thing
I want you to notice is that we actually often when traversing the internet see this particular value
here these are these stars ultimately this is saying that we are not getting a particular response
now the reason for this is that trace route just like the ping command is using ICMP the internet
control message protocol now this might happen to be such that the server here is configured to
not respond to these ICMP requests therefore we're actually not getting to see information relating
to this particular hop so this is obviously a limitation of the trace route command i.e. not
every single point on the trip is going to give you its particular information so obviously this
is the limitation however you can still get a lot of information as to how your packet is traveling
even with this partial information but more often the point is is that if you happen to have a large
internal network that you control that is not the public internet you can configure this such that
you do get detailed diagnostic data by not filtering this so you can actually see full
trace route paths if you happen to issue this particular command so just try to understand
the utility of this particular command how it actually works as well as its potential limitations
on places like the public internet ICMP may for example be filtered after all but in other scenarios
say for example your internal local networks under your own control trace route can actually give you
a lot of visibility as to how packets are being moved across your own network now what I will say
is that we have just talked about the ping utility in a previous skill and the trace route command
just right now there actually is another command that we can use that can perform these types of
tasks and this tool is called MTR let me quickly show you how this looks so if you go into the
man page it's going to say that MTR is a network diagnostic tool and we can see here it combines
the functionality of trace route and ping into a single tool so basically we're getting ping and
trace route together and again here we can see how this actually operates by sending purposefully low
time to live values this is exactly what we talked about and once again you may be wondering why do
we have to know about the ping command and the trace route command if the MTR command can do both
well as you know with the LPIC examinations very often you have to know different variations of
tools even if that tool is in a legacy or deprecated state it may still also come up any question for
the purposes of the examination so what we'll do here is I'll give you a quick example of how to use
the MTR command so if I just say MTR google.com if I hit enter we drop into a cool little screen here
which actually traces our path we can see here the spots and if you look at the right hand side
you'll notice the values continually changing we're still sending these ping commands we're
still getting this updated information and we can see how many pings are being sent as the
increments continually moving up and up and up we can see the percentage of packet loss right here
so if I press the Q command that will quit and that is simply the MTR command it works the same
way pretty much as the ping command and trace route it just presents that data a little bit
differently and rolls the two commands together effectively now another command we can use happens
to be the D message command and if you don't recall from the LPIC one which we talked about D
message fairly extensively the D message command is going to allow us to actually see the kernel
ring buffer simply put this is going to allow us to see messages from the kernel itself very very
useful when trying to diagnose issues now if you happen to issue this command D message you're going
to get a ton of information right here as such it can be useful to just print out the latest
information so say for example you can say D message and we will pass this to the tail command and we
could maybe say tail minus five and hit enter and now we just see the last five messages printed out
to the screen or the last if we so choose 10 and this can be a nice quick way to be able to isolate
the last few messages generated via the kernel say for example here we can actually see our
interface here the network interface card link is up and we can see the speed as well as it's in
full duplex similarly if we so choose we can use D message and grep for particular information say
for example en p0 s3 which is our network interface and we can see here kernel information right here
we can actually see this interface here has been renamed from ethernet zero now for the purposes
of the examination you don't have to have an encyclopedic understanding of the messages within
the kernel ring buffer but just understand that the D message command will present to us that
kernel information and we can use such information to diagnose potential network issues now we also
have particular log files we want to be aware of and there are two locations particularly
that are mentioned within the exam objectives let me first show you what the first one is this one
happens to be within the var directory and then it's in the log directory once again and then it's
the file called syslog now this file right here happens to be the central and primary file for
logging information on debian based systems so debian systems we would use or rather read the
contents of var log syslog to get our logging information this can have a whole treasure trove
of network based information that you can use to analyze and read and help you diagnose any
potential issues on your network so what i could do is i could say tail minus five on var log syslog
and to enter and what i'm seeing here are the last five messages that have actually been logged to
our system and once again just like what we saw before if you happen to be looking for particular
information you can just grep for that information so let's maybe say grep en p0 s3 and we will look
within var log syslog and to enter check this out we're seeing all of this information relating to
this particular interface we can see dhcp information we can see state changes we can see
the policy that's been set for wired connection one we can see the device has been activated
successfully so on so forth so this is the log file you would use for debian based systems
however if you happen to be on a red hat based system this will be instead within var log which
is just the same but instead it's not going to be in the syslog file it's going to be in a file
just called messages and again the same purpose as with the syslog file this is going to be your
main logging file however this time like i said for red hat based systems so these tools which we
have seen as well as these particular logging files such as our dmessage command which allows us to
read the kernel ring buffer as well as the two logging files that we've just examined here
been able to understand that we can locate these particular files read their output as well as
filter that particular output using the tail command or the grep command whatever it may be
in conjunction with using the pin command the trace root command or the mtr command all of this
information is vital for troubleshooting and diagnosing problems within your network
okay doc so i hope this has been informative for you and i'd like to thank you for viewing