NETOps / multi-vendor field desk

Network Workbench

Follow the evidence through the network: start with an IP, resolve the MAC, trace the physical port and VLAN, prove the route and firewall decision, then verify the real application flow. The same troubleshooting method is translated across major network vendors, operating systems and security platforms — with more platforms and workflows to come.

Start with the trail: use Live Chase for the IP → MAC → port → path flow. Use Troubleshoot to find the first layer where the evidence breaks, then jump to Vendors for the matching platform commands.

Follow the trail: IP → MAC → switch port/VLAN → next hop → route/FIB → firewall/session/NAT → service. At every step, prove what the device actually knows before moving downstream.

IP → MAC → physical port

Find where the endpoint lives

1. Generate traffic

Populate neighbor state if appropriate.

ping 10.20.30.44

2. Resolve IP → MAC

ip neigh show 10.20.30.44
show ip arp 10.20.30.44

3. Search the switching table

Find the VLAN and interface where that MAC is learned.

show mac address-table address 001a.2b3c.4d5e

4. Follow trunks and neighbors

If the MAC points to an uplink, identify the neighboring device and repeat until the endpoint or access edge is found.

show lldp neighbors detail
show cdp neighbors detail

Port → path → application

Keep following the packet

5. Prove the forwarding decision

Check the route/FIB for the destination and confirm the expected next hop, interface and VRF.

ip route get 10.50.60.70
show ip route 10.50.60.70
show ip cef 10.50.60.70 detail

6. Prove security and state

At firewalls, confirm policy, session creation, NAT and the return path rather than assuming traffic was allowed.

7. Prove the service

Test DNS and the real TCP/UDP application port. A successful ping does not prove the application works.

Test-NetConnection 10.50.60.70 -Port 443
curl -vkI https://example.com/

8. Capture where evidence disappears

When the tables stop answering the question, capture close to each boundary and follow the request and reply.

Troubleshoot the network by evidence

The workflow is vendor-neutral: find the first point where expected evidence disappears, then use the platform-specific command set to prove that layer.

1–4 · Endpoint and access

1 · Physical

Link, optics, speed/duplex, errors, CRC, drops, interface state.

2 · VLAN / L2

Access VLAN, trunk allowance, STP state, MAC learning, port-channel membership.

3 · Addressing

IP, mask/prefix, gateway, DHCP lease, duplicate IP, ARP/ND.

4 · First hop

Can the client reach its gateway? Does the gateway have the expected neighbor entry?

5–8 · Path, security and application

5 · Routing

Longest-prefix match, next hop, VRF, policy route, ECMP and return route.

6 · Security / NAT

Firewall policy, session state, NAT translation, ACLs and asymmetric routing.

7 · Service

DNS answer, TCP/UDP port, TLS, proxy/load balancer and application response.

8 · Capture

Capture close to source and destination. Compare request, response, retransmits, resets and directionality.

What each table proves

Table	Maps	Question
ARP / Neighbor	IP → MAC	Who owns this local L3 address?
MAC / FDB	MAC → port/VLAN	Where is this L2 identity learned?
Route / FIB	prefix → next hop	Where will this packet be forwarded?
Session	5-tuple → state	Did the firewall see, allow and translate the flow?

MAC formats

Colon00:1a:2b:3c:4d:5e

Dash00-1a-2b-3c-4d-5e

Cisco dotted001a.2b3c.4d5e

Read the decision

Linux

ip route get 8.8.8.8
ip rule

Cisco

show ip route 8.8.8.8
show ip cef 8.8.8.8 detail

Juniper

show route 8.8.8.8
show route forwarding-table destination 8.8.8.8

Trace the path

Linux

traceroute 8.8.8.8
tracepath 8.8.8.8

Windows

tracert 8.8.8.8
pathping 8.8.8.8

Network geartraceroute 8.8.8.8

Interpretation

Longest prefix wins

A /24 beats a /16, which beats the default /0.

Forward ≠ return

Prove the reverse path when stateful devices or asymmetric routing are involved.

Control ≠ forwarding

When available, inspect the FIB/CEF, not only the routing table.

DNS

Linux / macOS

dig example.com
dig +trace example.com
resolvectl status

Windows

Resolve-DnsName example.com
nslookup example.com

Prove the actual service

TCP port

nc -vz 10.50.60.70 443
Test-NetConnection 10.50.60.70 -Port 443

HTTP / TLS

curl -vkI https://example.com/
openssl s_client -connect example.com:443 -servername example.com

Listening sockets

ss -tulpn
Get-NetTCPConnection

Capture narrowly

Choose the endpoints and service before collecting packets.

Linux

sudo tcpdump -ni any 'host 10.20.30.44 and host 10.50.60.70'
sudo tcpdump -ni eth0 'host 10.50.60.70 and port 443' -w trace.pcap

FortiGatediagnose sniffer packet any 'host 10.20.30.44 and host 10.50.60.70' 4 0 l

Cisco IOS-XE

Embedded Packet Capture syntax and capability varies by release/platform; verify locally before production use.

Read the evidence

SYN, no SYN-ACK

Check path, firewall, service listener and return route.

RST

Host is reachable but something actively rejected or closed the connection.

Retransmissions

Look for loss, MTU/MSS, congestion, asymmetric filtering or a failing path.

Request leaves, reply never returns

Move the capture point downstream until you find the boundary where evidence disappears.

Major-vendor troubleshooting desk

The same evidence-first workflow translated to the platform in front of you. Current coverage includes Cisco IOS/IOS-XE, FortiGate, Juniper Junos, Palo Alto PAN-OS, Aruba AOS-CX, MikroTik RouterOS, Linux, Windows and Ubiquiti/UniFi. More vendors and platform-specific flows will be added as the workbench grows.

Cisco IOS / IOS-XE

Inspect

show ip interface brief
show interfaces status
show vlan brief
show interfaces trunk
show spanning-tree
show etherchannel summary
show ip arp
show mac address-table
show ip route
show ip cef
show cdp neighbors detail
show lldp neighbors detail
show interfaces counters errors
show logging

FortiGate

Inspect

get system status
get system interface physical
get system arp
get router info routing-table all
diagnose sys session list
diagnose sniffer packet any 'host 10.0.0.10' 4 0 l
execute ping 10.0.0.10
execute traceroute 10.0.0.10

Juniper Junos

Inspect

show interfaces terse
show arp no-resolve
show ethernet-switching table
show route
show route forwarding-table
show lldp neighbors
show log messages
ping 10.0.0.10 rapid count 5
traceroute 10.0.0.10

Palo Alto PAN-OS

Inspect

show arp all
show routing route
show session all filter source 10.0.0.10
show session all filter destination 10.0.0.20
ping host 10.0.0.20
traceroute host 10.0.0.20

Aruba AOS-CX

Inspect

show interface brief
show interface statistics
show vlan
show arp
show mac-address-table
show ip route
show lldp neighbor-info
ping 10.0.0.10
traceroute 10.0.0.10

MikroTik RouterOS

Inspect

/ip address print
/ip arp print
/interface bridge host print
/ip route print detail
/ip firewall connection print
/tool ping 10.0.0.10
/tool traceroute 10.0.0.10
/tool torch interface=ether1

Linux

Inspect

ip -br addr
ip -br link
ip neigh
ip route
ip route get 10.0.0.10
bridge fdb show
ss -tulpn
ethtool eth0
tcpdump -ni any host 10.0.0.10

Windows

Inspect

ipconfig /all
Get-NetIPConfiguration
Get-NetNeighbor
Get-NetRoute
Test-NetConnection 10.0.0.10 -Port 443
tracert 10.0.0.10
Resolve-DnsName example.com
Get-NetTCPConnection

Ubiquiti / UniFi

Inspect

Controller UI is often the safest source for client → AP/switch/port topology. Gateway shell availability varies by model/version.

ip neigh
ip route
ping 10.0.0.10
traceroute 10.0.0.10
tcpdump -ni any host 10.0.0.10

IPv4 subnet quick memory

CIDR	Mask	Addresses	Typical usable
/24	255.255.255.0	256	254
/25	255.255.255.128	128	126
/26	255.255.255.192	64	62
/27	255.255.255.224	32	30
/28	255.255.255.240	16	14
/29	255.255.255.248	8	6
/30	255.255.255.252	4	2
/31	255.255.255.254	2	2 on RFC 3021 point-to-point
/32	255.255.255.255	1	host route

Useful calculators

Linux ipcalcipcalc 192.168.20.44/27

Python standard librarypython3 -c "import ipaddress; print(ipaddress.ip_interface('192.168.20.44/27').network)"

IPv6 reminder

IPv6 uses Neighbor Discovery rather than ARP. Think prefix, route, NDP, router advertisements and ICMPv6.

ip -6 addr
ip -6 neigh
ip -6 route
ping -6 2001:4860:4860::8888