IT Toolbox
IT Toolbox

Network & Wi-Fi Center

Networking / Wi-Fi

Network & Wi-Fi Center

Guided diagnostics for Internet, DNS, DHCP, VLANs, switching, latency, MTU and Wi-Fi.

WindowsIP configuration
ipconfig /all
WindowsRoutes
route print
WindowsARP
arp -a
WindowsTest a port
Test-NetConnection <CIBLE> -Port 443
WindowsWi-Fi courant
netsh wlan show interfaces
WindowsBSSID visibles
netsh wlan show networks mode=bssid
LinuxAdresses IP
ip -br addr
LinuxRoutes
ip route
LinuxMTR
mtr <CIBLE>
LinuxPorts
ss -lntup
FortiGateRoutes
get router info routing-table all
FortiGateInterfaces
get system interface physical
FortiGateSniffer
diagnose sniffer packet any 'host <IP>' 4 0 l
FortiGateHealth-check SD-WAN
diagnose sys sdwan health-check
DiagnosticPing 50 paquets
ping <CIBLE> -n 50
DiagnosticPathping
pathping <CIBLE>
DiagnosticTest MTU
ping 1.1.1.1 -f -l 1472

Analyse RSSI / SNR

1

Couche 1

Câble, lien et radio avant le reste.

2

IP → Gateway → DNS

La séquence de base du diagnostic network.

3

VLAN de bout en bout

Port, trunk, gateway, DHCP et firewall.

4

Wi-Fi = radio

RSSI, bruit, SNR, canaux et clients.

5

Mesurer

Utilisez plusieurs dizaines de paquets.

6

Documenter

Conservez ports, VLAN, IP et uplinks.

Key point: adaptez les seuils radio et canaux à votre environnement et à la réglementation locale.
Field troubleshooting

Center mission

8 playbooks

Locate the failing layer — physical, VLAN, DHCP, routing, DNS or radio — always comparing LAN and Wi-Fi tests when possible.

Quick triage

  • Define whether the issue affects one endpoint, one VLAN, one site or the whole network.
  • Record IP, mask, gateway, DNS and VLAN on the affected endpoint.
  • Test gateway, public IP then DNS name in that order.
  • Compare loss/latency on LAN and Wi-Fi.
  • Record switch/AP/port and exact timestamp for log correlation.

Decision tree

169.254.x.x address→

Troubleshoot DHCP, VLAN or link before DNS/Internet.

Gateway unreachable→

Inspect layer 2, port, VLAN, ARP and Wi-Fi association.

Public IP works but names fail→

Isolate DNS: configured server, query, suffixes and filtering.

Only Wi-Fi is unstable→

Measure RSSI/SNR, roaming, channel and radio utilization.

Intervention playbooks

Start read-only, collect evidence, then change one variable at a time.

01No IP / APIPA addressRead-only
Symptom

Endpoint receives 169.254.x.x or no usable IPv4 configuration.

Checks

  • Check physical link or Wi-Fi association.
  • Confirm port/SSID VLAN and DHCP scope.
  • Look for exhausted scope or missing DHCP relay.

Commands / evidence

ipconfig /allipconfig /release & ipconfig /renewGet-NetIPConfiguration

Expected result

Client receives an address from the correct scope with expected gateway and DNS.

Corrective actions

  • Fix VLAN/relay/scope where DHCP requests disappear.
  • Avoid undocumented static-IP workarounds.

Escalate when

Multiple VLANs are affected, DHCP server is unavailable or central relay is suspect.

02Gateway unreachableRead-only
Symptom

Endpoint has a correct IP but cannot ping its gateway.

Checks

  • Compare IP/mask with the actual subnet.
  • Check ARP and gateway MAC.
  • Check switch port, access/trunk VLAN and physical errors.

Commands / evidence

ping <gateway>arp -aGet-NetAdapter | Format-Table Name,Status,LinkSpeed

Expected result

Gateway resolves in ARP and responds without loss from the expected VLAN.

Corrective actions

  • Fix mask/VLAN/port before investigating Internet.
  • Compare with another endpoint on the same port/VLAN to isolate the client.

Escalate when

Virtual gateway/stack is unstable, L2 loop exists or multiple switches show the same fault.

03DNS no longer resolvesRead-only
Symptom

IPs respond but names fail or resolve very slowly.

Checks

  • Identify the DNS server actually queried.
  • Test short name, FQDN and an external zone.
  • Compare response from another endpoint/VLAN.

Commands / evidence

ipconfig /allnslookup example.comResolve-DnsName example.com -Server <DNS>

Expected result

DNS server responds quickly with expected data and no timeout.

Corrective actions

  • Fix DHCP/client DNS, forwarding or zone depending on failure type.
  • Clear cache only after collecting the faulty response.

Escalate when

All internal DNS servers fail, AD-integrated zone is inconsistent or network filtering blocks TCP/UDP 53.

04Packet loss / latencyRead-only
Symptom

Drops, degraded audio, choppy RDP or variable response times.

Checks

  • Measure to gateway, WAN then final destination.
  • Separate local, carrier and Internet loss.
  • Correlate with interface errors/drops and utilization.

Commands / evidence

ping -n 100 <gateway>pathping <destination>tracert <destination>

Expected result

No local loss and stable latency before the first external hop.

Corrective actions

  • Fix cable/port/duplex or congestion if loss begins locally.
  • Provide exact times and hops to the ISP if loss starts after WAN.

Escalate when

Intermittent multi-site loss, loop/backbone saturation or sustained ISP SLA breach.

05Unexpectedly low throughputRead-only
Symptom

Downloads or applications cap far below expected throughput.

Checks

  • Read negotiated link speed and interface errors.
  • Compare local LAN test and Internet test.
  • Check QoS, duplex and any 100-Mb/s bottleneck device.

Commands / evidence

Get-NetAdapter | Select Name,Status,LinkSpeedGet-NetAdapterStatisticsping <gateway> -f -l 1472

Expected result

Link negotiates at expected speed without errors or local bottlenecks.

Corrective actions

  • Replace limited cable/switch or fix negotiation before blaming the ISP.
  • Test with one reference wired endpoint.

Escalate when

Local LAN is fast but WAN remains below SLA with reproducible timestamped tests.

06Wrong VLAN / unexpected networkControlled change
Symptom

Endpoint receives an IP range or access rights from another network.

Checks

  • Identify expected VLAN and actual VLAN presented on port/SSID.
  • Check access/native/tagged and any dynamic profile.
  • Compare received DHCP scope and endpoint MAC.

Commands / evidence

ipconfig /allarp -aGet-NetConnectionProfile

Expected result

Port or SSID places endpoint in intended VLAN and DHCP matches.

Corrective actions

  • Fix port/SSID configuration then renew the lease.
  • Validate the change does not affect a phone, AP or shared trunk.

Escalate when

Dynamic VLAN/RADIUS is inconsistent, multiple trunks involved or change may affect several services.

07Wi-Fi authentication failureRead-only
Symptom

SSID is visible but connection is denied, password loops or 802.1X fails.

Checks

  • Separate PSK, captive portal and 802.1X/RADIUS.
  • Check date/time and server certificate for EAP.
  • Compare another device/user on the same AP.

Commands / evidence

netsh wlan show interfacesnetsh wlan show wlanreportipconfig /all

Expected result

Client associates to the correct SSID and completes authentication with the expected profile.

Corrective actions

  • Fix profile/certificate/RADIUS based on failure log.
  • Remove/recreate client profile only if network works for others.

Escalate when

All 802.1X users fail, RADIUS certificate expired or identity backend unavailable.

08Wi-Fi roaming / interferenceControlled change
Symptom

Disconnects while moving, variable throughput or unstable Wi-Fi/VoIP calls.

Checks

  • Record RSSI/SNR and associated AP at problematic locations.
  • Check channels, width, power and radio utilization.
  • Observe whether client sticks to a distant AP.

Commands / evidence

netsh wlan show interfacesnetsh wlan show networks mode=bssidping -t <gateway>

Expected result

Client keeps usable signal and roams between APs without prolonged loss.

Corrective actions

  • Adjust channels/power/placement after measurement, not randomly.
  • Test a real roaming path with a representative endpoint.

Escalate when

Coverage requires a radio survey, high-density design or persistent external interference.

End-of-intervention checklist

  • Retest gateway, DNS and business destination.
  • Compare LAN and Wi-Fi after the fix if both are available.
  • Verify no loss on an extended test.
  • Document port, VLAN, AP and corrected configuration.
  • Keep exact timestamps for ISP or monitoring follow-up.

Continue in BAOI

Related cheat sheetWindows network diagnostics IT toolsCalculate, inspect or generate without leaving the workflow. ProceduresFollow a controlled implementation procedure. Known failuresCross-check the symptom with known failure patterns.

See also:. ICMP.

♡ 0