Network Troubleshooting Tools: Built-In Commands and 8 Platforms Ranked by Use Case

Good troubleshooting is a sequence, not a tool. You test one layer, rule it out and move up the stack. Built-in commands answer the first questions in seconds. Monitoring platforms answer the questions that commands cannot, such as what changed overnight or whether a link was already congested at 2 a.m.

Most commands in this guide rely on ICMP, defined in RFC 792, and on DNS, defined in RFC 1035. Knowing what those protocols promise helps you read results correctly. For example, a failed ping does not always mean a host is down, because firewalls often block ICMP. For wider coverage see our Linux network troubleshooting guide and the network monitoring software category.

Tool	Best for	Type
ping	Basic reachability and latency	Built-in command
traceroute / tracert / pathping	Where along the path packets stop or slow	Built-in command
nslookup / dig	DNS resolution faults	Built-in command
netstat / ss	Open ports and active connections	Built-in command
Wireshark	Deep packet inspection	Open source
Paessler PRTG	Ongoing availability and bandwidth history	Platform, freemium
ManageEngine OpManager	Device, interface and fault monitoring	Platform, freemium
SolarWinds NPM	Path and performance visibility	Platform, from $1,700
Auvik	Automated discovery and topology maps	Platform
Progress WhatsUp Gold	Maps and alerting	Platform, freemium
Datadog Network Monitoring	Cloud and on-premises correlation	Platform, freemium
Cisco ThousandEyes	Internet and cloud path visibility	Platform, custom pricing

How We Chose These Network Troubleshooting Tools

We combined the commands every administrator should know with platforms from SaaSPodium's network monitoring and network analyzer categories. We matched each to the fault type it detects fastest rather than ranking by popularity.

Directory ratings are not yet populated for these listings, so there is no score ranking. Pricing signals come from the SaaSPodium listings as of November 2026. Always confirm editions and limits with the vendor.

A Layer-by-Layer Troubleshooting Workflow

Start at the bottom and work upward: confirm the physical link, then IP configuration, then reachability, then name resolution, then the application port. Each step either finds the fault or eliminates a whole class of causes.

• Physical and link: check cabling, port status, duplex and error counters on the switch.
• IP configuration: verify address, mask, gateway and DNS settings with ipconfig or ip addr.
• Reachability: ping the gateway, then a remote address by IP, then by name.
• Path: run traceroute to see which hop adds delay or drops packets.
• DNS: use nslookup or dig against a specific resolver.
• Application: test the port with a connection check, then inspect packets if the handshake fails.

Built-In Commands Every Admin Should Know

Operating system commands are free, always available and fast. They give a first answer in seconds, which is often enough to decide whether the fault is local, on the path or at the remote service.

Ping and Traceroute

Ping sends ICMP echo requests and reports round-trip time and loss. Traceroute (tracert on Windows) lists each router along the path using increasing time-to-live values. On Windows, pathping combines both and calculates loss per hop over a longer sample, which helps when loss is intermittent.

Nslookup, Dig and Ipconfig

Nslookup and dig query DNS and let you choose the resolver, which separates a bad record from a broken resolver. Ipconfig and ifconfig (or ip addr) show address and DNS settings. A wrong default gateway or a leftover static DNS entry is a surprisingly common cause of single-user outages.

Netstat and Ss

Netstat and ss list listening ports and active connections. They confirm whether a service is listening, which tells you whether the fault is the application or the network. Combine them with the process list to find which program owns a port.

1. Wireshark

Wireshark is the standard open-source packet analyzer for capturing and inspecting traffic. Use it when logs and counters cannot explain why a connection resets, stalls or negotiates the wrong parameters.

• Strengths: protocol decoding, filters and follow-stream views for TCP and TLS handshakes.
• Limits: needs a capture point on the right link, and encrypted payloads stay opaque.
• Pricing model: free and open source. Vendor site: Wireshark.

2. Paessler PRTG Network Monitor

PRTG monitors devices, bandwidth and services using sensors, so you can see whether a problem is new or recurring. Its history answers the question admins hear most: was it like this yesterday?

• Strengths: quick setup, maps and alerting from one console.
• Architecture: self-hosted on Windows with remote probes.
• Pricing model: freemium; cost rises with sensor count.

3. ManageEngine OpManager

OpManager provides unified network and infrastructure monitoring with discovery, fault management and performance trends. It helps teams that want troubleshooting data alongside device configuration tools.

• Strengths: auto-discovery, SNMP and fault alerts, and reports for interface health.
• Architecture: self-hosted, with a free edition for small estates.
• More: read our OpManager review.

4. SolarWinds Network Performance Monitor

SolarWinds NPM helps reduce network outages and improve performance by showing device health, interface utilization and path details. It is suited to larger networks with multiple vendors.

• Strengths: deep SNMP coverage and performance baselines.
• Architecture: self-hosted Orion platform with add-on modules.
• Pricing model: listed from $1,700 on SaaSPodium as of November 2026.

5. Auvik

Auvik simplifies network management with automated discovery and topology maps. Its drawn network layout lets technicians trace a fault visually instead of reading device lists.

• Strengths: automatic maps, inventory and change tracking.
• Architecture: cloud service with an on-site collector.
• Fit: MSPs and small IT teams managing many sites.

6. Progress WhatsUp Gold

WhatsUp Gold lets teams see everything connected to the network, with maps, availability checks and alert rules that point to the failing device, so teams can see which dependency broke first.

• Strengths: clear dependency maps and notification workflows.
• Architecture: self-hosted Windows server.
• Pricing model: freemium option listed.

7. Datadog Network Monitoring

Datadog Network Monitoring unifies cloud and on-premises network visibility. It helps when a fault spans an application, a cloud network and a physical device, because one view links them.

• Strengths: correlation with metrics, traces and logs.
• Architecture: SaaS with agents.
• Fit: teams already using Datadog.

8. Cisco ThousandEyes

Cisco ThousandEyes provides digital experience monitoring across networks you do not own, such as the internet and SaaS providers. It shows where a path breaks outside your perimeter.

• Strengths: hop-by-hop internet path views and application reachability tests.
• Architecture: cloud platform with lightweight agents.
• Pricing model: custom pricing in the SaaSPodium listing.

Reading Latency and Loss Correctly

Latency is the delay for a packet to travel and return, and packet loss is the share of packets that never arrive. Together with jitter they explain most voice, video and application complaints.

A single dropped ping proves little. Sample at least 100 packets, test at different times and compare hops. If loss starts at one hop and continues to the end, that hop or the link after it is suspect. If loss appears only at one middle hop, the router may simply rate-limit ICMP.

Which Tool Should You Start With?

Use commands first, packet capture for protocol puzzles, and a monitoring platform for anything that repeats. A platform pays back quickest when the same fault returns weekly, since history replaces guesswork.

• One-off fault: ping, traceroute, nslookup and netstat.
• Protocol or handshake issue: Wireshark.
• Recurring slowness: PRTG, OpManager, SolarWinds NPM or WhatsUp Gold.
• Cloud and internet paths: ThousandEyes or Datadog.
• Many small sites: Auvik for maps and inventory.

Frequently Asked Questions

What are the best free network troubleshooting tools?
Built-in commands such as ping, traceroute, nslookup and netstat cost nothing, and Wireshark is free and open source. PRTG, OpManager and WhatsUp Gold also list freemium editions on SaaSPodium, which suit small networks.

When should I move from commands to a monitoring platform?
Move when the same problem recurs, when you manage more than a few dozen devices or when you need alerts before users complain. Platforms keep history and baselines, which commands cannot provide.

Can packet capture break privacy or compliance rules?
Yes. Captures can contain credentials and personal data. Limit access, filter to the needed hosts, store files securely and delete them after the investigation. Check your policy and local privacy law before capturing user traffic.