How it works
Command-line tools report what the network is actually doing rather than what a diagram says it should. Their output is evidence, and reading it accurately is a skill in itself.
Run the tool that answers the question you are asking, then read the whole output rather than the last line. Intermediate results often carry the finding.
Common error
Absence of a reply is not always failure. Knowing which non-answers are normal prevents a lot of wasted investigation.
Worked example
Interpret example command output without running disruptive commands.
Evidence
Address: 10.3.5.22/24
Gateway: 10.3.5.1
DNS query: timeout
HTTPS test by address: succeedsThe address and gateway are plausible for this subnet; successful service access by address narrows the problem. A resolver timeout supports a DNS investigation but does not distinguish server failure from filtering or misconfiguration. Compare resolver reachability and known-good settings.
Exercises
4.4.1
What information would you collect before changing DNS settings after a timeout?
Show solution
Record the configured resolver, the exact name queried, timestamps and error output, whether other clients are affected, and whether an approved alternate resolver answers. A timeout alone does not identify a unique cause.
4.4.2
Why should a technician preserve the original diagnostic output along with the interpretation?
Show solution
Another technician can review the evidence, compare later results, and detect mistaken assumptions. The interpretation may change, but the original readings establish what was actually observed.