Support Network Services
Understand what network servers and appliances do—and troubleshoot from the symptom instead of memorizing isolated terms.
Mission goal
Learn to recognize network services by the job they perform, connect each service to its protocol and port clues, distinguish Internet and embedded appliances, and troubleshoot wired, wireless, Voice over Internet Protocol (VoIP), speed, and limited-connectivity problems.
7.1 • Start with the server's job
A server is easier to remember when you first ask, “What service is this system providing?” Then attach the protocol and port clue. A single physical or virtual host can provide one or more of these services.
| Service | What students should understand | Protocol / clue |
|---|---|---|
| File / print | Makes files or printers available to network clients. Samba provides SMB-compatible sharing. | SMB/Samba, NetBIOS, FTP, FTPS, SFTP |
| Database | Stores application data. A flat file is different from a database. Relational and non-relational databases organize data differently. | Relational: Oracle, MySQL, MariaDB. Non-relational: MongoDB, CouchDB. |
| Web | Hosts webpages and websites. The browser requests content from the web server. | HTTP 80; HTTPS 443; TLS certificate |
| Moves outgoing email between systems. | SMTP 25; secure submission/TLS clues include 587 and 465 in the module. | |
| Mailbox | Lets a user retrieve or synchronize messages stored in a mailbox. | POP3 110 / POP3S 995; IMAP 143 / IMAPS 993 |
| Directory / authentication | Directory services organize identity information; AAA services control who is authenticated, what they are authorized to do, and accounting of activity. | LDAP 389; LDAPS 636; RADIUS 1812/1813; TACACS+ 49 |
| Remote access | Allows a technician to work on another system using a terminal or remote desktop. | SSH 22; Telnet 23; RDP 3389 |
| Time | Keeps device clocks synchronized. Stratum levels represent levels of time-source accuracy. | NTP 123; NTS secure port 4460 |
| Monitoring | Collects device status or event information so administrators can see what is happening. | SNMP 161; SNMP traps 162; Syslog 514 |
A user can send email but needs a service to retrieve/synchronize mailbox messages. Which family of protocols fits?
POP3 or IMAP. The module separates the mail-sending role (SMTP) from mailbox retrieval/synchronization (POP3/IMAP).
A technician needs secure command-line remote access. SSH or Telnet?
SSH. The module identifies SSH on port 22 and Telnet on port 23; SSH is the secure remote-shell choice.
Web service: follow the request
HTTP uses port 80. HTTPS uses port 443 and adds Transport Layer Security (TLS). A certificate is part of the secure HTTPS relationship, and a Certificate Authority (CA) is associated with certificate trust.
AAA: three different questions
Authentication: Who are you?
Authorization: What are you allowed to access or do?
Accounting: What activity is recorded?
The module describes a supplicant, Network Access Server (NAS), and AAA server, with RADIUS and TACACS+ as AAA-related protocols.
A user has successfully proved identity but still cannot access a restricted resource. Which “A” should you think about?
Authorization: the identity may be authenticated while permissions still restrict what the user can do.
7.2 • Internet and embedded appliances
Proxy server
Makes full HTTP requests on behalf of client nodes. The module also associates proxies with content filtering.
UTM / spam gateway
A Unified Threat Management appliance can combine security functions such as firewall, antivirus, anti-malware, and intrusion detection/prevention. Email authenticity concepts include SPF, DKIM, and DMARC.
Load balancer
Distributes workload across multiple systems rather than sending all work to one system.
Legacy system
A system may reach End of Life (EOL) or End of Service Life (EOSL), meaning the original manufacturer or developer no longer supports it.
ICS / SCADA
Industrial Control Systems perform specific physical-process tasks such as power, HVAC, or cooling-pump control. SCADA monitors two or more ICSs. These belong to operational technology (OT) environments.
Internet of Things (IoT)
Connected smart devices can include wearables, appliances, vehicles, hubs, and controllers. The module highlights Zigbee and Z-Wave communication.
One device combines firewall, antivirus, anti-malware, and intrusion functions. What module term fits?
Unified Threat Management (UTM).
A system monitors multiple industrial control systems. ICS or SCADA?
SCADA. The module describes SCADA as monitoring two or more ICSs.
7.3 • Troubleshoot from the symptom
| Symptom | Translate the clue | What to investigate |
|---|---|---|
| Wired connection drops | Physical link or interface problem | Cable/NIC damage; trace wall port → patch panel → switch; look for port flapping (continuous up/down transitions). |
| Network is slower than expected | A bottleneck exists somewhere in the path | Port configuration, NIC/switch-port limitations, cabling limitations, interference, malware. |
| Wi-Fi is intermittent | Wireless configuration or signal problem | Configuration, band selection, standard mismatch, signal strength, RSSI, Wi-Fi analyzer. |
| VoIP audio is delayed/choppy | Real-time traffic is sensitive to timing | Latency = delay; jitter = variation in delay; QoS can prioritize traffic. |
| Only part of the network works | Define the scope before changing things | Cables/configuration and VLAN configuration; determine which users/devices/segments are affected. |
A switch port repeatedly changes between up and down. What term does the module use?
Port flapping.
Voice calls arrive with inconsistent delay from packet to packet. Latency or jitter?
Jitter is variation in delay over time. Latency is the delay itself.
Interactive service challenge
Choose the service that best matches: “Synchronize device clocks.”
Before moving on, explain these without looking
- SMTP vs. POP3/IMAP
- SSH vs. RDP
- SNMP vs. Syslog
- ICS vs. SCADA
- Latency vs. jitter
Network Services Troubleshooting Challenge Lab
Work from the symptom. Choose the service, protocol, port, appliance, or troubleshooting direction that best matches the evidence from Module 7.
Challenge 1
A user can open websites, but secure command-line administration of a server is needed. Which service fits?
Challenge 2
Users can send mail, but they cannot synchronize messages stored in their mailbox. Which service family should you investigate?
Challenge 3
A network administrator needs to collect device status information. Which service is the strongest clue?
Challenge 4
Several devices show incorrect time and authentication-related activity is becoming unreliable. Which network service should be checked first?
Challenge 5
A technician needs centralized authentication, authorization, and accounting. Which concept is being described?
Challenge 6
Voice calls become choppy when the network is busy. Which feature should be considered because it can prioritize traffic?
Challenge 7
A technician sees a very weak wireless signal before troubleshooting anything else. Which measurement clue belongs to wireless signal strength?
Challenge 8
A web service needs encrypted browser communication. Which pairing fits?
Rapid retrieval checks
Say your answer first, then open the explanation.
Why is “JOB → PROTOCOL → PORT” more useful than memorizing port numbers alone?
Because the job tells you what the service is supposed to accomplish; the protocol and port then become troubleshooting clues rather than isolated numbers.
What is the difference between SMTP and IMAP/POP3?
SMTP is associated with sending mail; IMAP/POP3 are associated with retrieving or synchronizing mailbox messages.
What does a Syslog clue suggest?
Event/log collection or monitoring. The module associates Syslog with port 514.
What should “LDAP” make you think about?
Directory services and identity information; the module lists LDAP 389 and LDAPS 636.
Why might a proxy or UTM appear in a troubleshooting scenario?
They are network appliances that can sit in the traffic path and apply intermediary/security functions, so they can affect access even when the endpoint itself is working.
What is the first reasoning question when a network service fails?
Ask what job is failing, then identify the service/protocol involved before jumping to replacement or unrelated settings.