Diagnosing an enterprise internet outage

Requirements

• The incident time window
• Client and gateway details
• Firewall and switch logs when available

Capture client configuration

Record IP, gateway and DNS during the incident. An APIPA address indicates a DHCP problem.

ipconfig /all
route print
arp -a

Test layer by layer

Test gateway, an external IP and finally DNS resolution.

ping <GATEWAY_IP> -n 20
ping 1.1.1.1 -n 20
nslookup example.com
tracert 1.1.1.1

Create a timestamped log

Capture short interruptions for later correlation.

$Targets='<GATEWAY_IP>','1.1.1.1','example.com'
while($true){foreach($Target in $Targets){$OK=Test-Connection $Target -Count 1 -Quiet -ErrorAction SilentlyContinue;"$(Get-Date -Format s) | $Target | $OK"|Out-File .\connectivity.log -Append};Start-Sleep 5}