CloudLabBox
Try the free demo

Linux for network engineers lab 8 of 14

The troubleshooting toolkit: tcpdump, ss, ethtool, traceroute and mtr

Users say the parcel tracker is down. You work up the stack with `ip`, `traceroute`, `mtr`, `ss`, `tcpdump` and `ethtool`, and find three different faults hiding behind one ticket.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 2,560 MB in total. That fits the free demo too.

In your workspace: Shared, then Linux for network engineers guided labs, then 08 - The troubleshooting toolkit - tcpdump ss ethtool traceroute and mtr

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 70 minutes
Nodes need
4 vCPU, 2,560 MB
Smallest plan
Lite

The scenario

It's Monday at Rotherham. The ticket says "the tracker is down" and nothing else. SRV runs the tracker on TCP 8080 and the parcel API on TCP 8443, at the far end of a provider circuit (WAN). You sit at WS. Don't guess: go through the stack one layer at a time and write down what each tool proves.

DeviceInterfaceAddressRole
WSeth010.8.10.50/24your workstation
R1Gi0/0, Gi0/110.8.10.1/24, 10.8.1.1/30site router
WANeth0 and eth1bridge, no addressthe provider's circuit (a WAN emulator)
SRVeth010.8.1.2/30tracker on 8080, API on 8443
DeviceRunsHow to log in
WSUbuntu 22.04 desktop containerIts console is a remote desktop: root / eve. Open a terminal there.
R1Cisco IOSv 15.9The console opens at >; enable has no password.
WANAlpine Linux 3.16 as a WAN emulatorOpens on a menu: press 5, then Enter, for a root shell.
SRVAlpine Linux 3.16 with iptables and iproute2Opens on a menu: press 5, then Enter, for a root shell.

What you’ll practise

  • Choose the right tool for each layer
  • Tell a refused connection from a filtered one
  • Read TCP flags in tcpdump
  • Find where loss starts with mtr and prove it with counters
  • Read interface health with ethtool and ip -s
  • Save a capture and read it back

The tasks

  1. Start the Linux nodes
  2. Walk the path
  3. Connection refused
  4. Silence
  5. Packets going missing
  6. Read the interface
  7. Keep the evidence

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of The troubleshooting toolkit - tcpdump ss ethtool traceroute and mtr4 nodes, 3 links. Every link is listed as text below the diagram.WSR1WANSRVeth0Gi0/0Gi0/1eth0eth1eth0
4 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • WS eth0 to R1 Gi0/0
  • R1 Gi0/1 to WAN eth0
  • WAN eth1 to SRV eth0
Nodes in The troubleshooting toolkit: tcpdump, ss, ethtool, traceroute and mtr, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
WSEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
WANAlpine WAN emulatorclbalpinewanem-alpine-3-16-2-wanem1 vCPU, 512 MB
SRVAlpine WAN emulatorclbalpinewanem-alpine-3-16-2-wanem1 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Linux for network engineers guided labs.

  3. Open 08 - The troubleshooting toolkit - tcpdump ss ethtool traceroute and mtr and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Linux for network engineers labs

All Linux for network engineers labs

Related labs in other courses

CloudLabBox is independent of Cisco, CompTIA, the Linux Foundation and the Linux Professional Institute. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.