CompTIA Network+ Command-Line Tools: ping, traceroute, dig, netstat, and show Commands

Objective 5.5 in one line: pick the tool that answers the question

Network Troubleshooting is the largest domain of CompTIA Network+ N10-009, at 24%, and objective 5.5 closes it with "given a scenario, use the appropriate tool or protocol." It lists three groups:

• Software tools: a protocol analyzer; the command-line tools ping, traceroute/tracert, nslookup, tcpdump, dig, netstat, ip/ifconfig/ipconfig, and arp; Nmap; LLDP and CDP; and a speed tester.
• Hardware tools: toner, cable tester, taps, Wi-Fi analyzer, and visual fault locator.
• Basic device commands: seven show commands.

A scenario item rarely asks what a tool does. It describes what you need to know and asks which tool tells you. So learn each tool by the question it answers. The troubleshooting methodology guide shows where these checks fit in the seven steps.

The question-to-tool table for CompTIA Network+

Several of these commands differ by operating system, so the third column names the platform.

Two pairs cause most mix-ups. First, tracert and traceroute answer the same question with different probes, which is why a firewall can let one through and block the other. Second, nslookup and dig both query DNS, but dig's output separates the answer, authority, and additional sections, which makes it easier to see which server answered. For service identification and common ports, see ports and protocols.

Reading two original outputs

Both samples below are written for this page, with documentation and private addresses.

A Windows tracert with a silent hop:

Tracing route to 203.0.113.80 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  10.50.0.1
  2     8 ms     7 ms     9 ms  198.51.100.1
  3     *        *        *     Request timed out.
  4    14 ms    13 ms    15 ms  198.51.100.66
  5    15 ms    14 ms    16 ms  203.0.113.80

Trace complete.

Hop 3 shows asterisks, but hops 4 and 5 answer, so traffic does pass hop 3. Microsoft's documentation explains that some routers do not return the "time exceeded" message tracert depends on, and those routers show up as rows of asterisks. If later hops and the destination remain silent, traceroute alone still cannot prove where forwarding failed. Filtering, rate limits, return-path problems, or a destination that ignores probes can all hide replies. Test the destination service and compare other evidence before blaming the last responding router.

A Windows netstat -ano excerpt from a server:

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       1180
  TCP    10.50.0.25:3389        10.50.4.17:52114       ESTABLISHED     1180
  UDP    0.0.0.0:123            *:*                                    1532

Read it left to right. The server listens for RDP on TCP 3389 on all addresses, and one session is open from 10.50.4.17, using a high client port. Both lines belong to process 1180. UDP 123, the NTP port, is open under another process. A stem that asks "is the service actually listening?" wants this tool, not ping.

Hardware tools and what each one proves

A cable tester can prove a cable is wired correctly and still not explain errors on a busy link. Rising interface counters point you to the cable and interface troubleshooting guide.

The seven show commands as questions

The N10-009 objectives list seven device commands in generic form. Vendors spell some of them differently, so the last column gives a Cisco IOS XE form only where Cisco documentation was checked for this page.

On the exam, the generic form is enough. The skill is matching the question to the command. A MAC address learned on a trunk or uplink port means the device is behind another switch, so you follow it there and run the same command again.

The free mixed set of 20 Network+ questions includes one item built on this table: a technician has a MAC address and needs the switch port. When the seven questions above come easily, answer the free set's show-command item → and read why the other three commands miss.

Practicing these tools without a lab budget

Every software tool in the table except the show commands runs on an ordinary laptop. Run ping and traceroute to a site you use, read the hops, then run nslookup and dig against the same name and compare the outputs. Run netstat while a video call is open and find the connection. For Windows-only commands that A+ covers, such as ipconfig switches, the A+ Windows command-line guide is the right reference. Keep Nmap and packet captures to your own home network, where you are the one who authorizes them.