| Layer | Typical faults | Checks |
|---|---|---|
| 1 Physical | Unplugged or faulty cable, dead port, no power, damaged fibre | Link lights, swap cable, cable tester, check port |
| 2 Data link | Wrong VLAN, duplex mismatch, MAC filtering, loop | show interfaces, VLAN membership, switch MAC table |
| 3 Network | Wrong IP, mask or gateway, duplicate IP, routing fault, APIPA address | ipconfig, ping, tracert, routing table |
| 4 Transport | Port blocked by firewall, service not listening | netstat/ss, telnet host port, firewall rules |
| 5-7 Application | Service stopped, misconfiguration, certificate expired, DNS error | Service status, application logs, browser errors |
Quick story
"Email fails." Ping to the mail server's IP works → not Physical/Network. nslookup mail.school.lk fails → DNS (application helper) before you rebuild SMTP. Always separate path problems from name problems from service problems.
Symptoms by layer (practical view)
| Layer | Typical symptoms | First checks |
|---|---|---|
| Physical | No link light, intermittent disconnects | Cable, port, power, Wi-Fi radio |
| Data link | Linked but no MAC learning / VLAN mismatch | Correct VLAN, switchport mode, MAC table |
| Network | Cannot ping gateway or remote nets | IP, mask, gateway, routing |
| Transport | Ping works, app port fails | Firewall ports, listening service (ss) |
| Application | Port open but app errors | URL, DNS name, app logs, certificates |
A fault at a lower layer breaks everything above it. That is why "blinky lights first" saves time when the whole PC seems dead on the network.
Remember
- Map the symptom to a layer, then test at that layer.
- Connectivity (ping) succeeding does not prove the application layer is healthy.