common failure modes

Overview

Networks fail in recognizable, recurring ways. Knowing the common failure modes — and their typical symptoms — lets you diagnose quickly and recognize when a "failure" is actually a security event. This lesson catalogs the usual suspects.

Learning objectives

• Identify common network failure modes and their symptoms.
• Map each failure to the layer and tool that reveals it.
• Distinguish ordinary faults from possible attacks.

Core concept

Recurring failure modes and their signatures:

• Physical/link failure — cable unplugged, Wi-Fi down, interface disabled. Symptom: no link, everything fails. (Layer 1)
• Bad IP configuration — wrong IP, mask, or missing/incorrect gateway. Symptom: cannot reach local or remote hosts. (Layer 3)
• DNS failure — path works but names do not resolve. Symptom: ping by IP works, by name fails. (Application)
• Gateway/routing failure — local hosts reachable but nothing beyond the LAN. Symptom: gateway pings, internet does not.
• Port/service down or blocked — host reachable but a specific service does not respond. Symptom: ping works, the app/port does not.
• Congestion/latency — high RTT, intermittent loss. Symptom: slow, unreliable connections.

How it works

Each failure mode produces a characteristic pattern that the troubleshooting tools expose. The diagnostic routine (config → gateway → external IP → external name) walks straight into the right conclusion: where the pings stop and where they succeed pinpoints the failing layer. Recognizing the pattern is faster than testing blindly.

Practical example

Symptoms: local file sharing works, but no websites load and ping to the gateway fails. Pattern → the local segment is fine (you reach other local hosts) but the gateway/routing is the problem. You check the gateway device and its configuration rather than DNS or cabling. Matching the symptom pattern to the failure mode directed you straight to the cause.

Cybersecurity relevance

Some "failures" are actually security events: sudden loss and unreachability can indicate a DoS attack; DNS returning wrong answers can indicate DNS spoofing; the gateway's MAC changing (an "odd" connectivity issue) can indicate ARP poisoning. A security-minded troubleshooter asks not only "what broke?" but "could this be an attack?" — distinguishing a benign fault from a malicious one.

Common mistakes

• Assuming every outage is benign — some are attacks (DoS, spoofing, poisoning).
• Not matching symptoms to a failure pattern, leading to slow, scattershot diagnosis.
• Overlooking service-specific failures, blaming "the network" when one port/service is the issue.

Key takeaways

• Common failures include physical/link, IP misconfiguration, DNS, gateway/routing, service down/blocked, and congestion — each with a telltale symptom.
• The stepwise troubleshooting routine localizes the failing layer by pattern.
• Some failures are security events (DoS, DNS spoofing, ARP poisoning), so consider malicious causes, not just benign ones.

Check your understanding

• If local hosts are reachable but nothing on the internet is, and the gateway does not ping, which failure mode is indicated?
• Give one example of a connectivity symptom that could actually be a security attack rather than a benign fault.