--- title: "Network diagnostics for a dedicated server" sidebar_label: "Network diagnostics for a dedicated server" description: "Methods for diagnosing common network issues" sidebar_position: 4 toc_max_heading_level: 2 --- import Tabs from '@theme/Tabs' import TabItem from '@theme/TabItem' import {TabItemLabel} from 'docs-kit/components' import {CustomTable} from 'docs-kit/components' import Formbricks from '@theme/MDXComponents/Formbricks' # Network diagnostics for a dedicated server If you encounter network problems, perform diagnostics. After diagnostics, you will be able to resolve some common issues on your own. If the problem persists, [create a ticket](https://my.selectel.ru/tickets/create). In the ticket, describe the problem and attach the diagnostic results. [The diagnostic method](#network-problems-and-diagnostic-methods) depends on the problem you have encountered. ## Network issues and diagnostic methods \{#network-problems-and-diagnostic-methods}
No internet access * [check the status of network interfaces](#check-status-of-network-interfaces); * [check routing settings](#check-routing-settings); * [restart network services](#restart-network-services); * [check access from the OS in recovery and diagnostic mode](#check-access-in-recovery-mode)
Server is unreachable over the network * [scan ports](#scans-of-ports); * [check filtering rules](#check-filter-rules); * [check routing settings](#check-routing-settings); * [check host network availability and measure latency](#ping-to-measure-latency); * [check access from the OS in recovery and diagnostic mode](#check-access-in-recovery-mode)
Server is unreachable from a specific external network * [perform a route trace](#tracing); * [check routing settings](#check-routing-settings); * [restart network services](#restart-network-services); * [scan ports](#scans-of-ports); * [collect a network traffic dump](#capture-network-traffic)
Server is unreachable via SSH, HTTP/HTTPS, VPN, or RDP, but the server responds to ICMP requests and checks using `mtr`, `telnet` are successful * perform [TSPU influence diagnostics](/dedicated/troubleshooting/tspu.mdx)
Short-term connection loss * [perform a route trace](#tracing); * [collect a network traffic dump](#capture-network-traffic); * [check access from the OS in recovery and diagnostic mode](#check-access-in-recovery-mode)
Low speed * [perform a route trace](#tracing); * [measure data transfer speed](#change-connection-speed)
High network latency * [check host network availability and measure latency](#ping-to-measure-latency); * [perform a route trace](#tracing); * [check access from the OS in recovery and diagnostic mode](#check-access-in-recovery-mode)
Packet loss[Perform a route trace](#tracing)
## Perform a route trace \{#tracing} Perform a route trace if you encounter: * low connection speed; * high network latency; * connection losses; * packet loss during data transmission; * server unavailability from a specific external network. Traceroute must be performed in two directions—from the dedicated server to a point outside the Selectel infrastructure and back. For this, you will need an external server—any server with a public IP address and internet access that is located outside the Selectel infrastructure. We recommend performing a traceroute using the `mtr` (`WinMTR` for Windows) utility. The utility allows you to track the full path and traffic latency, and find out at which stage of the route delays or packet loss occur. 1. [Run a trace from the dedicated server to an external server](#trace-to-remote-server). 2. [Run a trace from an external server to the dedicated server](#trace-to-dedicated-server). ### 1. Run a trace from the dedicated server to an external server \{#trace-to-remote-server} Linux 1. [Connect to the server via SSH](/dedicated/manage/connect-to-server.mdx#connect-via-ssh) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Install the `mtr` utility on the dedicated server. Learn more on [GitHub mtr](https://github.com/traviscross/mtr). 3. Optional: prepare the dedicated server for tracing — turn off utilities and applications that might affect the trace result: * OS firewall rules; * application-layer (L7, application layer) applications — web servers, mail servers, file servers, name servers, peer-to-peer network clients and servers, etc. 4. Run a trace to the external server address: ``` mtr -b ``` Specify `` — the IP address of the external server. 5. Wait for the utility to complete the trace and display information about the route and latency. 6. Stop the trace: ```bash q ``` Windows 1. [Connect to the server via RDP](/dedicated/manage/connect-to-server.mdx#connect-via-rdp) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Install the `WinMTR` utility on the dedicated server. Learn more on the [winMTR](https://winmtr.net/) website. 3. Optional: prepare the dedicated server for tracing — turn off utilities and applications that might affect the trace result: * OS firewall rules; * application-layer (L7, application layer) applications — web servers, mail servers, file servers, name servers, peer-to-peer network clients and servers, etc. 4. Launch `WinMTR`. 5. In the **Host** field, enter the IP address of the external server. 6. Click **Start**. 7. Wait for the utility to complete the trace and display information about the route and latency. 8. Stop the trace by clicking **Stop**. macOS 1. [Connect to the server via VNC](/dedicated/manage/connect-to-server.mdx#connect-via-vnc) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Install the `mtr` utility on the dedicated server. Learn more on [GitHub mtr](https://github.com/traviscross/mtr). 3. Optional: prepare the dedicated server for tracing — turn off utilities and applications that might affect the trace result: * OS firewall rules; * application-layer (L7, application layer) applications — web servers, mail servers, file servers, name servers, peer-to-peer network clients and servers, etc. 4. Run a trace to the external server address: ``` mtr -b ``` Specify `` — the IP address of the external server. 5. Wait for the utility to complete the trace and display information about the route and latency. 6. Stop the trace: ```bash q ``` ### 2. Run a trace from an external server to the dedicated server \{#trace-to-dedicated-server} 1. Install the utility on the external server depending on the OS used: * for Linux — `mtr`, more details on [GitHub mtr](https://github.com/traviscross/mtr?tab=readme-ov-file#installing); * for Windows — `WinMTR`. 2. Optional: prepare the external server for tracing — turn off utilities and applications that might affect the trace result: * OS firewall rules; * application-layer (L7) applications — web servers, mail servers, file servers, name servers, peer-to-peer network clients and servers, etc. 3. Run a traceroute to the dedicated server's IP address. You can find the dedicated server's IP address in the [control panel](https://my.selectel.ru/servers): in the top menu, click **Products** → **Dedicated Servers** → **Servers** → server page → tab **Operating System** → field **IP**. ## Measure data transfer speed \{#change-connection-speed} If you encounter issues with low data transfer speed, measure the connection speed. Measure data transfer speed in two directions—from the dedicated server to a point outside the Selectel infrastructure and back. For this, you will need an external server—any server with a public IP address and internet access that is located outside the Selectel infrastructure. We recommend using the `iperf3` utility to measure speed. 1. [Prepare the dedicated server for speed measurement](#prepare-dedicated-server-for-speed-measurement). 2. [Measure the data transfer speed](#change-connection-speed). ### 1. Prepare the dedicated server for speed measurement \{#prepare-dedicated-server-for-speed-measurement} 1. [Boot the server into recovery and diagnostic mode](/dedicated/troubleshooting/boot-to-recovery.mdx) to exclude the influence of OS processes on diagnostic results. 2. [Connect to the server via SSH](/dedicated/manage/connect-to-server.mdx#connect-via-ssh) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 3. Install the `iperf3` utility on the dedicated server, see the [iPerf](https://iperf.fr/iperf-download.php) documentation for more details. 4. Run the `iperf3` utility. The utility must run until [data transfer speed measurement is complete](#change-connection-speed). ``` iperf3 -s ``` ### 2. Measure data transfer speed \{#change-connection-speed} 1. Open the CLI on the external server. 2. Install the `iperf3` utility on the external server, see the [iPerf](https://iperf.fr/iperf-download.php) documentation for more details. 3. Measure the speed from the external server to the dedicated server. The command will perform a measurement with 20 parallel streams to maximize the link load. ``` iperf3 -c -P20 -t60 -i10 ``` Specify `` — the public IP address of the dedicated server. You can view it in the [control panel](https://my.selectel.ru/servers): in the top menu, click **Products** → **Dedicated Servers** → **Servers** → server page → tab **Operating System** → field **IP**. 4. Perform a measurement in the reverse direction — add the `-R` key to the command: ``` iperf3 -c -P20 -t60 -i10 -R ``` Specify `` — the public IP address of the dedicated server. You can view it in the [control panel](https://my.selectel.ru/servers): in the top menu, click **Products** → **Dedicated Servers** → **Servers** → server page → tab **Operating System** → field **IP**. ## Check the status of network interfaces \{#check-status-of-network-interfaces} Check the status of network interfaces if the server has no internet access. Linux 1. [Connect to the server via SSH](/dedicated/manage/connect-to-server.mdx#connect-via-ssh) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Check the status of the network interfaces: ```bash ip a ``` Information about the network interfaces will appear in the response. For example: ```bash 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: enp0s1: mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 1c:1b:0d:12:34:56 brd ff:ff:ff:ff:ff:ff inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic enp0s1 valid_lft 604675sec preferred_lft 604675sec inet6 fe80::1234:abcd:5678:9ef0/64 scope link valid_lft forever preferred_lft forever 3: enp0s2: mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 1c:1b:0d:65:43:21 brd ff:ff:ff:ff:ff:ff inet 203.0.113.10/24 brd 203.0.113.255 scope global dynamic enp0s2 valid_lft 604675sec preferred_lft 604675sec inet6 fe80::abcd:1234:5678:9ef0/64 scope link valid_lft forever preferred_lft forever ``` Where: * `enp0s1` — the name of the network interface on the local port; * `enp0s2` — the name of the network interface on the internet port; * `UP` — the status of the network interface. 3. If the network interface is in the `DOWN` status, enable it. Learn more in the [IP Command Set](http://www.policyrouting.org/iproute2.doc.html) instruction in the iproute2 documentation—this is a package of utilities that includes the `ip` utility. ``` ip link set dev up ``` Specify `` — the name of the network interface you obtained in step 2. Windows 1. [Connect to the server via RDP](/dedicated/manage/connect-to-server.mdx#connect-via-rdp) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Launch PowerShell as administrator. 3. Check the status of the network interfaces: ```bash Get-NetAdapter ``` Information about the network interfaces will appear in the response. For example: ```bash Name InterfaceDescription ifIndex Status MacAddress LinkSpeed ---- -------------------- ------- ------ ---------- --------- Ethernet Intel(R) Ethernet Connection 12 Up 00-1A-2B-3C-4D-5E 1 Gbps ``` Where: * `Ethernet` — the name of the network interface on the internet port; * `Up` — the status of the network interface. 4. If the network interface is in the `Disabled` status, enable it: ``` Enable-NetAdapter -Name "" -Confirm:$false ``` Specify `` — the name of the network interface you obtained in step 3. macOS 1. [Connect to the server via VNC](/dedicated/manage/connect-to-server.mdx#connect-via-vnc) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Check the status of the network interfaces: ``` ifconfig ``` Information about the network interfaces will appear in the response. For example: ```bash lo0: flags=8049 mtu 16384 inet 127.0.0.1 netmask 0xff000000 inet6 ::1 prefixlen 128 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 nd6 options=201 en0: flags=8863 mtu 1500 ether a4:5e:60:12:34:56 inet 203.0.113.10 netmask 0xffffff00 broadcast 203.0.113.255 inet6 fe80::a65e:60ff:fe12:3456%en0 prefixlen 64 secured scopeid 0x4 inet6 2001:db8::1234:abcd prefixlen 64 autoconf secured nd6 options=201 media: autoselect status: active ``` Where: * `en0` — the name of the network interface on the internet port; * `UP` and `active` — the status of the network interface; the `en0` interface is up and running. 3. If the network interface is in the `inactive` status, enable it: ``` sudo ifconfig up ``` Specify `` — the name of the network interface you obtained in step 2. ## Check routing settings \{#check-routing-settings} Check routing settings if: * there is no internet access on the server; * the server is unreachable over the network; * the server is unreachable from a specific external network. Linux 1. [Connect to the server via SSH](/dedicated/manage/connect-to-server.mdx#connect-via-ssh) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Check routing settings: ``` ip r ``` A route table will appear in the response. For example: ```bash default via 203.0.113.1 dev enp0s2 proto dhcp metric 100 203.0.113.0/24 dev enp0s2 proto kernel scope link src 203.0.113.10 metric 100 192.168.1.0/24 dev enp0s1 proto kernel scope link src 192.168.1.100 metric 100 ``` Where: * `default via 203.0.113.1 dev enp0s2` — the default route, internet traffic goes through gateway `203.0.113.1` via the `enp0s2` interface; * `203.0.113.0/24 dev enp0s2` — the route to the public subnet `203.0.113.0/24`, traffic to this subnet goes via the `enp0s2` interface; * `192.168.1.0/24 dev enp0s1` — the route to the private subnet `192.168.1.0/24`, traffic to this subnet goes via the `enp0s1` interface. Windows 1. [Connect to the server via RDP](/dedicated/manage/connect-to-server.mdx#connect-via-rdp) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Launch PowerShell as administrator. 3. Check routing settings: ```bash Get-NetRoute | Select-Object DestinationPrefix, NextHop, RouteMetric, @{Name="Interface";Expression={(Get-NetIPInterface -InterfaceIndex $_.InterfaceIndex).InterfaceAlias}} ``` A route table will appear in the response. For example: ```bash DestinationPrefix NextHop RouteMetric Interface ----------------- ------- ----------- --------- 0.0.0.0/0 203.0.113.1 25 Ethernet 203.0.113.0/24 0.0.0.0 25 Ethernet 192.168.1.0/24 0.0.0.0 10 Internal ``` Where: * `0.0.0.0/0` with NextHop `203.0.113.1` — the default route, internet traffic goes through gateway `203.0.113.1` via the `Ethernet` interface; * `203.0.113.0/24` with NextHop `0.0.0.0` — the route to the public subnet `203.0.113.0/24`, traffic to this subnet goes via the `Ethernet` interface; * `192.168.1.0/24` with NextHop `0.0.0.0` — the route to the private subnet `192.168.1.0/24`, traffic to this subnet goes via the `Internal` interface. macOS 1. [Connect to the server via VNC](/dedicated/manage/connect-to-server.mdx#connect-via-vnc) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Check routing settings: ``` netstat -rn ``` A route table will appear in the response. For example: ```bash Internet: Destination Gateway Flags Refs Use Netif Expire default 203.0.113.1 UGSc 10 0 en0 127 127.0.0.1 UCS 0 0 lo0 203.0.113.0/24 link#4 UCS 2 0 en0 ``` Where: * `default 203.0.113.1` — the default route, internet traffic goes through gateway `203.0.113.1` via the `en0` interface; * `203.0.113.0/24 link#4` — the route to the public subnet `203.0.113.0/24`, traffic to this subnet goes via the `en0` interface. ## Collect a network traffic dump \{#capture-network-traffic} If the server is unreachable from a specific external network or you observe short-term connection losses, collect a network traffic dump. A network traffic dump is a process of recording and saving the network traffic that passes through a network or device. The dump contains information about network protocols, transmitted packets, their content, and data sources and recipients. Linux 1. [Connect to the server via SSH](/dedicated/manage/connect-to-server.mdx#connect-via-ssh) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Install `tcpdump` —a utility for capturing and analyzing network traffic. Learn more in the [tcpdump documentation](https://www.tcpdump.org/index.html#documentation). ```bash apt update apt install -y tcpdump ``` 3. Look up the name of the network interface for which you need to record a dump; to do this, list the network interfaces: ```bash ip a ``` Information about the network interfaces will appear in the response. For example: ```bash 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: enp0s1: mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 1c:1b:0d:12:34:56 brd ff:ff:ff:ff:ff:ff inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic enp0s31f6 valid_lft 604675sec preferred_lft 604675sec inet6 fe80::1234:abcd:5678:9ef0/64 scope link valid_lft forever preferred_lft forever 3: enp0s2: mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 1c:1b:0d:65:43:21 brd ff:ff:ff:ff:ff:ff inet 203.0.113.10/24 brd 203.0.113.255 scope global dynamic enp0s2 valid_lft 604675sec preferred_lft 604675sec inet6 fe80::abcd:1234:5678:9ef0/64 scope link valid_lft forever preferred_lft forever ``` Where `enp0s2` is the name of the network interface on the internet port. 4. Launch `tcpdump`: ``` sudo tcpdump -i -w ``` Specify: * `` — the name of the network interface you obtained in step 3; * `` — the name of the file to save the network traffic capture to, for example `dump.pcap`. 5. Wait for the required amount of data to be collected. 6. Stop the recording by pressing **Ctrl + C**. Windows 1. [Connect to the server via RDP](/dedicated/manage/connect-to-server.mdx#connect-via-rdp) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Install `Wireshark` — this is a utility for capturing and analyzing network traffic, see the [Wireshark](https://www.wireshark.org/download.html) documentation for more details. 3. Launch `Wireshark` as administrator. 4. To start recording network traffic, click the required network interface. 5. Wait for the required amount of data to be collected. 6. Stop the recording. 7. Save the recording to a file. macOS 1. [Connect to the server via VNC](/dedicated/manage/connect-to-server.mdx#connect-via-vnc) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Install `tcpdump` —a utility for capturing and analyzing network traffic. Learn more in the [tcpdump documentation](https://www.tcpdump.org/index.html#documentation). 3. Look up the name of the network interface for which you need to record a dump; to do this, list the network interfaces: ```bash networksetup -listnetworkserviceorder ``` Information about the network interfaces will appear in the response. For example: ```bash An asterisk (*) denotes that a network service is disabled. (1) Ethernet (Hardware Port: Ethernet, Device: en0) ``` Where `en0` is the name of the network interface on the internet port. 4. Launch `tcpdump`: ``` sudo tcpdump -i -w ``` Specify: * `` — the name of the network interface you obtained in step 3; * `` — the name of the file to save the network traffic capture to, for example `dump.pcap`. 5. Wait for the required amount of data to be collected. 6. Stop the recording by pressing **Ctrl + C**. ## Restart network services \{#restart-network-services} Restart network services if on the server: * there is no internet access; * alternatively, if the server is unreachable from a specific external network. Linux 1. [Connect to the server via SSH](/dedicated/manage/connect-to-server.mdx#connect-via-ssh) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Restart network services: ``` systemctl restart networking ``` Windows 1. [Connect to the server via RDP](/dedicated/manage/connect-to-server.mdx#connect-via-rdp) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Launch PowerShell as administrator. 3. Look up the name of the network interface on which you need to restart network services; to do this, list the network interfaces: ```bash Get-NetAdapter ``` A list of network interfaces will appear in the response. For example: ```bash Name InterfaceDescription ifIndex Status MacAddress LinkSpeed ---- -------------------- ------- ------ ---------- --------- Ethernet Intel(R) Ethernet Connection 12 Up 00-1A-2B-3C-4D-5E 1 Gbps ``` Where `Ethernet` is the name of the network interface on the internet port. 4. Restart network services: ``` Disable-NetAdapter -Name Enable-NetAdapter -Name ``` Specify `` — the name of the network interface you obtained in step 3. macOS 1. [Connect to the server via VNC](/dedicated/manage/connect-to-server.mdx#connect-via-vnc) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Look up the name of the network interface on which you need to restart network services; to do this, list the network interfaces: ```bash networksetup -listnetworkserviceorder ``` A list of network interfaces will appear in the response. For example: ```bash An asterisk (*) denotes that a network service is disabled. (1) Ethernet (Hardware Port: Ethernet, Device: en0) ``` Where `en0` is the name of the network interface on the internet port. 3. Restart network services: ``` sudo networksetup -setnetworkserviceenabled off sudo networksetup -setnetworkserviceenabled on ``` Specify `` — the name of the network interface you obtained in step 2. ## Check filtering rules \{#check-filter-rules} If the server is unreachable over the network, check the firewall filtering rules in the server OS. Linux 1. [Connect to the server via SSH](/dedicated/manage/connect-to-server.mdx#connect-via-ssh) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. View the list of firewall rules: ``` iptables -L -n -v ``` A list of rules will appear in the response. For example: ```bash Chain INPUT (policy DROP 1234 packets, 98765 bytes) pkts bytes target prot opt in out source destination 2045 187K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 1087 159K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 120 8400 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 0 0 DROP all -- * * 192.168.1.100 0.0.0.0/0 Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 3456 packets, 456789 bytes) pkts bytes target prot opt in out source destination ``` Where: * `Chain` — a list of rules for packets of a specific direction: * `INPUT` — for incoming packets; * `FORWARD` — for forwarded packets; * `OUTPUT` — for outgoing packets; * `policy` — the action of the rule, for example `ACCEPT` or `DROP`. Windows 1. [Connect to the server via RDP](/dedicated/manage/connect-to-server.mdx#connect-via-rdp) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Launch PowerShell as administrator. 3. View the list of firewall rules: ``` Get-NetFirewallRule | Format-Table Name, Enabled, Action, DisplayName ``` A list of rules will appear in the response. For example: ```bash DisplayName : File and Printer Sharing (SMB-In) Name : FPS-SMB-In-TCP Enabled : True Direction : Inbound Action : Allow DisplayName : Remote Desktop - User Mode (TCP-In) Name : RDP-TCP-In Enabled : True Direction : Inbound Action : Allow DisplayName : Core Networking - DNS (UDP-Out) Name : CoreNet-DNS-Out Enabled : True Direction : Outbound Action : Allow DisplayName : Windows Remote Management (HTTP-In) Name : WINRM-HTTP-In Enabled : False Direction : Inbound Action : Allow DisplayName : Block Internet Access (Test Rule) Name : Block-Internet-Test Enabled : True Direction : Outbound Action : Block ``` Here, `Action` is the rule action, for example, `Allow` or `Block`. Learn more in the [Windows Firewall](https://learn.microsoft.com/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line) instruction in the Microsoft documentation. macOS 1. [Connect to the server via VNC](/dedicated/manage/connect-to-server.mdx#connect-via-vnc) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. View the list of firewall rules: ``` sudo pfctl -sr ``` A list of rules will appear in the response. For example: ```bash scrub in all fragment reassemble block return all pass out proto tcp from any to any port = ssh flags S/SA keep state pass out proto tcp from any to any port = http flags S/SA keep state pass out proto tcp from any to any port = https flags S/SA keep state pass out proto udp from any to any port = domain keep state pass out proto udp from any to any port = ntp keep state pass out inet proto icmp all keep state pass in proto tcp from any to any port = ssh flags S/SA keep state pass in proto tcp from any to any port = http flags S/SA keep state pass in proto tcp from any to any port = https flags S/SA keep state ``` Where `block` and `pass` are the actions of the rule; for more details, see the [Packet filtering](https://openbsd-ru.github.io/faq/pf/filter.html) section of the OpenBSD documentation. ## Scan ports \{#scans-of-ports} If the server is unavailable over the network or from a specific external network, scan the ports. Ports can be scanned using the `nmap` utility. Linux 1. [Connect to the server via SSH](/dedicated/manage/connect-to-server.mdx#connect-via-ssh) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Install `nmap`; for more details, see the [Linux Distributions](https://nmap.org/book/inst-linux.html) section of the nmap documentation. 3. Scan ports: ``` nmap -p ``` Specify: * optional: `` — ports separated by commas, for example `22,80,443`, or a range of ports, for example `20-30`; * `` — IP address of the dedicated server. You can view the IP address of the dedicated server in the control panel in the **Servers and Hardware** section → **Servers** → server card → field **IP address**. Windows 1. [Connect to the server via RDP](/dedicated/manage/connect-to-server.mdx#connect-via-rdp) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Install `nmap`; for more details, see the [Windows](https://nmap.org/book/inst-windows.html) section of the nmap documentation. 3. Launch PowerShell as administrator. 4. Scan ports: ``` nmap -p ``` Specify: * optional: `` — ports separated by commas, for example `22,80,443`, or a range of ports, for example `20-30`; * `` — IP address of the dedicated server. You can view the IP address of the dedicated server in the control panel in the **Servers and Hardware** section → **Servers** → server card → field **IP address**. macOS 1. [Connect to the server via VNC](/dedicated/manage/connect-to-server.mdx#connect-via-vnc) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console). 2. Install `nmap`; for more details, see the [Apple Mac OS X](https://nmap.org/book/inst-macosx.html) section of the nmap documentation. 3. Scan ports: ``` nmap -p ``` Specify: * optional: `` — ports separated by commas, for example `22,80,443`, or a range of ports, for example `20-30`; * `` — IP address of the dedicated server. You can view the IP address of the dedicated server in the control panel in the **Servers and Hardware** section → **Servers** → server card → field **IP address**. ## Check host network availability and measure latency \{#ping-to-measure-latency} If the server is unavailable over the network, or if you notice high network latency or packet loss, check the server's availability and measure latency using the `ping` utility. The `ping` utility is part of the standard set of network tools and is pre-installed in most operating systems. You can perform the check using the public or private IP address of the server, or the domain name linked to the server's IP address. To perform this check, you will need a second server from which you will conduct the test. If you are testing to a private IP address, the servers must be connected via a private network. 1. Open CLI on the server from which you will perform the check. 2. Perform the check: ```bash ping ``` Specify `` — the IP address or domain name of the server. You can view the dedicated server's IP address in the [control panel](https://my.selectel.ru/servers): in the top menu, click **Products** → **Dedicated Servers** → **Servers** → server page → tab **Operating System** → field **IP**. ## Check access from the OS in recovery and diagnostic mode \{#check-access-in-recovery-mode} To ensure OS settings do not affect server performance and diagnostics: 1. [Boot the server into recovery and diagnostic mode](/dedicated/troubleshooting/boot-to-recovery.mdx). 2. [Connect to the server via SSH](/dedicated/manage/connect-to-server.mdx#connect-via-ssh) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console): * if the server responds and you can connect to it, the problem is in the software on the server. [Reboot the server](/dedicated/manage/manage-server-power.mdx#reboot-server) to restart network services. If the issue is software-related, it will be resolved when you revert to the previous OS boot template; * if the server is unavailable in recovery and diagnostic mode, [create a ticket](https://my.selectel.ru/tickets/create/) with a description of the issue.