Octet

What is the follow-the-path method, and where do comparing with a working setup and swapping parts fit in?

Show the answer

Say this first

Follow the path means tracing the real route a packet takes, device by device, and checking at each hop that it arrives and leaves correctly: ARP, MAC table, route, ACL, NAT, firewall policy. Then I do the same for the return path, which can differ. It finds the one bad rule or route that a layer-by-layer check misses. Comparing with a working site or port shows the difference fast. Swapping a cable or optic is quick when the evidence points at hardware, but I record what I swapped and the counters before and after.

Go deeper

Follow the path, both directions

For a host in VLAN 10 reaching a server at another site:

  1. Host: IP, mask, gateway, DNS, ARP entry for the gateway.
  2. Access switch: MAC learned on the right port and VLAN, trunk carries the VLAN.
  3. Gateway: ARP entry for the host, route to the server subnet.
  4. Each router: show ip route 10.30.0.15, and show ip cef exact-route 10.10.0.25 10.30.0.15 when ECMP is involved. ACLs and NAT on the in and out interfaces.
  5. Firewall: which policy matched, NAT, the session table.
  6. Reverse it. The reply may take another router or another firewall.

Compare with a working one

Diff the broken device's config against a working peer or its last backup. Compare behavior too: a working host's ARP entry, route and capture next to the broken host's.

Swap components

Move the user to another port, replace the patch lead or the optic. Fast, and fine when the counters already point at hardware. The risk: the fault vanishes and you cannot tell whether the part or the reseat fixed it. Note the counters before and after.

Traps

  • Checking only the forward path. Return traffic through a different firewall is a classic cause.
How did you do?Book 3.3 Internet (IP)