Lessons · IT support · ping, traceroute, nslookup
ping, then traceroute, then nslookup: three questions in order
ping asks 'can I reach you, and how long does it take'. traceroute asks 'which hop stops answering on the way'. nslookup asks 'what address does this name turn into, and who told me'. Each one answers a different question, and the order you ask them is the order the fault is narrowed.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
'The file server is slow' could be the server, the path to it, or the name pointing at the wrong server. ping says the server answers and how fast. traceroute says where the slowness begins. nslookup says whether 'fileserver' is even the machine you think it is. Three commands and you can tell the network team which router, or tell the server team it is theirs.
How to think about it
ping the gateway first: if that fails, the fault is on this side of the wall. ping a known address beyond it, then ping the name. If the address works and the name fails, nslookup the name. If the address itself fails or is slow, traceroute to it and read the last hop that answered: the fault is just past it. Write the output in the ticket; it is evidence, not decoration.
Worked example
ping 10.4.2.1 → reply, 1 msThe gateway answers. The cable, the address and the switch are fine.
ping 10.4.10.20 → reply, 210 msThe server answers, slowly. Reachable, but something on the way is dragging.
traceroute 10.4.10.20 → hop 1: 1 ms, hop 2: 2 ms, hop 3: 205 ms, hop 4: 208 msThe delay begins at hop 3. Whatever sits there is the network team's, and you can name it.
nslookup fileserver → 10.4.10.20The name points where you thought. The name layer is not the fault; the third hop is.
Your turn
ping to the address works and ping to the name fails. Write the tool you use next.
address OK, name fails → the name
Solve one, graded on the server
The trap
Running traceroute first because it shows more. It shows more only when ping has already told you the address is reachable or slow. A traceroute to a name that does not resolve tells you nothing about the path, because there is no path to trace.