Field Tech Toolkit
Guided Network Troubleshooting for Everyone
We walk you through diagnosing your network step by step — no tech support needed. Whether your internet is down, port forwarding won’t work, or you just want to understand your setup better, we’ll help you figure out what’s going on and where the problem is.
What Brought You Here?
Pick the scenario closest to yours — we’ll point you to the right starting step.
Before We Start: Are You on Cellular Data?
Are you reading this on your phone using cellular data (4G/5G) instead of your home Wi-Fi?
If your home Wi-Fi is completely down, don’t worry — we’ll guide you to connect directly to your modem in the steps below.
Your phone can connect to the internet two different ways: through your home Wi-Fi, or through your cellular carrier (AT&T, Verizon, T-Mobile, etc.). These are completely separate networks. If we run a diagnostic test while you’re on cellular, we’re testing your carrier’s network, not your home connection — and we’d be diagnosing the wrong thing entirely.
Discovered something new — like a cable was unplugged, a light was off on the modem, or you realized you’re on a different network? Note it here. You don’t have to start over — just update what you know and keep going.
This note stays with you as you work through the steps. Jump to any step above if you need to revisit earlier answers.
How Are You Connected?
Is your computer connected via Wi-Fi (wireless) or Ethernet (a physical cable plugged into your computer)?
If you’re not sure, look at the back or side of your laptop — if there’s a cable running from it to your router or modem, that’s Ethernet. If not, you’re on Wi-Fi.
Wi-Fi adds an extra layer between you and your router — it can be affected by distance, walls, interference from other devices, and signal congestion. Ethernet is a direct physical connection and eliminates all of those variables. For troubleshooting, Ethernet gives us the most reliable test results.
Discovered something new — like a cable was unplugged, a light was off on the modem, or you realized you’re on a different network? Note it here. You don’t have to start over — just update what you know and keep going.
This note stays with you as you work through the steps. Jump to any step above if you need to revisit earlier answers.
Business or Residential Internet?
Do you have a business-class or residential internet plan? Check your bill or contact your provider if you’re not sure.
Business Class
- Costs roughly double residential
- Comes with a static IP address
- Port forwarding works reliably
- SLA guarantees (uptime commitment)
- Better support from your provider
Residential
- More affordable
- Usually a dynamic IP (changes periodically)
- Port forwarding may not work (CGNAT)
- No uptime guarantees
- Standard support
Your service type determines what’s possible. If you’re trying to host a game server, run a security camera remotely, or access your home network from outside — you generally need a static IP and the ability to port forward. Business-class connections include this by default. Residential connections often don’t, and some providers use CGNAT (Carrier-Grade NAT) which makes port forwarding impossible regardless of your router settings.
Discovered something new — like a cable was unplugged, a light was off on the modem, or you realized you’re on a different network? Note it here. You don’t have to start over — just update what you know and keep going.
This note stays with you as you work through the steps. Jump to any step above if you need to revisit earlier answers.
Do You See Multiple Wi-Fi Networks?
Open your Wi-Fi settings and look at the available networks. Do you see more than one that looks like it belongs to your house?
Which one are you connected to? Your personal router’s network (the one you set up with your own name and password) is usually the right choice for daily use. But for troubleshooting, we may ask you to connect to the modem’s default network to isolate the problem.
If both your modem and router are broadcasting Wi-Fi, they might be fighting each other — causing slow speeds, dropped connections, or devices jumping between networks. Knowing which network you’re on tells us which part of the chain we’re testing. It’s generally not best practice to have both broadcasting simultaneously, but during troubleshooting, having both available can help us isolate where the problem is.
Discovered something new — like a cable was unplugged, a light was off on the modem, or you realized you’re on a different network? Note it here. You don’t have to start over — just update what you know and keep going.
This note stays with you as you work through the steps. Jump to any step above if you need to revisit earlier answers.
Are You Trying to Port Forward or Access Your Network Remotely?
Are you trying to set up a game server, access a security camera from outside your home, run a web server, or use remote desktop?
Setting Up a Game Server or Remote Access on Residential Internet?
If you can’t get port forwarding to work on residential internet, it’s probably because your provider uses CGNAT (Carrier-Grade NAT) or doesn’t give you a real public IP. You typically need business-class internet with a static IP for reliable port forwarding.
Some residential providers do offer static IPs — but we want to be honest: sometimes they do it right, sometimes they don’t. It varies by provider and region. If you go this route, make sure to verify it’s actually a public static IP and not just a static private address behind their NAT.
Two Approaches to Remote Access
Dynamic DNS (DDNS)
Services like DynDNS, No-IP, or Duck DNS track your changing IP and map it to a hostname you choose (like myhome.ddns.net).
- Pros: Works on residential internet, usually free or cheap, many routers have it built in
- Cons: Depends on a third-party service, slight delay when your IP changes, still won’t work behind CGNAT
Static IP + Port Forwarding
Get a real static IP from your ISP and configure port forwards on your router to direct incoming traffic to the right device.
- Pros: Most reliable, no third-party dependency, your address never changes
- Cons: Costs more (usually business class), security exposure if misconfigured
Port forwarding lets traffic from the internet reach a specific device on your local network. Think of it like having a building with one public address (your IP) and many offices (your devices). Port forwarding is the directory that tells visitors which office to go to. Without it, or without a public IP, visitors can’t get in at all. CGNAT means your ISP puts you behind their router, so your “public IP” is actually shared with other customers — making port forwarding impossible from your end. RFC 6598 defines the CGNAT shared address space (100.64.0.0/10). RFC 5780 covers NAT behavior requirements.
Discovered something new — like a cable was unplugged, a light was off on the modem, or you realized you’re on a different network? Note it here. You don’t have to start over — just update what you know and keep going.
This note stays with you as you work through the steps. Jump to any step above if you need to revisit earlier answers.
Connect Directly to Your Modem
To figure out if the problem is your internal network (router, access points) or your ISP connection, we need to bypass your router and connect directly to the modem.
Best Option: Ethernet Cable
Get an Ethernet cable and plug one end into your laptop and the other directly into your ISP modem (not your router). This gives the cleanest test with no wireless variables.
Alternative: Modem Wi-Fi
Connect to the modem’s default Wi-Fi network (the one from your ISP, not your personal router). This isn’t ideal long-term, but it works for testing.
Your home network is a chain: Device → Wi-Fi/Ethernet → Router → Modem → ISP → Internet. If something is broken, you need to know which link is failing. By connecting directly to the modem, you skip your router entirely. If the internet works when connected to the modem but not through your router, the problem is your router. If it doesn’t work even connected to the modem, the problem is upstream — your ISP or modem itself.
Discovered something new — like a cable was unplugged, a light was off on the modem, or you realized you’re on a different network? Note it here. You don’t have to start over — just update what you know and keep going.
This note stays with you as you work through the steps. Jump to any step above if you need to revisit earlier answers.
Double NAT Nightmare
Double NAT happens when you have two devices both doing network address translation — usually your ISP’s modem/gateway and your personal router. Each one creates its own private network, so your devices end up on a network inside a network.
How to Tell If You Have Double NAT
- Check your router’s WAN IP. Log in to your personal router’s admin page and look at the WAN (internet) IP address. If it starts with
10.x.x.x,172.16–31.x.x, or192.168.x.x, your router is getting a private IP from the modem — not a public one. That’s Double NAT. - Compare WAN IP to your public IP. Use our What’s My IP tool below. If the IP it shows is different from your router’s WAN IP, there’s another NAT layer between you and the internet.
- Run a traceroute. Open Terminal (macOS/Linux) or Command Prompt (Windows) and run
traceroute 8.8.8.8(ortracert 8.8.8.8on Windows). If you see two private IP hops before reaching public addresses, you have Double NAT.
What Double NAT Breaks
Broken
- Port forwarding (only the outer NAT has the public IP)
- Game server hosting / peer-to-peer gaming
- Security camera remote access
- VPN connections (some types)
- UPnP auto-configuration
Usually Still Works
- Web browsing, email, streaming
- Outbound connections (you connecting out)
- Cloud-based remote access (TeamViewer, etc.)
- Most apps that don’t need inbound connections
How to Fix It
- Put the modem/gateway in Bridge Mode. This is the best fix. Bridge mode tells the ISP modem to stop doing NAT and pass the public IP directly to your router. Look for “Bridge Mode” or “Passthrough” in the modem’s admin settings, or call your ISP and ask them to enable it.
- Use only one router. If you don’t need your personal router, connect directly to the modem’s built-in Wi-Fi. This eliminates the second NAT layer entirely.
- Set your router to AP Mode. If your router supports Access Point (AP) mode, it stops routing/NAT and just extends the modem’s network wirelessly. You keep your router’s Wi-Fi but remove the extra NAT.
- DMZ as a last resort. Some ISP modems let you put one device in the DMZ, forwarding all traffic to your router. This works but is less clean than bridge mode and may have security implications.
NAT (Network Address Translation) lets multiple devices share one public IP address. It works by rewriting the source address on outgoing packets and tracking which responses go back to which device. One layer of NAT is normal and expected. But when you stack two NAT layers, the inner router has no way to receive inbound connections from the internet — those connections hit the outer NAT first, and it has no idea where to send them. The result: anything that requires someone on the internet to connect to you fails silently. RFC 3022 defines traditional NAT. RFC 6598 defines the CGNAT shared address space (100.64.0.0/10). The private address ranges are defined in RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
Discovered something new — like your router’s WAN IP is a private address, or traceroute shows two private hops? Note it here and keep going.
This note stays with you as you work through the steps. Jump to any step above if you need to revisit earlier answers.
What’s My IP Address?
This shows you the public IP address the internet sees for your connection. It confirms you have a working internet connection and shows whether you have a real public IP or one behind your ISP’s NAT.
External Port Check
This tool checks whether a specific port on your network is reachable from the outside internet. We use an external probe server to test the connection from a completely different location — giving you a real-world answer, not just what your router thinks.
Port checking from inside your own network can lie to you — your router might say a port is open even when it’s blocked by your ISP or a firewall you don’t control. Our probe server sits on the public internet and tries to connect to your port from outside, giving you the real answer. This is the “You See / The Internet Sees” perspective that matters for game servers, remote access, and any service you want reachable from outside your home. We use an external probe server (Observe Probe VPS) for this test. The connection attempt originates from our infrastructure, not your device.
DNS Resolution Check
If you can see your public IP but websites won’t load, the problem might be DNS (the system that translates website names like google.com into IP addresses your computer can connect to).
Quick DNS Test
Try this in your terminal to test if DNS is working:
nslookup google.com
If that fails, try using a public DNS server directly:
nslookup google.com 8.8.8.8
If the second command works but the first doesn’t, your default DNS server (usually provided by your ISP) is the problem. You can switch to a public DNS like Google (8.8.8.8) or Cloudflare (1.1.1.1).
DNS (Domain Name System) is like the phone book of the internet. When you type “google.com,” your computer asks a DNS server to translate that name into an IP address (like 142.250.80.14) so it can actually connect. If DNS is broken, your internet connection might be perfectly fine, but your computer can’t find anything because it doesn’t know where to go. This is one of the most common “internet is down” situations that’s actually fixable in seconds. DNS is defined in RFC 1034 and RFC 1035. The public resolvers at 8.8.8.8 (Google) and 1.1.1.1 (Cloudflare) are free and generally faster and more reliable than ISP-provided DNS.
The Dual-Network Trick: Diagnose a Dead Network Remotely
What if your internet is completely down and you need remote help from a technician? Or what if you’re the technician trying to help someone hundreds of miles away whose network just died? There’s a real technique field engineers use to solve this exact problem.
The Concept: Two Networks at Once
Modern computers (especially Macs) can connect to two networks simultaneously — one for internet access, and one for local diagnostics. Here’s how it works:
- Get online via phone hotspot: Connect your iPhone (or Android) via USB tethering or Wi-Fi hotspot. This gives you a working internet connection through your cellular carrier.
- Connect to the dead network via Ethernet: Plug an Ethernet cable from your laptop into the router or switch of the network that’s down. This gives you local access to scan and diagnose devices on that network.
- Set network priority: In your system’s network preferences, set the phone hotspot as the primary internet connection. Your computer uses the hotspot for internet access (remote desktop, screen sharing, web browsing) while the Ethernet connection lets you scan and probe the local network.
On macOS
- Connect iPhone via USB cable
- Open System Settings → Network
- Click the … menu → Set Service Order
- Drag iPhone USB above Ethernet
- Your Mac uses the phone for internet, Ethernet for local scanning
On Windows
- Enable phone hotspot (USB or Wi-Fi)
- Open Control Panel → Network Connections
- Right-click the hotspot adapter → Properties → IPv4 → Advanced
- Set a lower interface metric (e.g., 10) than the Ethernet adapter’s metric
- Windows routes internet through the hotspot, local traffic through Ethernet
When a network goes down, you lose the ability to remotely access it — which creates a catch-22 for remote support. The dual-network technique solves this by separating internet access (phone hotspot) from local network access (Ethernet). Your operating system’s routing table handles this naturally: traffic to the local subnet (e.g., 192.168.x.x, 10.x.x.x) goes through Ethernet, while everything else routes through the hotspot’s default gateway. This is the same principle behind multi-homed servers and policy-based routing used in enterprise environments.
Essential Terminal Commands
You don’t always need a website — these built-in commands are a technician’s first line of defense. Open your terminal (Command Prompt on Windows, Terminal on Mac/Linux) and try these:
| What It Does | Windows | macOS / Linux |
|---|---|---|
| Continuous connection test (checks for intermittent drops) | ping -t 8.8.8.8 |
ping 8.8.8.8 |
| Trace the path to a website (shows every hop) | tracert google.com |
traceroute google.com |
| Clear DNS cache (fixes “server not found” errors) | ipconfig /flushdns |
sudo dscacheutil -flushcache |
| Show active network connections and ports | netstat -an |
netstat -an |
| Show your local network configuration | ipconfig /all |
ifconfig or ip addr |
| Look up a domain’s DNS record | nslookup example.com |
dig example.com |
| Measure network quality (upload, download, responsiveness) | Not available | networkQuality |
| Detailed network quality with per-flow metrics | Not available | networkQuality -v |
networkQuality: Built into macOS Monterey and later, this Apple command measures your network’s upload capacity, download capacity, and responsiveness (RPM — Round-trips Per Minute) simultaneously. Unlike traditional speed tests, it measures under load — meaning it shows how your network performs when you’re actually using it. Run networkQuality -v for per-flow breakdowns. This is what field technicians use to quickly assess real-world connection quality without opening a browser.
Before You Paste a Terminal Command
Some commands (like sudo dscacheutil -flushcache) will ask for your password. Here’s what to expect so you’re not caught off guard:
- Paste the command into your terminal and press Return
- If it asks for a password, this is your Mac login password — the one you use to unlock your computer. It is not your Apple ID or iCloud password
- You will not see anything as you type — no dots, no asterisks, nothing. This is normal and intentional (it’s a security feature)
- Type your password carefully, then press Return
- If you think you made a typo, press Delete repeatedly to clear what you’ve typed (even though you can’t see it), then start over
Why no visible characters? If someone is watching your screen (shoulder-surfing), hiding the password length and characters prevents them from guessing it. This practice comes from Unix security design (circa 1970s) and remains standard on every Mac, Linux, and server terminal today.
These commands talk directly to your operating system’s network stack — no browser or third-party service needed. ping tests raw connectivity (RFC 792 — ICMP Echo). traceroute maps the hop-by-hop path your packets take, showing exactly where delays or drops occur. netstat reveals what programs on your computer are actively communicating over the network. These are the same tools network engineers use every day.
Industry-Standard Diagnostic Tools
Beyond what we offer here, these are the tools professional field technicians reach for. We’re listing them because they’re genuinely useful — not because we’re affiliated with any of them.
Speedtest by Ookla
The industry standard for measuring download/upload speed, latency, and jitter. Helps determine if you’re getting what you’re paying for.
speedtest.netFast.com
Netflix-powered speed test. Useful for checking if your ISP is throttling streaming traffic specifically — if Fast.com shows slower speeds than Ookla, that’s a red flag.
fast.comPingPlotter
Combines ping and traceroute into a visual graph over time. Shows exactly where in the network path you’re losing packets or experiencing latency spikes.
pingplotter.comDowndetector
Crowdsourced outage reports. Before you spend an hour troubleshooting, check here to see if your ISP or service is having a widespread outage.
downdetector.comFing
Network scanner that identifies all devices on your Wi-Fi. Helps you spot bandwidth hogs, unauthorized devices, or rogue access points.
fing.comWireshark
Professional packet analyzer — see exactly what’s happening on the wire. Advanced tool for identifying protocol issues, hidden background traffic, or malware communication.
wireshark.orgNo single tool does everything. Speedtest measures throughput. PingPlotter maps the path. Wireshark shows the packets. Downdetector checks if it’s just you or everyone. Together, they cover the full diagnostic spectrum from “is it plugged in?” to “which router in my ISP’s backbone is dropping 12% of my packets between hops 4 and 5.” We built the Field Tech Toolkit to handle the guided troubleshooting flow and the tests you can run right here — but for deep dives, these tools are what the pros use.
We use two cookies, both essential:
_csrf— Prevents cross-site request forgery. Required for form submissions. Security-only._dns_session— Only exists if you choose to sign in. No account required to use DNS Tool.
We log your IP address for two reasons: rate limiting (so nobody abuses the service) and security (identifying malicious actors and complying with legal obligations). We check source geography for analysis accuracy — DNS responses vary by region, and knowing which resolver answered from where makes the science better.
No tracking cookies. No analytics cookies. No ad networks. No data brokers. Our code is open-core — the application framework is publicly available under BUSL-1.1 with timed Apache-2.0 conversion. Verify it yourself.
If you create an account and want out, account deletion removes your login and scan history. Public domain analyses remain available because they contain only public DNS records, already hashed. Full details: Privacy Pledge.
