Network diagnostics for a dedicated server

Last update: September 11 2026Open in Markdown

If you encounter network problems, run diagnostics. After diagnostics, you will be able to resolve some common issues on your own.

If you cannot resolve the issue, create a ticket. In the ticket, describe the issue and attach the diagnostic results. The diagnostic method depends on the problem you encountered.

Network issues and diagnostic methods

No internet access	check the status of network interfaces; check routing settings; restart network services; check access from the OS in recovery and diagnostic mode
Server is unreachable over the network	scan ports; check filtering rules; check routing settings; check host network availability and measure latency; check access from the OS in recovery and diagnostic mode
Server is unreachable from a specific external network	trace the route; check routing settings; restart network services; scan ports; capture a network traffic dump
Server is unreachable via SSH, HTTP/HTTPS, VPN, RDP, while the server responds to ICMP requests and checks using the mtr, telnet utilities are successful	perform diagnostics of TSPU impact
Short-term connection loss	trace the route; capture a network traffic dump; check access from the OS in recovery and diagnostic mode
Low speed	trace the route; measure data transfer speed
High network latency	check host network availability and measure latency; trace the route; check access from the OS in recovery and diagnostic mode
Packet loss	Trace the route

Trace the route

Trace the route if you encounter:

• low connection speed;
• high network latency;
• connection drops;
• packet loss during data transfer;
• server unreachability from a specific external network.

Route tracing must be performed in both directions — from the dedicated server to a point outside the Selectel infrastructure and back. To do this, you will need an external server — any server with a public IP address and internet access that is located outside the Selectel infrastructure.

We recommend running route tracing using the mtr utility (WinMTR for Windows). The utility allows you to track the full path and transit time of traffic and find out at what stage of the route delays or packet loss occur.

1. Trace the route from the dedicated server to the external server.
2. Trace the route from the external server to the dedicated server.

1. Trace the route from the dedicated server to the external server

Linux

1. Connect to the server via SSH or via KVM console.

2. Install the mtr utility on the dedicated server. Learn more on GitHub mtr.

3. Optional: prepare the dedicated server for route tracing — disable tools and applications that may affect the tracing result:

   • OS firewall rules;
   • application layer (L7) applications — web servers, mail servers, file servers, name servers, peer-to-peer network clients and servers, etc.

4. Trace the route to the external server address:

   mtr -b <remote_ip_address>

   Specify <remote_ip_address> — IP address of the external server.

5. Wait for the utility to trace the route and output routing and latency information.

6. Stop tracing:

   q

Windows

1. Connect to the server via RDP or via KVM console.

2. Install the WinMTR utility on the dedicated server. Learn more on the winMTR website.

3. Optional: prepare the dedicated server for route tracing — disable tools and applications that may affect the tracing result:

   • OS firewall rules;
   • application layer (L7) applications — web servers, mail servers, file servers, name servers, peer-to-peer network clients and servers, etc.

4. Run WinMTR.

5. In the Host field, enter the IP address of the external server.

6. Click Start.

7. Wait for the utility to trace the route and output routing and latency information.

8. To stop tracing, click Stop.

macOS

1. Connect to the server via VNC or via KVM console.

2. Install the mtr utility on the dedicated server. Learn more on GitHub mtr.

3. Optional: prepare the dedicated server for route tracing — disable tools and applications that may affect the tracing result:

   • OS firewall rules;
   • application layer (L7) applications — web servers, mail servers, file servers, name servers, peer-to-peer network clients and servers, etc.

4. Trace the route to the external server address:

   mtr -b <remote_ip_address>

   Specify <remote_ip_address> — IP address of the external server.

5. Wait for the utility to trace the route and output routing and latency information.

6. Stop tracing:

   q

2. Trace the route from the external server to the dedicated server

1. Install a utility on the external server depending on the OS used:

   • for Linux — mtr, learn more on GitHub mtr;
   • for Windows — WinMTR.

2. Optional: prepare the external server for route tracing — disable tools and applications that may affect the tracing result:

   • OS firewall rules;
   • application layer (L7) applications — web servers, mail servers, file servers, name servers, peer-to-peer network clients and servers, etc.

3. Trace the route to the dedicated server address. You can view the dedicated server IP address in the control panel: in the top menu, click Products → Dedicated Servers → Servers → server page → Operating System tab → IP.

Measure data transfer speed

If you encounter low data transfer speed issues, measure the connection speed.

Measure data transfer speed in two directions — from the dedicated server to a point outside the Selectel infrastructure and back. To do this, you will need an external server — any server with a public IP address and internet access that is located outside the Selectel infrastructure.

To measure speed, we recommend using the iperf3 utility.

1. Prepare the dedicated server for speed measurement.
2. Measure data transfer speed.

1. Prepare the dedicated server for speed measurement

1. Boot the server into recovery and diagnostic mode to eliminate the influence of OS processes on diagnostic results.

2. Connect to the server via SSH or via KVM console.

3. Install the iperf3 utility on the dedicated server, learn more in the iPerf documentation.

4. Launch the iperf3 utility. The utility must run until measuring the data transfer speed is complete.

   iperf3 -s

2. Measure data transfer speed

1. Open the CLI on the external server.

2. Install the iperf3 utility on the external server, learn more in the iPerf documentation.

3. Measure the speed from the external server to the dedicated server. The command will perform the test in 20 threads to maximize the load on the communication channel.

   iperf3 -c <ip_address> -P20 -t60 -i10

   Specify <ip_address> — public IP address of the dedicated server. You can view it in the control panel: in the top menu, click Products → Dedicated Servers → Servers → server page → Operating System tab → IP.

4. Measure the speed in the reverse direction — add the -R flag to the command:

   iperf3 -c <ip_address> -P20 -t60 -i10 -R

   Specify <ip_address> — public IP address of the dedicated server. You can view it in the control panel: in the top menu, click Products → Dedicated Servers → Servers → server page → Operating System tab → IP.

Check the status of network interfaces

Check the status of network interfaces if there is no internet access on the server.

Linux

1. Connect to the server via SSH or via KVM console.

2. Check the status of network interfaces:

   ip a

   The response will contain information about network interfaces. For example:

   1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default 
       link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
       inet 127.0.0.1/8 scope host lo
         valid_lft forever preferred_lft forever
       inet6 ::1/128 scope host 
         valid_lft forever preferred_lft forever
   
   2: enp0s1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 1c:1b:0d:12:34:56 brd ff:ff:ff:ff:ff:ff
       inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic enp0s1
         valid_lft 604675sec preferred_lft 604675sec
       inet6 fe80::1234:abcd:5678:9ef0/64 scope link 
         valid_lft forever preferred_lft forever
   
   3: enp0s2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 1c:1b:0d:65:43:21 brd ff:ff:ff:ff:ff:ff
       inet 203.0.113.10/24 brd 203.0.113.255 scope global dynamic enp0s2
         valid_lft 604675sec preferred_lft 604675sec
       inet6 fe80::abcd:1234:5678:9ef0/64 scope link 
         valid_lft forever preferred_lft forever

   Where:

   • enp0s1 — network interface name on the local port;
   • enp0s2 — network interface name on the internet port;
   • UP — network interface status.

3. If the network interface is in the DOWN status, enable it. Learn more in the IP Command Set guide of the iproute2 documentation — this is a utility package that includes the ip utility.

   ip link set dev <eth_name> up

   Specify <eth_name> — network interface name you obtained in step 2.

Windows

1. Connect to the server via RDP or via KVM console.

2. Run PowerShell as administrator.

3. Check the status of network interfaces:

   Get-NetAdapter

   The response will contain information about network interfaces. For example:

   Name          InterfaceDescription            ifIndex Status       MacAddress             LinkSpeed
   ----          --------------------            ------- ------       ----------             ---------
   Ethernet      Intel(R) Ethernet Connection         12 Up           00-1A-2B-3C-4D-5E       1 Gbps

   Where:

   • Ethernet — network interface name on the internet port;
   • Up — network interface status.

4. If the network interface is in the Disabled status, enable it:

   Enable-NetAdapter -Name "<eth_name>" -Confirm:$false

   Specify <eth_name> — network interface name you obtained in step 3.

macOS

1. Connect to the server via VNC or via KVM console.

2. Check the status of network interfaces:

   ifconfig

   The response will contain information about network interfaces. For example:

   lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
       inet 127.0.0.1 netmask 0xff000000
       inet6 ::1 prefixlen 128 
       inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
       nd6 options=201<PERFORMNUD,DAD>
       
   en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
       ether a4:5e:60:12:34:56 
       inet 203.0.113.10 netmask 0xffffff00 broadcast 203.0.113.255
       inet6 fe80::a65e:60ff:fe12:3456%en0 prefixlen 64 secured scopeid 0x4 
       inet6 2001:db8::1234:abcd prefixlen 64 autoconf secured
       nd6 options=201<PERFORMNUD,DAD>
       media: autoselect
       status: active

   Where:

   • en0 — network interface name on the internet port;
   • UP and active — network interface status, interface en0 is up and running.

3. If the network interface is in the inactive status, enable it:

   sudo ifconfig <eth_name> up

   Specify <eth_name> — network interface name you obtained in step 2.

Check routing settings

Check routing settings if:

• there is no internet access on the server;
• the server is unreachable over the network;
• the server is unreachable from a specific external network.

Linux

1. Connect to the server via SSH or via KVM console.

2. Check routing settings:

   ip r

   The response will contain a routing table. For example:

   default via 203.0.113.1 dev enp0s2 proto dhcp metric 100
   203.0.113.0/24 dev enp0s2 proto kernel scope link src 203.0.113.10 metric 100
   192.168.1.0/24 dev enp0s1 proto kernel scope link src 192.168.1.100 metric 100

   Where:

   • default via 203.0.113.1 dev enp0s2 — default route, internet traffic goes via gateway 203.0.113.1 on interface enp0s2;

   • 203.0.113.0/24 dev enp0s2 — route to public subnet 203.0.113.0/24, traffic to this subnet goes on interface enp0s2;

   • 192.168.1.0/24 dev enp0s1 — route to private subnet 192.168.1.0/24, traffic to this subnet goes on interface enp0s1.

Windows

1. Connect to the server via RDP or via KVM console.

2. Run PowerShell as administrator.

3. Check routing settings:

   Get-NetRoute | Select-Object DestinationPrefix, NextHop, RouteMetric, @{Name="Interface";Expression={(Get-NetIPInterface -InterfaceIndex $_.InterfaceIndex).InterfaceAlias}}

   The response will contain a routing table. For example:

   DestinationPrefix NextHop       RouteMetric Interface
   ----------------- -------       ----------- ---------
   0.0.0.0/0         203.0.113.1   25          Ethernet
   203.0.113.0/24    0.0.0.0       25          Ethernet
   192.168.1.0/24    0.0.0.0       10          Internal

   Where:

   • 0.0.0.0/0 with NextHop 203.0.113.1 — default route, internet traffic goes via gateway 203.0.113.1 on interface Ethernet;

   • 203.0.113.0/24 with NextHop 0.0.0.0 — route to public subnet 203.0.113.0/24, traffic to this subnet goes on interface Ethernet;

   • 192.168.1.0/24 with NextHop 0.0.0.0 — route to private subnet 192.168.1.0/24, traffic to this subnet goes on interface Internal.

macOS

1. Connect to the server via VNC or via KVM console.

2. Check routing settings:

   netstat -rn

   The response will contain a routing table. For example:

   Internet:
   Destination        Gateway            Flags        Refs      Use   Netif Expire
   default            203.0.113.1        UGSc           10        0     en0
   127                127.0.0.1          UCS             0        0     lo0
   203.0.113.0/24     link#4             UCS             2        0     en0

   Where:

   • default 203.0.113.1 — default route, internet traffic goes via gateway 203.0.113.1 on interface en0;

   • 203.0.113.0/24 link#4 — route to public subnet 203.0.113.0/24, traffic to this subnet goes on interface en0.

Capture a network traffic dump

If the server is unreachable from a specific external network or you observe short-term connection losses, capture a network traffic dump.

A network traffic dump is the process of recording and saving network traffic that passes through a network or device. The dump contains information about network protocols, transmitted packets, their content, sources, and destinations of data.

Linux

1. Connect to the server via SSH or via KVM console.

2. Install tcpdump — a utility for capturing and analyzing network traffic. Learn more in the tcpdump documentation.

   apt update
   apt install -y tcpdump

3. Find the name of the network interface for which you need to capture a dump by listing the network interfaces:

   ip a

   The response will contain information about network interfaces. For example:

   1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default 
       link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
       inet 127.0.0.1/8 scope host lo
         valid_lft forever preferred_lft forever
       inet6 ::1/128 scope host 
         valid_lft forever preferred_lft forever
   
   2: enp0s1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 1c:1b:0d:12:34:56 brd ff:ff:ff:ff:ff:ff
       inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic enp0s31f6
         valid_lft 604675sec preferred_lft 604675sec
       inet6 fe80::1234:abcd:5678:9ef0/64 scope link 
         valid_lft forever preferred_lft forever
   
   3: enp0s2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 1c:1b:0d:65:43:21 brd ff:ff:ff:ff:ff:ff
       inet 203.0.113.10/24 brd 203.0.113.255 scope global dynamic enp0s2
         valid_lft 604675sec preferred_lft 604675sec
       inet6 fe80::abcd:1234:5678:9ef0/64 scope link 
         valid_lft forever preferred_lft forever

   Where enp0s2 is the network interface name on the internet port.

4. Run tcpdump:

   sudo tcpdump -i <eth_name> -w <file_name>

   Specify:

   • <eth_name> — network interface name you obtained in step 3;
   • <file_name> — name of the file to save the network traffic capture to, for example dump.pcap.

5. Wait until the required amount of data is collected.

6. To stop recording, press Ctrl + C.

Windows

1. Connect to the server via RDP or via KVM console.

2. Install Wireshark — a utility for capturing and analyzing network traffic, learn more in the Wireshark documentation.

3. Run Wireshark as administrator.

4. To start capturing network traffic, click the desired network interface.

5. Wait until the required amount of data is collected.

6. Stop recording.

7. Save the recording to a file.

macOS

1. Connect to the server via VNC or via KVM console.

2. Install tcpdump — a utility for capturing and analyzing network traffic. Learn more in the tcpdump documentation.

3. Find the name of the network interface for which you need to capture a dump by listing the network interfaces:

   networksetup -listnetworkserviceorder

   The response will contain information about network interfaces. For example:

   An asterisk (*) denotes that a network service is disabled.
   
   (1) Ethernet (Hardware Port: Ethernet, Device: en0)

   Where en0 is the network interface name on the internet port.

4. Run tcpdump:

   sudo tcpdump -i <eth_name> -w <file_name>

   Specify:

   • <eth_name> — network interface name you obtained in step 3;
   • <file_name> — name of the file to save the network traffic capture to, for example dump.pcap.

5. Wait until the required amount of data is collected.

6. To stop recording, press Ctrl + C.

Restart network services

Restart network services if on the server:

• there is no internet access;
• or the server is unreachable from a specific external network.

Linux

1. Connect to the server via SSH or via KVM console.

2. Restart network services:

   systemctl restart networking

Windows

1. Connect to the server via RDP or via KVM console.

2. Run PowerShell as administrator.

3. Find the name of the network interface on which you need to restart network services by listing the network interfaces:

   Get-NetAdapter

   The response will contain a list of network interfaces. For example:

   Name          InterfaceDescription            ifIndex Status       MacAddress             LinkSpeed
   ----          --------------------            ------- ------       ----------             ---------
   Ethernet      Intel(R) Ethernet Connection         12 Up           00-1A-2B-3C-4D-5E       1 Gbps

   Where Ethernet is the network interface name on the internet port.

4. Restart network services:

   Disable-NetAdapter -Name <eth_name>
   Enable-NetAdapter -Name <eth_name>

   Specify <eth_name> — network interface name you obtained in step 3.

macOS

1. Connect to the server via VNC or via KVM console.

2. Find the name of the network interface on which you need to restart network services by listing the network interfaces:

   networksetup -listnetworkserviceorder

   The response will contain a list of network interfaces. For example:

   An asterisk (*) denotes that a network service is disabled.
   
   (1) Ethernet (Hardware Port: Ethernet, Device: en0)

   Where en0 is the network interface name on the internet port.

3. Restart network services:

   sudo networksetup -setnetworkserviceenabled <eth_name> off
   sudo networksetup -setnetworkserviceenabled <eth_name> on

   Specify <eth_name> — network interface name you obtained in step 2.

Check filtering rules

If the server is unreachable over the network, check the firewall filtering rules in the server OS.

Linux

1. Connect to the server via SSH or via KVM console.

2. View the list of firewall rules:

   iptables -L -n -v

   The response will contain a list of rules. For example:

   Chain INPUT (policy DROP 1234 packets, 98765 bytes)
   pkts bytes target     prot opt in     out     source               destination
   2045  187K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
   1087  159K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0      ctstate RELATED,ESTABLISHED
    120  8400 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0      tcp dpt:22
      0     0 DROP       all  --  *      *       192.168.1.100        0.0.0.0/0
   
   Chain FORWARD (policy DROP 0 packets, 0 bytes)
   pkts bytes target     prot opt in     out     source               destination
   
   Chain OUTPUT (policy ACCEPT 3456 packets, 456789 bytes)
   pkts bytes target     prot opt in     out     source               destination

   Where:

   • Chain — list of rules for packets of a specific direction:

     • INPUT — for incoming packets;
     • FORWARD — for forwarded packets;
     • OUTPUT — for outgoing packets;

   • policy — rule action, for example ACCEPT or DROP.

Windows

1. Connect to the server via RDP or via KVM console.

2. Run PowerShell as administrator.

3. View the list of firewall rules:

   Get-NetFirewallRule | Format-Table Name, Enabled, Action, DisplayName

   The response will contain a list of rules. For example:

   DisplayName : File and Printer Sharing (SMB-In)
   Name        : FPS-SMB-In-TCP
   Enabled     : True
   Direction   : Inbound
   Action      : Allow
   
   DisplayName : Remote Desktop - User Mode (TCP-In)
   Name        : RDP-TCP-In
   Enabled     : True
   Direction   : Inbound
   Action      : Allow
   
   DisplayName : Core Networking - DNS (UDP-Out)
   Name        : CoreNet-DNS-Out
   Enabled     : True
   Direction   : Outbound
   Action      : Allow
   
   DisplayName : Windows Remote Management (HTTP-In)
   Name        : WINRM-HTTP-In
   Enabled     : False
   Direction   : Inbound
   Action      : Allow
   
   DisplayName : Block Internet Access (Test Rule)
   Name        : Block-Internet-Test
   Enabled     : True
   Direction   : Outbound
   Action      : Block

   Where Action is the rule action, for example Allow or Block. Learn more in the Windows Firewall guide of the Microsoft documentation.

macOS

1. Connect to the server via VNC or via KVM console.

2. View the list of firewall rules:

   sudo pfctl -sr

   The response will contain a list of rules. For example:

   scrub in all fragment reassemble 
   block return all 
   pass out proto tcp from any to any port = ssh flags S/SA keep state 
   pass out proto tcp from any to any port = http flags S/SA keep state 
   pass out proto tcp from any to any port = https flags S/SA keep state 
   pass out proto udp from any to any port = domain keep state 
   pass out proto udp from any to any port = ntp keep state 
   pass out inet proto icmp all keep state 
   pass in proto tcp from any to any port = ssh flags S/SA keep state 
   pass in proto tcp from any to any port = http flags S/SA keep state 
   pass in proto tcp from any to any port = https flags S/SA keep state 

   Where block and pass are rule actions, learn more in the Packet filtering guide of the OpenBSD documentation.

Scan ports

If the server is unreachable over the network or unreachable from a specific external network, scan ports. Ports can be scanned using the nmap utility.

Linux

1. Connect to the server via SSH or via KVM console.

2. Install nmap, learn more in the Linux Distributions article of the nmap documentation.

3. Scan ports:

   nmap -p <port> <ip_address>

   Specify:

   • optional: <port> — comma-separated ports, for example 22,80,443, or a port range, for example 20-30;
   • <ip_address> — IP address of the dedicated server. You can view the dedicated server IP address in the control panel under Servers and Hardware → Servers → server card → IP address.

Windows

1. Connect to the server via RDP or via KVM console.

2. Install nmap, learn more in the Windows article of the nmap documentation.

3. Run PowerShell as administrator.

4. Scan ports:

   nmap -p <port> <ip_address>

   Specify:

   • optional: <port> — comma-separated ports, for example 22,80,443, or a port range, for example 20-30;
   • <ip_address> — IP address of the dedicated server. You can view the dedicated server IP address in the control panel under Servers and Hardware → Servers → server card → IP address.

macOS

1. Connect to the server via VNC or via KVM console.

2. Install nmap, learn more in the Apple Mac OS X article of the nmap documentation.

3. Scan ports:

   nmap -p <port> <ip_address>

   Specify:

   • optional: <port> — comma-separated ports, for example 22,80,443, or a port range, for example 20-30;
   • <ip_address> — IP address of the dedicated server. You can view the dedicated server IP address in the control panel under Servers and Hardware → Servers → server card → IP address.

Check host network availability and measure latency

If the server is unreachable over the network, experiencing high network latency or packet loss, check server availability and measure latency using the ping utility. The ping utility is part of the standard networking toolset and is pre-installed on most operating systems.

You can perform the check to the server's public or private IP address, or to the domain name linked to the server's IP address.

To perform the check, you will need a second server from which you will run the check. If the check is to a private IP address, the servers must be connected via a private network.

1. Open the CLI on the server from which you will perform the check.

2. Run the check:

   ping <ip_address>

   Specify <ip_address> — IP address or domain name of the server. You can view the dedicated server IP address in the control panel: in the top menu, click Products → Dedicated Servers → Servers → server page → Operating System tab → IP.

Check access from the OS in recovery and diagnostic mode

To prevent OS settings from affecting server operation and diagnostics:

1. Boot the server into recovery and diagnostic mode.

2. Connect to the server via SSH or via KVM console:

   • if the server responds and you can connect, the problem is with the software on the server. Reboot the server to restart network services. If the problem is software-related, it will be resolved when reverting to the previous OS boot template;
   • if the server is unreachable in recovery and diagnostic mode, create a ticket describing the issue.