Network diagnostics for a dedicated server

Last update: September 22 2026Open in Markdown

If you encounter network problems, run diagnostics. After diagnostics, you will be able to resolve some common issues on your own.

If you cannot resolve the issue, create a ticket. In the ticket, describe the issue and attach the diagnostic results. The diagnostic method depends on the problem you encountered.

Network issues and diagnostic methods

No internet access	check the status of network interfaces; check routing settings; restart network services; check access from the OS in recovery and diagnostic mode
Server is unreachable over the network	scan ports; check filtering rules; check routing settings; check host network availability and measure latency; check access from the OS in recovery and diagnostic mode
Server is unreachable from a specific external network	trace the route; check routing settings; restart network services; scan ports; capture a network traffic dump
Server is unreachable via SSH, HTTP/HTTPS, VPN, RDP, while the server responds to ICMP requests and checks using the mtr, telnet utilities are successful	perform diagnostics of TSPU impact
Short-term connection loss	trace the route; capture a network traffic dump; check access from the OS in recovery and diagnostic mode
Low speed	trace the route; measure data transfer speed
High network latency	check host network availability and measure latency; trace the route; check access from the OS in recovery and diagnostic mode
Packet loss	Trace the route

Trace the route

Trace the route if you encounter:

• low connection speed;
• high network latency;
• connection drops;
• packet loss during data transfer;
• server unreachability from a specific external network.

Route tracing must be performed in both directions — from the dedicated server to a point outside the Selectel infrastructure and back. To do this, you will need an external server — any server with a public IP address and internet access that is located outside the Selectel infrastructure.

We recommend running route tracing using the mtr utility (WinMTR for Windows). The utility allows you to track the full path and transit time of traffic and find out at what stage of the route delays or packet loss occur.

1. Trace the route from the dedicated server to the external server.
2. Trace the route from the external server to the dedicated server.

1. Trace the route from the dedicated server to the external server

Linux

1. Connect to the server via SSH or via KVM console.

2. Install the mtr utility on the dedicated server. Learn more on GitHub mtr.

3. Optional: prepare the dedicated server for route tracing — disable tools and applications that may affect the tracing result:

   • OS firewall rules;
   • application layer (L7) applications — web servers, mail servers, file servers, name servers, peer-to-peer network clients and servers, etc.

4. Trace the route to the external server address:

   mtr -b <remote_ip_address>

   Specify <remote_ip_address> — IP address of the external server.

5. Wait for the utility to trace the route and output routing and latency information.

6. Stop tracing:

   q

Windows

1. Connect to the server via RDP or via KVM console.

2. Install the WinMTR utility on the dedicated server. Learn more on the winMTR website.

3. Optional: prepare the dedicated server for route tracing — disable tools and applications that may affect the tracing result:

   • OS firewall rules;
   • application layer (L7) applications — web servers, mail servers, file servers, name servers, peer-to-peer network clients and servers, etc.

4. Run WinMTR.

5. In the Host field, enter the IP address of the external server.

6. Click Start.

7. Wait for the utility to trace the route and output routing and latency information.

8. Stop the trace by clicking Stop.

macOS

1. Connect to the server via VNC or via the KVM console.

2. Install the mtr utility on the dedicated server. Learn more on mtr GitHub.

3. Optional: prepare the dedicated server for route tracing — disable tools and applications that may affect the tracing result:

   • OS firewall rules;
   • application layer (L7) applications — web servers, mail servers, file servers, name servers, peer-to-peer network clients and servers, etc.

4. Trace the route to the external server address:

   mtr -b <remote_ip_address>

   Specify <remote_ip_address> — the IP address of the external server.

5. Wait for the utility to trace the route and output routing and latency information.

6. Stop tracing:

   q

2. Trace the route from the external server to the dedicated server

1. Install a utility on the external server depending on the OS used:

   • for Linux — mtr, learn more on mtr GitHub;
   • for Windows — WinMTR.

2. Optional: prepare the external server for route tracing — disable tools and applications that may affect the tracing result:

   • OS firewall rules;
   • application layer (L7) applications — web servers, mail servers, file servers, name servers, peer-to-peer network clients and servers, etc.

3. Run a traceroute to the address of the dedicated server. You can view the IP address of the dedicated server in the control panel: from the top menu, click Products → Dedicated Servers → Servers → server page → Operating System tab → IP.

Measure data transfer speed

If you encounter low data transfer speed issues, measure the connection speed.

Measure data transfer speed in two directions — from the dedicated server to a point outside the Selectel infrastructure and back. To do this, you will need an external server — any server with a public IP address and internet access that is located outside the Selectel infrastructure.

To measure speed, we recommend using the iperf3. utility.

1. Prepare the dedicated server for speed measurement.
2. Measure the data transfer speed.

1. Prepare the dedicated server for speed measurement

1. Boot the server in rescue and diagnostics mode to eliminate the influence of OS processes on diagnostic results.

2. Connect to the server via SSH or via the KVM console.

3. Install the iperf3 utility on the dedicated server, learn more in the documentation for iPerf.

4. Run the iperf3 utility. The utility must remain running until the completion of the data transfer speed measurement.

   iperf3 -s

2. Measure data transfer speed

1. Open the CLI on the external server.

2. Install the iperf3 utility on the external server, learn more in the documentation for iPerf.

3. Measure the speed from the external server to the dedicated server. The command will perform the test in 20 threads to maximize the load on the communication channel.

   iperf3 -c <ip_address> -P20 -t60 -i10

   Specify <ip_address> — public IP address of the dedicated server. You can view it in the control panel: from the top menu, click Products → Dedicated Servers → Servers → server page → Operating System tab → IP.

4. Perform the measurement in the reverse direction — add the flag -R: to the command:

   iperf3 -c <ip_address> -P20 -t60 -i10 -R

   Specify <ip_address> — public IP address of the dedicated server. You can view it in the control panel: from the top menu, click Products → Dedicated Servers → Servers → server page → Operating System tab → IP.

Check the status of network interfaces

Check the status of network interfaces if there is no internet access on the server.

Linux

1. Connect to the server via SSH or via the KVM console.

2. Check the status of network interfaces:

   ip a

   The response will contain information about network interfaces. For example:

   1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default 
       link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
       inet 127.0.0.1/8 scope host lo
         valid_lft forever preferred_lft forever
       inet6 ::1/128 scope host 
         valid_lft forever preferred_lft forever
   
   2: enp0s1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 1c:1b:0d:12:34:56 brd ff:ff:ff:ff:ff:ff
       inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic enp0s1
         valid_lft 604675sec preferred_lft 604675sec
       inet6 fe80::1234:abcd:5678:9ef0/64 scope link 
         valid_lft forever preferred_lft forever
   
   3: enp0s2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 1c:1b:0d:65:43:21 brd ff:ff:ff:ff:ff:ff
       inet 203.0.113.10/24 brd 203.0.113.255 scope global dynamic enp0s2
         valid_lft 604675sec preferred_lft 604675sec
       inet6 fe80::abcd:1234:5678:9ef0/64 scope link 
         valid_lft forever preferred_lft forever

   Where:

   • enp0s1 — name of the network interface on the private port;
   • enp0s2 — name of the network interface on the internet port;
   • UP — status of the network interface.

3. If the network interface is in the DOWN status, enable it. Learn more in the IP Command Set guide of the iproute2 documentation — a package of utilities that includes the utility ip.

   ip link set dev <eth_name> up

   Specify <eth_name> — the network interface name you obtained in step 2.

Windows

1. Connect to the server via RDP or via the KVM console.

2. Run PowerShell as administrator.

3. Check the status of network interfaces:

   Get-NetAdapter

   The response will contain information about network interfaces. For example:

   Name          InterfaceDescription            ifIndex Status       MacAddress             LinkSpeed
   ----          --------------------            ------- ------       ----------             ---------
   Ethernet      Intel(R) Ethernet Connection         12 Up           00-1A-2B-3C-4D-5E       1 Gbps

   Where:

   • Ethernet — name of the network interface on the internet port;
   • Up — status of the network interface.

4. If the network interface is in the Disabled status, enable it:

   Enable-NetAdapter -Name "<eth_name>" -Confirm:$false

   Specify <eth_name> — the network interface name you obtained in step 3.

macOS

1. Connect to the server via VNC or via the KVM console.

2. Check the status of network interfaces:

   ifconfig

   The response will contain information about network interfaces. For example:

   lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
       inet 127.0.0.1 netmask 0xff000000
       inet6 ::1 prefixlen 128 
       inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
       nd6 options=201<PERFORMNUD,DAD>
       
   en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
       ether a4:5e:60:12:34:56 
       inet 203.0.113.10 netmask 0xffffff00 broadcast 203.0.113.255
       inet6 fe80::a65e:60ff:fe12:3456%en0 prefixlen 64 secured scopeid 0x4 
       inet6 2001:db8::1234:abcd prefixlen 64 autoconf secured
       nd6 options=201<PERFORMNUD,DAD>
       media: autoselect
       status: active

   Where:

   • en0 — name of the network interface on the internet port;
   • UP and active — network interface status, interface en0 is up and running.

3. If the network interface is in the inactive status, enable it:

   sudo ifconfig <eth_name> up

   Specify <eth_name> — the network interface name you obtained in step 2.

Check routing settings

Check routing settings if:

• there is no internet access on the server;
• the server is unreachable over the network;
• the server is unreachable from a specific external network.

Linux

1. Connect to the server via SSH or via the KVM console.

2. Check routing settings:

   ip r

   The response will contain a routing table. For example:

   default via 203.0.113.1 dev enp0s2 proto dhcp metric 100
   203.0.113.0/24 dev enp0s2 proto kernel scope link src 203.0.113.10 metric 100
   192.168.1.0/24 dev enp0s1 proto kernel scope link src 192.168.1.100 metric 100

   Where:

   • default via 203.0.113.1 dev enp0s2 — default route, internet traffic goes through the gateway 203.0.113.1 via interface enp0s2;

   • 203.0.113.0/24 dev enp0s2 — route to the public subnet 203.0.113.0/24, traffic to this subnet goes via interface enp0s2;

   • 192.168.1.0/24 dev enp0s1 — route to the private subnet 192.168.1.0/24, traffic to this subnet goes via interface enp0s1.

Windows

1. Connect to the server via RDP or via the KVM console.

2. Run PowerShell as administrator.

3. Check routing settings:

   Get-NetRoute | Select-Object DestinationPrefix, NextHop, RouteMetric, @{Name="Interface";Expression={(Get-NetIPInterface -InterfaceIndex $_.InterfaceIndex).InterfaceAlias}}

   The response will contain a routing table. For example:

   DestinationPrefix NextHop       RouteMetric Interface
   ----------------- -------       ----------- ---------
   0.0.0.0/0         203.0.113.1   25          Ethernet
   203.0.113.0/24    0.0.0.0       25          Ethernet
   192.168.1.0/24    0.0.0.0       10          Internal

   Where:

   • 0.0.0.0/0 with NextHop 203.0.113.1 — default route, internet traffic goes through the gateway 203.0.113.1 via interface Ethernet;

   • 203.0.113.0/24 with NextHop 0.0.0.0 — route to the public subnet 203.0.113.0/24, traffic to this subnet goes via interface Ethernet;

   • 192.168.1.0/24 with NextHop 0.0.0.0 — route to the private subnet 192.168.1.0/24, traffic to this subnet goes via interface Internal.

macOS

1. Connect to the server via VNC or via the KVM console.

2. Check routing settings:

   netstat -rn

   The response will contain a routing table. For example:

   Internet:
   Destination        Gateway            Flags        Refs      Use   Netif Expire
   default            203.0.113.1        UGSc           10        0     en0
   127                127.0.0.1          UCS             0        0     lo0
   203.0.113.0/24     link#4             UCS             2        0     en0

   Where:

   • default 203.0.113.1 — default route, internet traffic goes through the gateway 203.0.113.1 via interface en0;

   • 203.0.113.0/24 link#4 — route to the public subnet 203.0.113.0/24, traffic to this subnet goes via interface en0.

Capture a network traffic dump

If the server is unreachable from a specific external network or you observe short-term connection losses, capture a network traffic dump.

A network traffic dump is the process of recording and saving network traffic that passes through a network or device. The dump contains information about network protocols, transmitted packets, their content, sources, and destinations of data.

Linux

1. Connect to the server via SSH or via the KVM console.

2. Install tcpdump — a utility for capturing and analyzing network traffic. Learn more in the documentation for tcpdump.

   apt update
   apt install -y tcpdump

3. Find the name of the network interface for which you need to capture a dump by listing the network interfaces:

   ip a

   The response will contain information about network interfaces. For example:

   1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default 
       link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
       inet 127.0.0.1/8 scope host lo
         valid_lft forever preferred_lft forever
       inet6 ::1/128 scope host 
         valid_lft forever preferred_lft forever
   
   2: enp0s1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 1c:1b:0d:12:34:56 brd ff:ff:ff:ff:ff:ff
       inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic enp0s31f6
         valid_lft 604675sec preferred_lft 604675sec
       inet6 fe80::1234:abcd:5678:9ef0/64 scope link 
         valid_lft forever preferred_lft forever
   
   3: enp0s2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
       link/ether 1c:1b:0d:65:43:21 brd ff:ff:ff:ff:ff:ff
       inet 203.0.113.10/24 brd 203.0.113.255 scope global dynamic enp0s2
         valid_lft 604675sec preferred_lft 604675sec
       inet6 fe80::abcd:1234:5678:9ef0/64 scope link 
         valid_lft forever preferred_lft forever

   Here enp0s2 is the name of the network interface on the internet port.

4. Run tcpdump:

   sudo tcpdump -i <eth_name> -w <file_name>

   Specify:

   • <eth_name> — the network interface name you obtained in step 3;
   • <file_name> — the name of the file to save the network traffic capture to, for example dump.pcap.

5. Wait until the required amount of data is collected.

6. Stop recording by pressing Ctrl + C.

Windows

1. Connect to the server via RDP or via the KVM console.

2. Install Wireshark — a utility for capturing and analyzing network traffic, learn more in the documentation for Wireshark.

3. Run Wireshark as administrator.

4. To start capturing network traffic, click the desired network interface.

5. Wait until the required amount of data is collected.

6. Stop recording.

7. Save the recording to a file.

macOS

1. Connect to the server via VNC or via the KVM console.

2. Install tcpdump — a utility for capturing and analyzing network traffic. Learn more in the documentation for tcpdump.

3. Find the name of the network interface for which you need to capture a dump by listing the network interfaces:

   networksetup -listnetworkserviceorder

   The response will contain information about network interfaces. For example:

   An asterisk (*) denotes that a network service is disabled.
   
   (1) Ethernet (Hardware Port: Ethernet, Device: en0)

   Here en0 is the name of the network interface on the internet port.

4. Run tcpdump:

   sudo tcpdump -i <eth_name> -w <file_name>

   Specify:

   • <eth_name> — the network interface name you obtained in step 3;
   • <file_name> — the name of the file to save the network traffic capture to, for example dump.pcap.

5. Wait until the required amount of data is collected.

6. Stop recording by pressing Ctrl + C.

Restart network services

Restart network services if on the server:

• there is no internet access;
• or the server is unreachable from a specific external network.

Linux

1. Connect to the server via SSH or via the KVM console.

2. Restart network services:

   systemctl restart networking

Windows

1. Connect to the server via RDP or via the KVM console.

2. Run PowerShell as administrator.

3. Find the name of the network interface on which you need to restart network services by listing the network interfaces:

   Get-NetAdapter

   The response will contain a list of network interfaces. For example:

   Name          InterfaceDescription            ifIndex Status       MacAddress             LinkSpeed
   ----          --------------------            ------- ------       ----------             ---------
   Ethernet      Intel(R) Ethernet Connection         12 Up           00-1A-2B-3C-4D-5E       1 Gbps

   Here Ethernet is the name of the network interface on the internet port.

4. Restart network services:

   Disable-NetAdapter -Name <eth_name>
   Enable-NetAdapter -Name <eth_name>

   Specify <eth_name> — the network interface name you obtained in step 3.

macOS

1. Connect to the server via VNC or via the KVM console.

2. Find the name of the network interface on which you need to restart network services by listing the network interfaces:

   networksetup -listnetworkserviceorder

   The response will contain a list of network interfaces. For example:

   An asterisk (*) denotes that a network service is disabled.
   
   (1) Ethernet (Hardware Port: Ethernet, Device: en0)

   Here en0 is the name of the network interface on the internet port.

3. Restart network services:

   sudo networksetup -setnetworkserviceenabled <eth_name> off
   sudo networksetup -setnetworkserviceenabled <eth_name> on

   Specify <eth_name> — the network interface name you obtained in step 2.

Check filtering rules

If the server is unreachable over the network, check the firewall filtering rules in the server OS.

Linux

1. Connect to the server via SSH or via the KVM console.

2. View the list of firewall rules:

   iptables -L -n -v

   The response will contain a list of rules. For example:

   Chain INPUT (policy DROP 1234 packets, 98765 bytes)
   pkts bytes target     prot opt in     out     source               destination
   2045  187K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
   1087  159K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0      ctstate RELATED,ESTABLISHED
    120  8400 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0      tcp dpt:22
      0     0 DROP       all  --  *      *       192.168.1.100        0.0.0.0/0
   
   Chain FORWARD (policy DROP 0 packets, 0 bytes)
   pkts bytes target     prot opt in     out     source               destination
   
   Chain OUTPUT (policy ACCEPT 3456 packets, 456789 bytes)
   pkts bytes target     prot opt in     out     source               destination

   Where:

   • Chain — list of rules for packets of a specific direction:

     • INPUT — for incoming packets;
     • FORWARD — for forwarded packets;
     • OUTPUT — for outgoing packets;

   • policy — rule action, for example ACCEPT or DROP.

Windows

1. Connect to the server via RDP or via the KVM console.

2. Run PowerShell as administrator.

3. View the list of firewall rules:

   Get-NetFirewallRule | Format-Table Name, Enabled, Action, DisplayName

   The response will contain a list of rules. For example:

   DisplayName : File and Printer Sharing (SMB-In)
   Name        : FPS-SMB-In-TCP
   Enabled     : True
   Direction   : Inbound
   Action      : Allow
   
   DisplayName : Remote Desktop - User Mode (TCP-In)
   Name        : RDP-TCP-In
   Enabled     : True
   Direction   : Inbound
   Action      : Allow
   
   DisplayName : Core Networking - DNS (UDP-Out)
   Name        : CoreNet-DNS-Out
   Enabled     : True
   Direction   : Outbound
   Action      : Allow
   
   DisplayName : Windows Remote Management (HTTP-In)
   Name        : WINRM-HTTP-In
   Enabled     : False
   Direction   : Inbound
   Action      : Allow
   
   DisplayName : Block Internet Access (Test Rule)
   Name        : Block-Internet-Test
   Enabled     : True
   Direction   : Outbound
   Action      : Block

   Here Action is the rule action, for example Allow or Block. Learn more in the Windows firewall guide of the Microsoft documentation.

macOS

1. Connect to the server via VNC or via the KVM console.

2. View the list of firewall rules:

   sudo pfctl -sr

   The response will contain a list of rules. For example:

   scrub in all fragment reassemble 
   block return all 
   pass out proto tcp from any to any port = ssh flags S/SA keep state 
   pass out proto tcp from any to any port = http flags S/SA keep state 
   pass out proto tcp from any to any port = https flags S/SA keep state 
   pass out proto udp from any to any port = domain keep state 
   pass out proto udp from any to any port = ntp keep state 
   pass out inet proto icmp all keep state 
   pass in proto tcp from any to any port = ssh flags S/SA keep state 
   pass in proto tcp from any to any port = http flags S/SA keep state 
   pass in proto tcp from any to any port = https flags S/SA keep state 

   Here block and pass are rule actions, learn more in the Packet filtering guide of the OpenBSD documentation.

Scan ports

If the server is unreachable over the network or unreachable from a specific external network, scan the ports. Ports can be scanned using the nmap. utility.

Linux

1. Connect to the server via SSH or via the KVM console.

2. Install nmap, learn more in the Linux Distributions section of the nmap documentation.

3. Scan ports:

   nmap -p <port> <ip_address>

   Specify:

   • optional: <port> — comma-separated ports, for example 22,80,443, or a port range, for example 20-30;
   • <ip_address> — IP address of the dedicated server. You can view the IP address of the dedicated server in the control panel under Servers and Hardware → Servers → server card → IP address.

Windows

1. Connect to the server via RDP or via the KVM console.

2. Install nmap, learn more in the Windows section of the nmap documentation.

3. Run PowerShell as administrator.

4. Scan ports:

   nmap -p <port> <ip_address>

   Specify:

   • optional: <port> — comma-separated ports, for example 22,80,443, or a port range, for example 20-30;
   • <ip_address> — IP address of the dedicated server. You can view the IP address of the dedicated server in the control panel under Servers and Hardware → Servers → server card → IP address.

macOS

1. Connect to the server via VNC or via the KVM console.

2. Install nmap, learn more in the Apple Mac OS X section of the nmap documentation.

3. Scan ports:

   nmap -p <port> <ip_address>

   Specify:

   • optional: <port> — comma-separated ports, for example 22,80,443, or a port range, for example 20-30;
   • <ip_address> — IP address of the dedicated server. You can view the IP address of the dedicated server in the control panel under Servers and Hardware → Servers → server card → IP address.

Check host network availability and measure latency

If the server is unreachable over the network, or if you experience high network latency or packet loss, check the server availability and measure latency using the ping utility. The ping utility is part of the standard networking toolset and is pre-installed in most OSs.

You can perform the check to the server's public or private IP address, or to the domain name linked to the server's IP address.

To perform the check, you will need a second server from which you will run the check. If the check is to a private IP address, the servers must be connected via a private network.

1. Open the CLI on the server from which you will perform the check.

2. Run the check:

   ping <ip_address>

   Specify <ip_address> — IP address or domain name of the server. You can view the IP address of the dedicated server in the control panel: from the top menu, click Products → Dedicated Servers → Servers → server page → Operating System tab → IP.

Check access from the OS in recovery and diagnostic mode

To prevent OS settings from affecting server operation and diagnostics:

1. Boot the server in rescue and diagnostics mode.

2. Connect to the server via SSH or via the KVM console:

   • if the server responds and you can connect, the issue is with the software on the server. Reboot the server to restart network services. If it is a software issue, it will be resolved when reverting to the previous OS boot template;
   • if the server is unreachable in rescue and diagnostics mode, submit a ticket describing the issue.