This chapter covers the essential network command-line tools: ping, ipconfig, nslookup, and tracert. These tools are fundamental for network troubleshooting and configuration verification, and they appear frequently on the CompTIA A+ 220-1101 exam, typically in 5-10% of questions across the Networking domain (Objective 2.4). Mastering their syntax, output interpretation, and appropriate usage scenarios is critical for both the exam and real-world IT support roles. We will explore each tool in depth, including how they work at the protocol level, their key parameters, and how to apply them methodically.
Jump to a section
Think of network command tools like a mechanic's diagnostic toolkit for a car's electrical system. ping is like a continuity tester: you send a small pulse (ICMP Echo Request) and wait for a return pulse (Echo Reply). If you get it, the circuit is intact; if not, there's a break. ipconfig/ifconfig is like reading the car's VIN and dashboard gauges: it tells you the car's identity (IP address), subnet mask (engine type), default gateway (steering linkage), and DHCP status (fuel level sensor). nslookup/dig is like calling a parts database: you ask for a part number (hostname) and get the warehouse location (IP address), or vice versa. tracert/traceroute is like following a pipeline from the pump to the faucet, noting each valve and pressure drop along the way. Each tool gives a different view into the network's health and configuration, and a skilled technician uses the right tool for the symptom. Just as a mechanic wouldn't use a continuity tester to check fuel pressure, a network tech shouldn't use ping to diagnose DNS failures.
Ping: The Foundation of Connectivity Testing
Ping (Packet Internet Groper) is the most basic network diagnostic tool. It tests reachability between a source and destination host by sending Internet Control Message Protocol (ICMP) Echo Request packets and waiting for Echo Reply packets. The name originates from sonar technology, where a pulse of sound is sent and an echo is listened for.
How Ping Works 1. The ping command constructs an ICMP Echo Request packet with a specific Type (8) and Code (0). 2. The packet is encapsulated in an IP datagram with the source IP (your host) and destination IP (target). 3. If the destination is on the same subnet, the packet is sent directly via ARP to determine the MAC address. If on a different subnet, it is forwarded to the default gateway. 4. The destination host receives the packet, checks its ICMP stack, and generates an Echo Reply (Type 0, Code 0). The reply is sent back to the source, swapping source and destination IPs. 5. The source receives the reply, calculates the round-trip time (RTT), and displays the result.
Key Parameters and Defaults
- ping <hostname or IP> – Sends 4 Echo Requests (Windows) or unlimited until Ctrl+C (Linux/macOS). The exam focuses on Windows defaults.
- -t – Pings continuously until stopped (Windows).
- -n <count> – Specifies number of Echo Requests (Windows).
- -l <size> – Sets packet size in bytes (Windows default: 32 bytes).
- -a – Resolves IP addresses to hostnames (Windows).
- Timeout: Windows waits 4 seconds for each reply; if no reply, it shows "Request timed out."
- TTL (Time to Live): Default 128 on Windows, 64 on Linux/macOS. Each router decrements TTL by 1. If TTL reaches 0, the router sends an ICMP Time Exceeded message.
Interpreting Ping Output - Reply from <IP>: Success. Shows bytes, time in ms, TTL. - Request timed out: No reply within 4 seconds. Could indicate network congestion, firewall blocking ICMP, host down, or routing issue. - Destination host unreachable: A router has no route to the destination. This is an ICMP Destination Unreachable (Type 3) message from an intermediate router. - General failure: Typically a local configuration issue (e.g., no IP address).
Common Exam Traps - A successful ping to a local IP but failure to a remote IP often points to a default gateway problem. - Ping to 127.0.0.1 (loopback) tests the local TCP/IP stack. Failure indicates a protocol stack issue. - Ping to the host's own IP tests if the IP is properly bound to the network adapter. - Firewalls can block ICMP, causing false negatives. The exam may present a scenario where ping fails but other connectivity works (e.g., web browsing).
ipconfig: Windows IP Configuration
ipconfig is the primary command for viewing and managing IP configuration on Windows systems. It displays current TCP/IP network configuration values and can refresh DHCP leases and DNS caches.
Key Commands and Output
- ipconfig – Displays basic information for all adapters: IPv4 address, subnet mask, default gateway.
- ipconfig /all – Displays detailed info: MAC address, DHCP status, lease obtained/expires, DNS servers, WINS servers, etc.
- ipconfig /release – Releases the DHCP lease for the specified adapter (or all if no adapter specified). The adapter loses its IP address.
- ipconfig /renew – Renews the DHCP lease. The adapter requests a new IP from the DHCP server. This is a two-step process: broadcast DHCPDISCOVER, then DHCPREQUEST.
- ipconfig /flushdns – Clears the DNS resolver cache. Useful when DNS changes are not being picked up.
- ipconfig /displaydns – Displays the contents of the DNS resolver cache.
- ipconfig /registerdns – Initiates dynamic DNS registration for the adapter's IP and hostname.
Exam Focus
- The exam tests knowledge of which command to use in specific scenarios. For example, if a user cannot connect to the internet after obtaining a new IP from DHCP, you might use ipconfig /all to verify the default gateway and DNS servers.
- ipconfig /release and ipconfig /renew are often tested together. The correct sequence is release first, then renew.
- ipconfig /flushdns is used when a website resolves to an old IP after a DNS change.
Common Misunderstandings
- Candidates often confuse ipconfig with ifconfig (Linux/macOS). The exam expects Windows-specific commands for Windows scenarios.
- ipconfig /renew does not work if the DHCP server is unreachable; the system may fall back to Automatic Private IP Addressing (APIPA) (169.254.x.x).
nslookup: DNS Query Tool
nslookup (Name Server Lookup) is a command-line tool for querying DNS servers to obtain domain name or IP address mapping. It can perform both forward (hostname to IP) and reverse (IP to hostname) lookups.
Interactive vs. Non-Interactive Mode
- Non-interactive: nslookup <hostname> or nslookup <IP>. Returns the IP for a hostname or the hostname for an IP.
- Interactive: Type nslookup without arguments. Then use commands like server <DNS server IP> to change the DNS server, set type=<record type> (e.g., MX, A, AAAA, CNAME, NS), and exit to quit.
Key Output Interpretation - Name: The queried hostname. - Addresses: The IP address(es) returned. Multiple addresses indicate round-robin DNS or multiple A records. - Non-authoritative answer: The response came from a caching DNS server, not the authoritative server for the domain. - Aliases: CNAME records that point to the canonical name. - DNS request timed out: The DNS server did not respond within the timeout period. - *** server can't find <name>: NXDOMAIN: The domain does not exist.
Exam Scenarios
- Use nslookup to verify DNS resolution when a user can access a website by IP but not by hostname. This isolates the problem to DNS.
- Use nslookup <hostname> <DNS server IP> to query a specific DNS server, e.g., nslookup example.com 8.8.8.8.
- Reverse lookup: nslookup <IP> returns the PTR record.
Common Exam Traps - Candidates might think nslookup can test all network connectivity; it only tests DNS. - A successful nslookup does not guarantee that the hostname is reachable via ping or other protocols; it only confirms DNS resolution.
tracert: Tracing the Route
tracert (Trace Route) on Windows (traceroute on Linux/macOS) maps the path packets take from the source to a destination. It works by sending ICMP Echo Requests (Windows) or UDP packets (Linux) with incrementing TTL values.
How Tracert Works 1. The source sends a packet with TTL=1 to the destination. The first router decrements TTL to 0, discards the packet, and sends an ICMP Time Exceeded message (Type 11, Code 0) back to the source. 2. The source records the router's IP address and RTT. 3. The source sends a packet with TTL=2. The first router decrements to 1 and forwards; the second router decrements to 0 and sends Time Exceeded. 4. This continues until the packet reaches the destination. The destination, seeing TTL=1, does not send Time Exceeded; instead, it sends an ICMP Echo Reply (Windows) or a Port Unreachable (Linux). 5. The trace stops when a reply is received from the destination or when the maximum TTL (default 30) is reached.
Key Parameters
- tracert <hostname/IP> – Default max hops = 30.
- -h <maxhops> – Specifies maximum number of hops.
- -d – Do not resolve IP addresses to hostnames (faster).
- -w <timeout> – Wait timeout in milliseconds for each reply.
Interpreting Output - Each line shows hop number, RTT for three probes (Windows sends three packets per TTL), and the router's IP/hostname. - Request timed out: Indicates a router that does not respond to ICMP (common for firewalls) or packet loss. - Destination unreachable: A router cannot forward the packet further. - High RTT at a particular hop may indicate congestion or a slow link.
Exam Focus - Use tracert to identify where packet loss occurs in the path. For example, if all hops after hop 5 show timeouts, the problem is at hop 5 or beyond. - Tracert uses ICMP on Windows; knowing this helps differentiate from traceroute on Linux (UDP). - The exam may ask which tool to use to determine the path to a remote server.
Supplementary Tools: pathping, netstat, and nbtstat
The exam also covers:
- pathping: Combines ping and tracert. It sends packets and then analyzes packet loss at each hop over a period (default 300 seconds). Useful for identifying network congestion.
- netstat: Displays network connections, routing tables, interface statistics, and listening ports. Key options: -a (all connections and listening ports), -n (numeric addresses), -o (owning process ID), -r (routing table).
- nbtstat: Used for NetBIOS over TCP/IP. nbtstat -n shows local NetBIOS names, nbtstat -a <IP> displays the remote machine's NetBIOS name table.
Common Exam Scenarios
- Use netstat to verify that a service is listening on a specific port (e.g., netstat -an | findstr :80).
- Use nbtstat when troubleshooting legacy NetBIOS name resolution issues.
- Use pathping when intermittent packet loss is suspected.
Command Syntax Reminders - Windows: tracert, pathping, netstat, nbtstat. - Linux/macOS: traceroute, netstat (or ss), nslookup (or dig), ifconfig (or ip addr).
The exam expects knowledge of the Windows commands primarily, but may present Linux scenarios.
Verify Local TCP/IP Stack
Ping the loopback address 127.0.0.1. This tests that the TCP/IP protocol stack is installed and functioning on the local host. A failure here indicates a corrupted TCP/IP stack or missing protocol installation. On Windows, you can also ping the local host's own IP address to verify that the IP is bound to the network adapter. If loopback succeeds but pinging the local IP fails, the network adapter driver may be faulty.
Check Default Gateway Reachability
Ping the default gateway IP address obtained from ipconfig. This verifies that the local network and the router are reachable. If this fails, the problem is likely within the local subnet: faulty cable, misconfigured IP/subnet mask, or the router is down. If it succeeds, the issue is beyond the local network.
Test Remote Connectivity
Ping a known remote IP address (e.g., 8.8.8.8). If this fails but the default gateway ping succeeded, the problem is likely on the WAN side or with the ISP. If it succeeds, the issue may be DNS resolution. Use nslookup to test DNS. If nslookup resolves the name but ping to the name fails, the remote host may be blocking ICMP.
Perform DNS Resolution Test
Use nslookup to resolve a hostname, e.g., `nslookup example.com`. If it returns an IP address, DNS is working. If it fails, try querying a different DNS server (e.g., `nslookup example.com 8.8.8.8`). If that succeeds, the issue is with the configured DNS server. If it fails, the domain may not exist or there is a network path issue to the DNS server.
Trace Route to Destination
Use tracert to the destination IP or hostname. This reveals the path and identifies where packets are being dropped or delayed. Look for hops that show asterisks (timeouts) or significantly higher latency. If a particular hop consistently times out, that router may be filtering ICMP or there is a routing problem. If the trace stops before reaching the destination, the last responding hop may be the point of failure.
Enterprise Scenario 1: Office Network Outage
A user reports being unable to access the internet. The help desk follows a systematic ping-based approach:
1. ipconfig /all reveals the IP is 169.254.x.x (APIPA), indicating DHCP failure.
2. ipconfig /release then ipconfig /renew fails, confirming the DHCP server is unreachable.
3. Ping the loopback succeeds, but pinging the default gateway (manually set to 192.168.1.1) fails.
4. Checking the switch port shows the link light is off. A cable tester reveals a broken pair. Replacing the cable restores connectivity.
In this scenario, the tools quickly isolated the problem to Layer 1 (physical). The help desk avoided unnecessary router or server checks.
Enterprise Scenario 2: DNS Misconfiguration
A company migrates its web server to a new IP. Users can access the site by IP but not by hostname. The admin uses:
- nslookup www.company.com – returns the old IP.
- ipconfig /flushdns on a client, then nslookup again – still old IP.
- Checking the DNS server's cache and zone file reveals the old A record. After updating the zone and clearing the cache, nslookup returns the new IP. Users can now browse.
This demonstrates the importance of understanding DNS caching at both client and server levels.
Enterprise Scenario 3: Intermittent Packet Loss
A remote office experiences slow application performance. The network engineer runs:
- pathping remote-server.com – the output shows 10% packet loss at hop 5 and 20% loss at hop 6.
- Further investigation reveals a saturated WAN link at hop 5. The engineer prioritizes traffic and increases bandwidth, resolving the issue.
Pathping's ability to calculate per-hop loss over time made it the ideal tool, as ping and tracert only show instantaneous results.
Common Pitfalls
ICMP filtering: Many enterprise firewalls block ICMP. In such environments, ping and tracert may show timeouts even when the network is fine. Alternative tools like tcping or using TCP-based checks (e.g., Test-NetConnection in PowerShell) are necessary.
DNS caching: After changing DNS records, users may still resolve old IPs. Always flush the client DNS cache (ipconfig /flushdns) and wait for TTL expiration.
Multiple NICs: On servers with multiple network adapters, ipconfig output can be confusing. Use ipconfig /all and check the adapter description to identify the correct interface.
Exam Objectives (220-1101 Objective 2.4)
The CompTIA A+ 220-1101 exam tests your ability to use network command-line tools to troubleshoot connectivity and configuration issues. Specifically, you must know:
The purpose and syntax of ping, ipconfig, nslookup, tracert, pathping, netstat, and nbtstat.
How to interpret common output messages (e.g., "Request timed out", "Destination host unreachable", "Non-authoritative answer").
Which tool to use for a given symptom (e.g., use ipconfig /flushdns when a website resolves incorrectly).
The default values for key parameters (e.g., ping sends 4 packets on Windows, TTL default 128).
Common Wrong Answers and Why Candidates Choose Them
Using nslookup to test general connectivity: Candidates often think that if nslookup succeeds, the network is fine. Reality: nslookup only tests DNS. A host may be resolvable but unreachable due to routing or firewall issues.
Confusing ipconfig /release with /renew: A common trap is to renew before releasing. The exam may ask the correct sequence: release first, then renew. If you renew without releasing, you may get the same IP.
Assuming ping failure means the host is down: ICMP may be blocked by firewalls. The exam may present a scenario where ping fails but the host is accessible via HTTP. The correct answer is that the firewall is blocking ICMP.
Misinterpreting "Destination host unreachable" vs. "Request timed out": "Destination host unreachable" is an ICMP message from a router indicating no route. "Request timed out" means no reply within 4 seconds, which could be due to packet loss or filtering.
Specific Numbers and Terms That Appear on the Exam
Ping default packet size: 32 bytes (Windows).
Ping default count: 4 (Windows).
Ping timeout: 4 seconds.
Loopback address: 127.0.0.1.
APIPA range: 169.254.0.0/16.
Tracert max hops: 30.
nslookup non-authoritative answer: Indicates a cached response.
Edge Cases and Exceptions
IPv6: The exam may test ping with IPv6 addresses (e.g., ping ::1 for loopback). ipconfig shows IPv6 addresses as well.
Linux/macOS: While the exam focuses on Windows, you should know that Linux uses ifconfig instead of ipconfig, and traceroute instead of tracert. However, the exam typically specifies the OS in the question.
Pathping vs. tracert: Pathping sends 100 packets per hop over a period, while tracert sends 3 probes per hop instantly. Use pathping for long-term analysis, tracert for quick path discovery.
How to Eliminate Wrong Answers
If the symptom is "cannot access website by name but can by IP", the issue is DNS. Eliminate any answer that suggests ping or tracert as the primary tool; use nslookup and ipconfig /flushdns.
If the symptom is "intermittent connectivity", pathping is better than ping because it shows loss over time.
If the symptom is "no network access at all", start with ipconfig to check IP configuration, then ping the loopback, then the gateway.
If the question asks for the tool to view active TCP connections, the answer is netstat -a or netstat -an.
Ping tests reachability using ICMP; default 4 packets on Windows, timeout 4 seconds.
ipconfig /all displays detailed IP configuration; /release and /renew manage DHCP leases.
nslookup queries DNS servers; use it to test hostname resolution, not general connectivity.
tracert maps the path to a destination using TTL manipulation; default max hops is 30.
pathping combines ping and tracert, sending 100 packets per hop to calculate loss over time.
netstat -an shows all active TCP/UDP connections with numeric addresses and ports.
The loopback address 127.0.0.1 tests the local TCP/IP stack only.
APIPA (169.254.x.x) indicates DHCP failure; use ipconfig /release and /renew to retry.
DNS caching at the client can be cleared with ipconfig /flushdns.
Always verify the default gateway with ping before troubleshooting remote connectivity.
These come up on the exam all the time. Here's how to tell them apart.
ping
Tests end-to-end reachability to a single host.
Sends ICMP Echo Requests and waits for Echo Replies.
Shows success/failure and round-trip time (RTT).
Default: 4 packets on Windows, unlimited on Linux.
Cannot identify where packet loss occurs along the path.
tracert
Maps the route packets take to a destination.
Sends packets with incrementing TTL values to elicit ICMP Time Exceeded messages from routers.
Shows each hop's IP and RTT for three probes.
Default max hops: 30.
Can identify the specific hop where packet loss or high latency occurs.
Mistake
Ping is always the first troubleshooting step for any network issue.
Correct
Ping should not be the first step if the issue is clearly DNS-related (e.g., hostname resolution failure). Use nslookup first. Also, ping may be blocked by firewalls, so a failed ping does not always indicate a problem.
Mistake
ipconfig /renew always gets a new IP address.
Correct
ipconfig /renew requests a lease from the DHCP server. If the DHCP server is unavailable, the client may retain its current IP or fall back to APIPA (169.254.x.x). Renewing without releasing may also result in the same IP.
Mistake
nslookup tests end-to-end connectivity.
Correct
nslookup only queries DNS servers. It does not test reachability to the target host. A host can have a valid DNS record but be unreachable due to routing, firewall, or server failure.
Mistake
Tracert and pathping are interchangeable.
Correct
Tracert quickly shows the path and RTT for each hop with three probes. Pathping sends many packets over a longer period (default 300 seconds) and calculates packet loss per hop. They serve different purposes: tracert for quick path discovery, pathping for loss analysis.
Mistake
The loopback address 127.0.0.1 tests the network adapter.
Correct
Pinging 127.0.0.1 tests the TCP/IP protocol stack only. It does not test the network adapter or cable. To test the adapter, ping the host's own IP address or another host on the same subnet.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Ping tests end-to-end reachability and measures round-trip time to a single host. Tracert maps the entire path from source to destination by sending packets with incrementing TTL values, showing each router hop. Use ping to quickly check if a host is reachable; use tracert to identify where along the path packets are being dropped or delayed.
First, run `ipconfig /release` to release the current IP lease. Then run `ipconfig /renew` to request a new lease from the DHCP server. If the DHCP server is reachable, you will get a new IP. If the process fails, you may get an APIPA address (169.254.x.x), indicating the DHCP server is unreachable.
The website may be hosted on a server that blocks ICMP (ping) traffic but allows HTTP/HTTPS. This is common for security reasons. Ping failure does not necessarily mean the server is down; it only means ICMP Echo Requests are not responded to. Use a tool like `Test-NetConnection` or `tcping` to test TCP connectivity on port 80 or 443.
It means the DNS server that responded is not the authoritative name server for the domain. The response came from a caching DNS server (e.g., your ISP's DNS or a public DNS like 8.8.8.8). The answer may be stale if the TTL has not expired. For authoritative answers, query the domain's name servers directly using `nslookup -type=NS example.com` and then query those servers.
Run `netstat -ano` to list all connections and listening ports with their associated process IDs (PIDs). Then use Task Manager (or `tasklist /fi "PID eq <PID>"`) to find the process name. For example, `netstat -ano | findstr :80` shows all connections on port 80 with PIDs.
TTL (Time to Live) prevents packets from looping indefinitely. Each router decrements the TTL by 1. When TTL reaches 0, the router discards the packet and sends an ICMP Time Exceeded message back to the source. Tracert uses this mechanism to discover routers along the path by starting with TTL=1 and incrementing. Ping uses TTL to limit the packet's lifespan; default TTL is 128 on Windows, 64 on Linux.
Yes. In interactive mode, type `set type=mx` then enter the domain name. Alternatively, use `nslookup -type=mx example.com`. This returns the mail exchange servers for the domain, which is useful for troubleshooting email delivery issues.
You've just covered Network Command Tools: ping, ipconfig, nslookup, tracert — now see how well it sticks with free 220-1101 practice questions. Full explanations included, no account needed.
Done with this chapter?