لطفا منتظر باشید ...
PublisherNetwork Diagnostic Utilities
Before examining network name resolution in detail, we need to take a look at a few network diagnostic utilities in Windows Server 2003 and the Resource Kit. (They are also available in Windows 2000.) These tools are useful for displaying the contents of the many name caches and to modify their contents. They are IPCONFIG, NETSTAT, TRACERT, PATHPING, NBTSTAT, and NETDIAG.
IPCONFIG
The IP parameters for an interface are set and configured using the Network and Dial-up Connection window. You can view these settings from the command line using IPCONFIG. Run ipconfig /all to display detailed information for each interface.Here is an example:
Ethernet adapter :
Host Name: . . . . . . . . . . . . : PRO1.company.com
Description . . . . . . . . . . : NETGEAR FA310TX Fast Ethernet Adapter (NGRPCI).
Physical Address. . . . . . . . : 08-00-09-AA-AA-AA
DHCP Enabled. . . . . . . . . . : Yes
IP Address. . . . . . . . . . . : 10.1.60.1
Subnet Mask . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . : 10.1.254.254
Primary WINS Server . . . . . . : 10.1.100.254
Secondary WINS Server . . . . . : 10.1.100.253
Lease Obtained. . . . . . . . . : Saturday, December 16, 2001 3:35:06 AM
Lease Expires . . . . . . . . : Sunday, December 24, 2001 3:35:06 AM
Here are the switches associated with IPCONFIG and their functions:
- Ipconfig /release.
If an adapter is configured for DHCP, this option releases the currently leased address. Use this switch to force the client to give up an address that you want to assign to another client. - Ipconfig /renew.
If the adapter is configured for DHCP, this option sends a renewal request to the DHCP server that initially leased the address. Under most circumstances, the client will obtain the address that it had previously leased. Use this option to download a new DHCP configuration packet. - Ipconfig /displaydns.
This option shows the records in the local DNS cache. - Ipconfig /flushdns.
This option clears the local DNS cache. - Ipconfig /registerdns.
This option registers the client with Dynamic DNS. - Ipconfig /showclassid.
This option lists the allowable DHCP class IDs for the adapter. - Ipconfig /setclassid.
This option modifies the DHCP class ID.
Netstat
This utility displays data collected from interfaces configured for TCP/IP. Here are the switches and what they display:
- Netstat -a.
Displays the various TCP and UDP sessions established on an interface. Use this switch when you want a quick check for potential teardrop attacks or other possible problems that could cause a server to accumulate excessive TCP listens and sessions:
TCP DC01:3269 DC01.subsidiary.com:0 LISTENING
TCP DC01:6548 DC01.subsidiary.com:0 LISTENING
TCP DC01:nbsession DC01.subsidiary.com:0 LISTENING
TCP DC01:389 DC01.subsidiary.com:1065 ESTABLISHED
TCP DC01:389 DC01.subsidiary.com:1095 ESTABLISHED
TCP DC01:389 DC01.subsidiary.com: 1103 ESTABLISHEDGraphical IP Configuration
You may prefer a graphical representation of an interface's IP configuration, such as that used by Winipcfg in Windows 9x. You can get such a display by right-clicking the connection icon in the system tray and selecting STATUS from the flyout menu. This opens the Status window for the connection. Then select the Support tab to show the IP configuration information. Figure 4.4 shows an example. You can renew and release DHCP addresses using this window.Figure 4.4. Local Area Connection Status window showing IP connection information.
If you do not see a connection icon in the system tray, enable the Show Icon In Taskbar Notification Area When Connected option in the properties for the connection. - Netstat e.
Displays Ethernet statistics including problem packets:
Interface Statistics
Received Sent
Bytes 870327 9569847
Unicast packets 6729 10074
Non-unicast packets 2345 725
Discards 0 0
Errors 0 2
Unknown protocols 0 - Netstat n.
Displays local addresses and port numbers for the various sessions and listens:
Active Connections
Proto Local Address Foreign Address State
TCP 10.1.100.1:445 10.1.1.1:1160 ESTABLISHED
TCP 10.1.100.1:445 10.2.1.1:1313 ESTABLISHED
TCP 10.1.100.1:445 10.3.1.2:1047 ESTABLISHED
TCP 10.1.100.1:2261 10.1.1.254:3389 ESTABLISHED - Netstat p [tcp] [udp] [ip].
Similar to -n, but lists by host name. The list includes protocol represented by p. The example is for Netstat -p tcp (The microsoft-ds entry corresponds to TCP port 445):
Proto Local Address Foreign Address State
TCP srv1:microsoft-ds DC01:1160 ESTABLISHED
TCP srv1:microsoft-ds DC02:1313 ESTABLISHED
TCP srv1:microsoft-ds DC03:1047 ESTABLISHED
TCP srv1:2261 NT401:3389 ESTABLISHED - Netstat r.
Displays the contents of the local routing table. The listing also includes the active ports:
=======================================================================
Interface List
0x1 ................. Internal loopback interface for 127.0.0.0 network
0x2 ................. Internal RAS Server interface for dial in clients
0x3 ...08 00 09 aa aa aa ...... NETGEAR FA310TX Adapter (NGRPCI)
=======================================================================
=======================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
10.1.0.0 255.255.0.0 10.1.30.1 10.1.30.1 1
10.1.30.1 255.255.255.255 127.0.0.1 127.0.0.1 1
10.255.255.255 255.255.255.255 10.1.30.1 10.1.30.1 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
127.0.0.1 255.255.255.255 127.0.0.1 127.0.0.1 1
224.0.0.0 224.0.0.0 10.1.30.1 10.1.30.1 1
255.255.255.255 255.255.255.255 10.1.30.1 10.1.30.1 1
=============================================================================== - Netstat s.
Displays statistics for each protocol. Use the p switch to select a particular protocol:
TCP Statistics
Active Opens = 1103
Passive Opens = 1204
Failed Connection Attempts = 1
Reset Connections = 34
Current Connections = 22
Segments Received = 23942
Segments Sent = 27209
Segments Retransmitted = 134
Tracert
This utility is similar to the UNIX traceroute. It reports the IP address and name of each interface between the client and the target. If Ping fails, Tracert can tell you where the responses have stopped.Tracert works by sending out a series of ICMP Echo Requests to the destination host, similar to Ping, except that Tracert controls the Time-To-Live (TTL) value in the ICMP packet to get a response from each intervening router.Tracert sends the first ICMP Echo Request with a TTL of 1, so the first router responds but the second times out with a TTL Exceeded in Transit error. The next ICMP has a TTL of 2, then 3, and so forth until the ultimate host finally responds. Each request is repeated three times and the output is presented as a series of router names and IP addresses. By default, Tracert does a reverse DNS query to get the name associated with each IP address. Here is a sample Tracert report:
C:\Documents and Settings\Admin>tracert www.google.com
Tracing route to www.google.com [216.239.35.100]
over a maximum of 30 hops:
1 1 ms 1 ms <1 ms 192.168.0.254
2 13 ms 12 ms 12 ms 12.48.12.1
3 16 ms 58 ms 77 ms 12.0.121.81
4 21 ms 29 ms 15 ms c1-pos4-1.phnxaz1.home.net [24.7.76.173]
5 21 ms 19 ms 19 ms c1-pos2-0.sndgca1.home.net [24.7.65.134]
6 25 ms 57 ms 23 ms c1-pos1-0.anhmca1.home.net [24.7.64.69]
7 23 ms 26 ms 25 ms c1-pos1-0.lsanca1.home.net [24.7.65.169]
8 30 ms 26 ms 25 ms c1-pos2-0.snbbca1.home.net [24.7.65.174]
9 31 ms 29 ms 30 ms c2-pos3-0.snjsca1.home.net [24.7.64.49]
10 30 ms 32 ms 32 ms above-athome.sjc2.above.net [208.185.175.133]
11 32 ms 36 ms 31 ms core4-core3-oc48.sjc2.above.net [208.184.102.198]
12 32 ms 64 ms 32 ms core2-sjc2-oc48.sjc3.above.net [208.184.233.50]
13 31 ms 31 ms 63 ms main1colo56-core2-oc48.sjc3.above.net [208.185.175.198]
14 31 ms 31 ms 32 ms sjni1-gige-2-1.google.com [216.239.47.18]
15 38 ms 75 ms 40 ms 192.168.254.86
16 38 ms 30 ms 40 ms www.google.com [216.239.35.100]
Trace complete.
Here are the Tracert switches:
- Tracert d.
Turns off host name lookups. This significantly speeds up traces. Highly recommended. - Tracert h.
Increases the maximum hop count. The default is 30. - Tracert j host-list.
This option is used to force Tracert to use a specific router via source routing. - Tracert w.
Increases the maximum timeout.
Pathping
Tracert can take a long time to produce a listing because it waits for the Echo Response from the final host. You'll get a faster trace using Pathping. This utility sends out a series of ICMP Echo Requests with incremented TTLs, just as Tracert does, but it displays the intermediate host address immediately then waits until the ultimate host is contacted before calculating statistics. The calculation takes a long time and you can abort it with Ctrl+C.
Nbtstat
When a Windows TCP/IP client resolves a NetBIOS name, it caches the results in a NetBIOS Name Cache table. By default, the entry stays in the cache for 600 seconds (10 minutes). You can view and manipulate the contents of the NetBIOS Name Cache using Nbtstat. Here are the Nbtstat switches and their functions. The switches are case sensitive:
- Nbtstat -c.
Displays the contents of the local name cache. Use this switch when you want to verify that a computer has cached the correct IP address for a target host.The following code listing shows a sample name cache. The Type column is the 2-byte hex ID of the NetBIOS service. The first three entries were preloaded from a local Lmhosts file, which gives them a life of 60 seconds rather than the default 600 seconds:
Node IpAddress: [10.1.1.10] Scope Id: []
NetBIOS Remote Cache Name Table
Name Type Host Address Life [sec]
------------------------------------------------------------
DC02 <03> UNIQUE 10.1.1.20 60
DC02 <00> UNIQUE 10.1.1.20 60
DC02 <20> UNIQUE 10.1.1.20 60
NTS01 <00> UNIQUE 10.1.1.101 600 - Nbtstat - a.
Displays the name cache on a remote computer given its NetBIOS name. This option also displays the MAC address of the remote network adapter. Example syntax: Nbtstat -a dc01. - Nbtstat -A.
Displays the name cache on a remote machine given its IP address. Also displays the MAC address of the remote network adapter. Example syntax: Nbtstat -A 10.1.1.1. - Nbtstat -n.
Displays the NetBIOS names associated with the local computer. This includes the computer name with all services, the locally logged-on user with all services, the workgroup or domain of the computer, and any browser services running:
Node IpAddress: [10.1.10.3] Scope Id: []
NetBIOS Local Name Table
Name Type Status
--------------------------------------------------
PRO1 <00> UNIQUE Registered
PRO1 <03> UNIQUE Registered
PRO1 <20> UNIQUE Registered
COMPANY <00> GROUP Registered
COMPANY <1E> GROUP Registered
..__MSBROWSE__. <01> GROUP Registered - Nbtstat -r.
Lists the names in the name cache and how they were resolved. This is handy when you are trying to determine whether a computer used broadcasts or WINS to get an IP address:
NetBIOS Names Resolution and Registration Statistics
----------------------------------------------------
Resolved By Broadcast = 2
Resolved By Name Server = 5
Registered By Broadcast = 32
Registered By Name Server = 8
NetBIOS Names Resolved By Broadcast
---------------------------------------------
DC01 <00>
DC01 <00> - Nbtstat -R.
Purges the name cache and loads the preload (#PRE) items out of the Lmhosts file. See "Resolving NetBIOS Names Using Lmhosts" later in the chapter. - Nbtstat -S.
Displays the current sessions on the local machine showing the IP addresses of the connected machines. This is very useful when you want a quick display of the services that have active connections:
NetBIOS Connection Table
Local Name State In/Out Remote Host Input Output
------------------------------------------------------------------------
PRO1 <03> Listening
PRO1 Connected In 10.1.100.3 2KB 3KB
ADMINISTRATOR <03> Listening - Nbtstat -s.
Same as -S, but with the name of the connected machine rather than the IP address:
NetBIOS Connection Table
Local Name State In/Out Remote Host Input Output
------------------------------------------------------------------------
PRO1 <03> Listening
PRO1 Connected In SRV1 2KB 3KB
ADMINISTRATOR <03> Listening - Nbtstat -RR.
Releases the name registration in WINS and then reregisters. Introduced in NT4 SP4, this switch is extremely useful for correcting WINS errors. A bad record can be deleted manually from WINS, and then the client can be reregistered with this option.
If you discover during all this pinging and tracing and name cache scanning that everyone else in the area is working fine and only this machine is having problems, try opening the Network Connections window and checking the status of the connection icon. If it has a big X on it, the interface has lost communication with the network. Check the Event log to see whether there is some reason for the failure.
Registry Tip: Location of NetBIOS Cache Control KeysThe Registry key that contains the configuration parameters such as cache timeouts and broadcast counts is located in HKLM | System | CurrentControlSet | Services | NETBT. |
Netdiag
This utility does a comprehensive set of tests on just about every network function. The report is too long to read inside a console or to reproduce here. Pipe the output to a file for review.If you have a network problem that goes beyond a simple connectivity glitch, Netdiag is the first place to turn. It will either point right to the source of the trouble or give you a good set of clues to start troubleshooting. It may take a while to sort through the report, but the root cause should be buried in there somewhere.
Netsh
The Network Shell utility is the primary unified command-line management tool for all network interfaces and basic TCP/IP services with the exception of DNS. A new parameter in Windows Server 2003, called Diag, gives lots of good information about the state of each interface. The syntax for a full test is netsh> diag show test.
