9.1Troubleshooting methodology

1. Identify the problem: gather information, ask questions (who, what, when, what changed?), reproduce the fault, define the scope (one user, one subnet, everyone).
2. Establish a theory of probable cause (start with the simple and common).
3. Test the theory to confirm; if wrong, form a new theory or escalate.
4. Establish a plan of action and consider the impact (get approval for production changes).
5. Implement the solution (change only one thing at a time).
6. Verify full system functionality and apply preventive measures.
7. Document findings, actions and outcomes.

Approaches

• Top-down: start at the application layer and move down.
• Bottom-up: start at the physical layer and move up (best when nothing works).
• Divide and conquer: start at a middle layer (usually ping at layer 3) and move up or down depending on the result.
• Follow the path and compare with a working system; substitute known-good parts.

Making the seven steps concrete

1. Identify: "Who is affected — one PC, one VLAN, or everyone? Did anything change (new switch, new DHCP, Windows update)?" Reproduce the fault yourself.
2. Theory: start with likely causes (unplugged cable, wrong gateway) before exotic ones.
3. Test theory: swap the cable, ping the gateway, check ipconfig. One experiment at a time.
4. Plan: for production, note downtime risk and get approval if needed.
5. Implement: apply the fix; avoid changing five settings at once.
6. Verify: confirm the original symptom is gone and related services still work.
7. Document: what you saw, what fixed it, how to prevent it — future you will thank you.

Which approach when?

• Bottom-up when the link lights are off or nothing pings.
• Top-down when the network seems fine but one application fails.
• Divide and conquer: ping gateway and a public IP first; branch up (DNS/app) or down (cable/NIC) from the result.