This chapter is from the book
This chapter is from the book
This chapter is from the book
TCP/IP Troubleshooting
Windows XP Professional and Windows Server 2003 offer several native programs that an administrator can use to troubleshoot TCP/IP issues. Some are full-fledged tools in their own right, such as FTP, but they can help in determining what might be affecting a TCP/IP network. Many of these TCP/IP troubleshooting tools are discussed in the sections that follow.
The PING Command
The PING command can be used to test network connectivity from a local system by sending an ICMP message to a remote host or gateway. On external networks such as the Internet, the use of PING might be somewhat limited, depending on how routers and firewalls are configured; many do not allow ICMP traffic. If the remote host receives the message, it responds with a reply message. PING notes the IP address, the number of bytes in the message, how long it took to reply (in milliseconds –], and the length of Time to Live (TTL) in seconds and shows any packet loss in terms of percentages, as shown here:
D:\>ping 192.168.1.225 Pinging 192.168.1.225 with 32 bytes of data: Reply from 192.168.1.225: bytes=32 time<10ms TTL=128 Reply from 192.168.1.225: bytes=32 time<10ms TTL=128 Reply from 192.168.1.225: bytes=32 time<10ms TTL=128 Reply from 192.168.1.225: bytes=32 time<10ms TTL=128 Ping statistics for 192.168.1.225: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milliseconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms Usage: ping [-t] [-a] [-n count] [-l size] [-f] [-i TTL] [-v TOS] [-r count] [-s count] [[-j host-list] | [-k host-list]] [-w timeout] target_name
The following list describes the switches available for use with PING:
-t—Ping the specified host until stopped. To see statistics and to continue, type Ctrl+Break; to stop, type Ctrl+C.
-a—Resolve addresses to hostnames.
-n count—The number of echo requests to send.
-l size—Send buffer size.
-f—Set the Don't Fragment flag in the packet.
-i TTL—Time to Live.
-v TOS—Type of Service.
-r count—Record route for count hops.
-s count—Timestamp for count hops.
-j host-list—Loose source route along host list.
-k host-list—Strict source route along host list.
-w timeout—Time in milliseconds to wait for each reply.
The ARP Command
The ARP command displays and modifies the IP-to-physical address translation tables used by Address Resolution Protocol (ARP), as shown here:
ARP -s inet_addr eth_addr [if_addr] ARP -d inet_addr [if_addr] ARP -a [inet_addr] [-N if_addr]
The following list describes the switches available for use with ARP:
-a—Displays current ARP entries by referencing the current protocol data. If inet_addr is specified, the IP and physical addresses for only the specified computer are displayed. If more than one network interface uses ARP, entries for each ARP table are displayed.
-g—Same as -a.
inet_addr—Specifies an Internet address.
-N if_addr—Displays ARP entries for the network interface specified by if_addr.
-d—Deletes the host specified by inet_addr. You can use * as a wildcard with inet_addr to delete all hosts.
-s—Adds the host and associates the Internet address inet_addr with the physical (MAC) address.
eth_addr—Uses the physical (MAC) address and is given as six hexadecimal bytes separated by hyphens.
if_addr—Specifies the Internet address of the interface that should have its address translation table modified. If if_addr is not entered, the first applicable interface is used.
For example, the following code adds a static entry:
> arp -s 157.55.85.212 00-aa-00-62-c6-09 ....
The following displays the ARP table:
> arp -a
The IPCONFIG Command
IPCONFIG is a command-line tool for getting basic IP configuration information, including the IP address, subnet mask, and default gateway. The IPCONFIG /all switch produces a detailed configuration report for all interfaces on a system, including any configured remote access adapters, as shown here:
ipconfig [/? | /all | /renew [adapter] | /release [adapter] | /flushdns | /displaydns | /registerdns | /showclassid adapter | /setclassid adapter [classid] ]
The following list describes the switches available for use with IPCONFIG:
/all—Display full configuration information.
/release—Releases the IP address for the specified adapter.
/renew—Renews the IP address for the specified adapter.
/flushdns—Purges the DNS Resolver cache.
/registerdns—Reregisters DNS names.
/displaydns—Displays the contents of the DNS Resolver Cache.
/showclassid—Displays all the DHCP class IDs allowed for adapter.
/setclassid—Modifies the DHCP class ID.
The default is to display only the IP address, subnet mask, and default gateway for each adapter bound to TCP/IP. For /release and /renew, if no adapter name is specified, the IP address leases for all adapters bound to TCP/IP are released or renewed.
The NBTSTAT Command
NetBT Statistics (Nbtstat.exe) is a command-line tool that can be used to view and troubleshoot network NetBIOS over TCP/IP (NetBT) name resolution. It displays protocol statistics and current TCP/IP connections that are using NetBT.
NetBT resolves NetBIOS names to IP addresses by using several options for NetBIOS name resolution, including local cache lookup, WINS server query, broadcast, LMHOSTS and HOSTS file lookup, and DNS server query. It also displays protocol statistics and current TCP/IP connections using NetBT.
NBTSTAT [ [-a RemoteName] [-A IP address] [-c] [-n] [-r] [-R] [-RR] [-s] [-S] [interval] ]
The following list describes the switches available for use with NBTSTAT:
-a (adapter status)—Lists the remote machine's name table given its name.
-A (adapter status)—Lists the remote machine's name table given its IP address.
-c (cache)—Lists NBT's cache of remote (machine) names and their IP addresses.
-n (names)—Lists local NetBIOS names.
-r (resolved)—Lists names resolved by broadcast and via WINS.
-R (Reload)—Purges and reloads the cache name table and reloads the #PRE tagged entries from the LMHOST file if any are present.
-S (Sessions)—Lists the sessions table with the destination IP addresses.
-s (sessions)—Lists the sessions table, converting destination IP addresses to computer NetBIOS names.
-RR (ReleaseRefresh)—Sends Name Release packets to WINS and then starts Refresh.
RemoteName—Remote host machine name.
IP address—Dotted decimal representation of the IP address.
interval—Redisplays selected statistics, pausing the number of seconds specified by interval between each display. Press Ctrl+C to stop redisplaying statistics.
The NETSTAT Command
NETSTAT (Netstat.exe) is a command-line tool that displays TCP/IP statistics and active connections to and from the local system. It can also display all connections and listening ports and has an option to display the number of bytes sent and received and any network packets dropped (if applicable).
NETSTAT [-a] [-e] [-n] [-o] [-s] [-p protocol] [-r] [interval]
The following list describes the switches available for use with NETSTAT:
-a—Displays all connections and listening ports.
-e—Displays ethernet statistics. Can be combined with the -s option.
-n—Displays addresses and port numbers in numerical form.
-o—Displays the owning process ID associated with each connection.
-p protocol—Shows connections for the protocol specified by protocol, which can be TCP, UDP, TCPv6, or UDPv6. If used with the –s option to display per-protocol statistics, protocol can be any of the following: IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.
-r—Displays the routing table.
-s—Displays per-protocol statistics. By default, statistics are shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6; the -p option can be used to specify a subset of the default.
interval—Redisplays selected statistics, pausing the number of seconds specified by interval between each display. Press Ctrl+C to stop redisplaying statistics. If this switch is omitted, NETSTAT prints the current configuration information once.
The ROUTE Command
The ROUTE command-line tool displays the current IP routing table for the local system, and it can be used to add or delete IP routes and to add persistent routes.
ROUTE [-f] [-p] [command] [destination] [MASK netmask] [gateway] [METRIC metric] [IF interface]
The following list describes the switches available for use with ROUTE:
-f—Clears the routing tables of all gateway entries. If it is used with one of the ROUTE commands (see the following list), the routing tables are cleared before running the command.
-p—When used with the ADD command, it makes a route persistent across boots of the system. By default, routes are not preserved when the system is restarted. Ignored for all other commands, which always affect the appropriate persistent routes.
The following list describes the commands available for use with ROUTE:
PRINT—Prints a route.
ADD—Adds a route.
DELETE—Deletes a route.
CHANGE—Modifies an existing route.
destination—Specifies the host.
MASK—Specifies that the next parameter is the netmask value.
netmask—Specifies a subnet mask value for this route entry. If not specified, it defaults to 255.255.255.255.
gateway—Specifies the gateway.
interface—Specifies the interface number for the specified route.
METRIC—Specifies the metric—that is, the cost for the destination.
Names used for the destination command are looked up in the NETWORKS file on the local system. Names used for the gateway command are looked up in the HOSTS file on the local system. If the command is PRINT or DELETE, the destination or gateway can be a wildcard (*), or the gateway entry can be left blank. Invalid MASK entries, such as (DEST & MASK) != DEST, generate an error.
The HOSTNAME Command
HOSTNAME is a command-line tool for showing the local computer's hostname. It can be used for authentication purposes by the Remote Copy Protocol (RCP), Remote Shell (RSH), and Remote Execution (REXEC) tools.
The TRACERT Command
TRACERT is sometimes used to verify that IP addressing has been correctly configured on a client. It basically shows the route taken to reach a remote system.
tracert [-d] [-h maximum_hops] [-j host-list] [-w timeout] target_name
Here is a list of available switches for the TRACERT command:
-d—Do not resolve addresses to hostnames.
-h maximum_hops—Maximum number of hops to search for target.
-j host-list—Loose source route along host list.
-w timeout—Wait the number of milliseconds specified by timeout for each reply.
The PATHPING Command
Like TRACERT, PATHPING shows the route taken to reach a remote system, but PATHPING does so with more detail and offers more functionality.
pathping [-g host-list] [-h maximum_hops] [-i address] [-n] [-p period] [-q num_queries] [-w timeout] [-P] [-R] [-T] [-4] [-6] target_name
Here is a list of available switches for the PATHPING command:
-g host-list—Loose source route along the host list.
-h maximum_hops—Maximum number of hops to search for target.
-i address—Use the specified source address.
-n—Do not resolve addresses to hostnames.
-p period—Wait the number of milliseconds specified by period between pings.
-q num_queries—Number of queries per hop.
-w timeout—Wait the number of milliseconds specified by timeout for each reply.
-P—Test for RSVP PATH connectivity.
-R—Test if each hop is RSVP aware.
-T—Test connectivity to each hop with layer-2 priority tags.
-4—Force using IPv4.
-6—Force using IPv6.
The FTP Command
FTP is used to transfer files from system to system over TCP ports 20 and 21 (by default), but it can also help you diagnose problems on your TCP/IP network. By using Internet Explorer with FTP, users experience a Windows Explorer–type of GUI environment for the FTP file transfer by having features such as file and folder views, drag-and-drop, and copy-and-paste available.
The command-line FTP allows for more functionality. FTP is considered a connected session that uses TCP. FTP commands are as follows: !, delete, literal, prompt, send ?, debug, ls, put, status append, dir, mdelete, pwd, trace ascii, disconnect, mdir, quit, type, bell, get, mget, quote, user, binary, glob, mkdir, recv, verbose, bye, hash, mls, remotehelp, cd, help, mput, rename, close, lcd, open, and rmdir. Here is an example of the syntax:
FTP [-v] [-d] [-i] [-n] [-g] [-s:filename] [-a] [-w:windowsize] [-A] [host]
The following list explains the options you can use with the FTP command:
-v—Suppresses display of remote server responses.
-n—Suppresses auto-login at initial connection.
-i—Turns off interactive prompting during multiple file transfers.
-d—Enables debugging.
-g—Disables filename globing.
-s:filename—Specifies a text file containing FTP commands; the commands automatically run after FTP starts.
-a—Use any local interface when binding a data connection.
-A—Log in as anonymous.
-w:buffersize—Overrides the default transfer buffer size of 4,096.
host—Specifies the hostname or IP address of the remote host to connect to.
The TFTP Command
Trivial File Transfer Protocol allows for connectionless transfer of files to and from systems using UDP. Although TFTP is limited in functionality, there are still some command-line switches that can be used to tailor its performance:
TFTP [-i] host [GET | PUT] source [destination]
Definitions for these switches are as follows:
-i—Specifies binary image transfer mode (also called octet). In binary image mode, the file is moved literally byte by byte.
host—Specifies the local or remote host by name.
GET—Transfers the file destination on the remote host to the file source on the local host.
PUT—Transfers the file source on the local host to the file destination on the remote host.
source—Specifies the file to transfer.
destination—Specifies where to transfer the file.
The TELNET Command
Telnet is a command-line terminal emulation program that enables an administrator to perform commands on a remote computer from a command window on a local system. Here is an example of the syntax:
telnet [-a] [-e char] [-f filename] [-l user] [-t term] [host] [port]
Definitions for TELNET switches are as follows:
-a—Attempts automatic logon. Same as -l option, except it uses the currently logged on user's name.
-e char—Escape character to enter Telnet client prompt.
-f filename—Filename for client-side logging.
-l user—Specifies the username to log in with on the remote system. Requires that the remote system support the TELNET ENVIRON option.
-t term—Specifies terminal type. Supported term types are vt100, vt52, ansi, and vtnt only.
host—Specifies the hostname or IP address of the remote computer to connect to.
port—Specifies a port number or service name.
The RCP Command
Remote Copy Protocol (RCP) uses TCP to copy files to and from systems running the RCP service. It can be scripted in a batch file and does not require a password. The remote host must be running the Remote Shell Daemon (RSHD) service, and the user's username must be configured in the remote host's .rhosts file. Microsoft's implementation of TCP/IP includes the RCP client software but not RSHD services. RCP is one of the r- commands available on all Unix systems.
RCP [-a | -b] [-h] [-r] [host][.user:]source [host][.user:] path\destination
The following list explains the options you can use with the RCP command:
-a—This is the default transfer mode that specifies ASCII transfer mode. This mode converts the end-of-line (EOL) characters to a carriage return for Unix and a carriage return/line feed for personal computers.
-b—Specifies binary image transfer mode.
-h—Transfers hidden files.
-r—Copies the contents of all subdirectories; destination must be a directory.
host—Specifies the local or remote host. If the host is specified as an IP address or if the hostname contains dots, you must specify the user.
.user:—Specifies a username to use instead of the current username.
source—Specifies the files to copy.
path\destination—Specifies the path to the logon directory on the remote host.
The RSH Command
Remote Shell (RSH) enables clients to run commands directly on remote hosts running the RSH service without having to log on to the remote host. Microsoft's implementation of TCP/IP includes the RSH client software but not the RSH service. If a user on a computer running in a Windows domain tries to use RSH to run a command on a remote Unix server running RSH, the domain controller is required by the RSH client to resolve the user's username. RSH is one of the Unix r-commands that is available on all Unix systems.
The REXEC Command
Remote Execution (REXEC) runs commands on remote hosts running the REXEC service and authenticates the username on the remote host before executing the specified command.
REXEC host [-l username] [-n] command
The following list defines options to use with the REXEC command:
host—Specifies the remote host on which to run the command.
-l username—Specifies the username on the remote host.
-n—Redirects the input of REXEC to NULL.
command—Specifies the command to run.