WINDOWS 1002000 PROFESSIONAL RESOURCE KIT [Electronic resources] نسخه متنی

Networking Tools

Windows 2000 provides a large collection of networking client tools to optimize and troubleshoot network performance. Several of the most useful tools, shown in Table 31.21, are discussed in this section.

Table 31.21 Networking Troubleshooting Tools

NetDiag

NetDiag is a command-line, diagnostic tool that helps isolate networking and connectivity problems by performing a series of tests to determine the state of your network client and whether it is functional. These tests and the network status information they expose help network administrators and support personnel identify and isolate network problems. Moreover, because this tool does not require parameters or switches, you can focus on analyzing the output, rather than training users on tool usage.

NetDiag diagnoses network problems by checking all aspects of a client computer's network configuration and connections. Beyond troubleshooting TCP/IP issues, it also examines a client computer's Internet Packet Exchange (IPX) and NetWare configurations.

NetDiag is part of the Support Tools collection on the Windows 2000 operating system CD. For information about NetDiag, see Windows 2000 Support Tools Help. For information about installing and using the Windows 2000 Support Tools and Support Tools Help, see the file Sreadme.doc in the SupportTools folder of the Windows 2000 operating system CD.

Run NetDiag from a command prompt rather than from Windows Explorer to see the results upon completion of the tests. Because the results fill more than one normal command prompt screen, use the /l switch to log the results to the text file NetDiag.log. The tests take a few minutes to complete.

NetDiag Syntax

The command-line syntax for NetDiag is as follows:

netdiag [[/q|/v|/debug][/l][/d:DomainName][/fix][/dcaccountenum]
[/test:TestName|/skip:TestName]]

No switches or syntax need to be specified, but several are available, primarily to increase or decrease the level of detail in NetDiag reports. These switches are shown in the Table 31.22.

Table 31.22 NetDiag Switches

NetDiag prints the string [FATAL] when it detects a condition that needs to be fixed immediately. The string [WARNING] signals a failure condition that does not require immediate attention.

NetDiag Tests

Run NetDiag whenever a computer is having network problems. The tool tries to diagnose the problem and can even flag problem areas for closer inspection.

NetDiag examines DLL files, output from other tools, and the system registry to find potential problem spots. It checks which network services or functions are enabled and then runs the network configuration tests listed in Table 31.23, in the order presented.

NOTE

---

If the computer is not running one of the network troubleshooting tools listed in Table 31.23, that test is skipped and no results are displayed, not even an acknowledgement that the test was skipped.

Table 31.23 NetDiag Tests

IPConfig

IPConfig is a command-line tool that displays the current configuration of the installed IP stack on a networked computer using TCP/IP.

Run IPConfig from a command prompt rather than from Windows Explorer to see the resulting display.

IPConfig Syntax

The command-line syntax for IPConfig is as follows:

ipconfig [/?|/all|/release [adapter]|/renew [adapter] 
|/flushdns|/registerdns|/showclassid adapter 
|/setclassid adapter [classidtoset]]
adapter    Full name or pattern with '*' and '?' to 'match', * matches
any character, ? matches one character.
The default is to display only the IP address, subnet mask and default
gateway for each adapter bound to TCP/IP.
For /release and /renew, if no adapter name is specified, then the IP
address leases for all adapters bound to TCP/IP will be released or
renewed.
For SetClassID, if no class ID is specified, then the ClassID is
removed.

IPConfig Switches

Table 31.24 lists the IPConfig command-line switches.

Table 31.24 IPConfig Switches

CAUTION

---

It is recommended that only a network administrator or support personnel use many of the advanced features of IPConfig. Using these commands incorrectly can cause problems with the client system's connection to the server.

Run IPConfig to check the status of a computer's TCP/IP configuration. When used with the /all switch, it displays a detailed configuration report for all interfaces, including any configured WAN miniports (typically used for remote access or virtual private network [VPN] connections). The following is a sample report:

Windows 2000 IP Configuration
Host Name . . . . . . . . . . . . : TESTPC1
Primary Domain Name . . . . . . . : reskit.com
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : ntcorpdc1.reskit.com
dns.reskit.com
reskit.com
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix  . : dns.reskit.com
Description . . . . . . . . . . . : Acme XL 10/100Mb Ethernet NIC
Physical Address. . . . . . . . . : 00-CC-44-79-C3-AA
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 172.16.245.111
Subnet Mask . . . . . . . . . . . : 255.255.248.0
Default Gateway . . . . . . . . . : 172.16.240.1
DHCP Server . . . . . . . . . . . : 172.16.248.8
DNS Servers . . . . . . . . . . . : 172.16.55.85
172.16.55.134
172.16.55.54
Primary WINS Server . . . . . . . : 172.16.248.10
Secondary WINS Server . . . . . . : 172.16.248.9
Lease Obtained. . . . . . . . . . : Friday, March 05, 1999 2:21:40 PM
Lease Expires . . . . . . . . . . : Sunday, March 07, 1999 2:21:40 PM

NBTStat

NBTStat is a command-line tool for troubleshooting NetBIOS name over TCP/IP (NetBT) resolution problems. It displays protocol statistics and current TCP/IP connections using NetBT.

When a network is functioning normally, NetBT resolves NetBIOS names to IP addresses. It uses several options for NetBIOS name resolution, including local cache lookup, WINS server query, broadcast, Lmhosts lookup, Hosts lookup, and DNS server query.

Run NBTStat from a command prompt rather than from Windows Explorer to see the resulting display.

NBTStat Syntax

The command-line syntax for NBTStat is as follows:

nbtstat [-a RemoteName] [-A IP address] [-c] [-n]
[-r] [-R] [-RR] [-s] [-S] [interval]
RemoteName   Remote host machine NetBIOS name.
IP address   Dotted decimal representation of the IP address.
interval     Redisplays selected statistics, pausing interval seconds
between each display. Press Ctrl+C to stop redisplaying
statistics.

NBTStat Switches

NBTStat removes and corrects preloaded entries using case-sensitive switches as shown in Table 31.25.

Table 31.25 NBTStat Switches

NBTStat output is in the form of a table. For example, nbtstat -S lists the current NetBIOS sessions by IP address, including status, as in the following example:

Local Area Connection:
Node IpAddress: [172.16.0.142]  Scope Id: []
NetBIOS Connection Table
Local Name      State      In/Out   Remote Host     Input   Output
------------------------------------------------------------------
TESTPC1   <00>  Connected   Out     172.16.210.25     6MB      5MB
TESTPC1   <00>  Connected   Out     172.16.3.1      108KB    116KB
TESTPC1   <00>  Connected   Out     172.16.3.20     299KB     19KB
TESTPC1   <00>  Connected   Out     172.16.3.4      324KB     19KB
TESTPC1   <03>  Listening

The following example shows a sample NetBIOS name table for a client running Windows 2000 Professional on a Windows 2000 Server-based network, using the nbtstat -n command. This example shows the sixteenth byte for special names, plus the type of NetBIOS name (unique or group).

Local Area Connection:
Node IpAddress: [192.168.17.41] Scope Id: []
NetBIOS Local Name Table
Name               Type         Status
---------------------------------------------
WIN2KPROF      <00>  UNIQUE      Registered
NOAM           <00>  GROUP       Registered
WIN2KPROF      <03>  UNIQUE      Registered
WIN2KPROF      <20>  UNIQUE      Registered 
NOAM           <1E>  GROUP       Registered
USER1          <03>  UNIQUE      Registered 

In this example, the following NetBIOS special names are identified:

computer0x00 (shown as <00> in the example) indicates the computer name associated with the Workstation service.

domain0x00 indicates the domain to which this computer belongs.

computer0x03 indicates the computer name associated with the Messenger service.

computer0x20 indicates the computer name associated with the Server service.

domain0x1E indicates that this computer can serve as a backup browser in this domain.

username0x03 displays the user name of the account currently logged on to the computer.

Possible NetBIOS special names found in NBTStat are described in Table 31.26.

Table 31.26 Samples of NetBIOS Special Names

PathPing

PathPing is a command-line route tracing tool that combines features of the tools Ping and TraceRt with additional information that neither provides. PathPing sends packets to each router on the way to a final destination over a period of time, and then computes results based on the packets returned from each hop. Since PathPing shows the degree of packet loss at any specified router or link, you can pinpoint which routers or links might be causing network problems.

Run PathPing from a command prompt rather than from Windows Explorer to see the resulting display.

PathPing Syntax

The command-line syntax for PathPing is as follows:

pathping [-n] [-h maximum_hops] [-g host-list] [-p period]
[-q num_queries] [-w timeout] [-T] [-R] target_name

PathPing Switches

A number of switches are available, as shown in Table 31.27.

Table 31.27 PathPing Switches

PathPing Reports

The following is a sample PathPing report. Note that the compiled statistics that follow the hop list indicate packet loss at each router.

Tracing route to testpc1.dns.reskit.com [7.54.1.196]
over a maximum of 30 hops:
0  172.16.87.35
1  172.16.87.218
2  192.168.52.1
3  192.168.80.1
4  7.54.247.14
5  7.54.1.196
Computing statistics for 125 seconds…
Source to Here   This Node/Link
Hop  RTT    Lost/Sent = Pct  Lost/Sent = Pct  Address
0                                           172.16.87.35
0/ 100 =  0%   |
1   41ms     0/ 100 =  0%     0/ 100 =  0%  172.16.87.218
13/ 100 = 13%   |
2   22ms    16/ 100 = 16%     3/ 100 =  3%  192.168.52.1
0/ 100 =  0%   |
3   24ms    13/ 100 = 13%     0/ 100 =  0%  192.168.80.1
0/ 100 =  0%   |
4   21ms    14/ 100 = 14%     1/ 100 =  1%  7.54.247.14
0/ 100 =  0%   |
5   24ms    13/ 100 = 13%     0/ 100 =  0%  7.54.1.196
Trace complete.

When PathPing is run, the first results you see list the route as it is tested for problems. This is the same path shown by TraceRt. PathPing then displays a busy message while it gathers information from all the routers previously listed and the links between them. At the end of this period, it displays the test results.

The columns "This Node/Link Lost/Sent = Pct" and "Address" contain the most useful information. In the preceding sample report, the link between 172.16.87.218 (hop 1), and 192.168.52.1 (hop 2) is dropping 13 percent of the packets. All other links are working normally. The routers at hops 2 and 4 also drop packets addressed to them, but this loss does not affect their forwarding path.

The loss rates displayed for the links (marked as a "|" in the rightmost column) indicate losses of packets being forwarded along the path. This loss indicates link congestion. The loss rates displayed for routers (indicated by their IP addresses in the rightmost column) indicate that their CPUs or packet buffers might be overloaded. These congested routers might also be a factor in end-to-end problems, especially if packets are forwarded by software routers.

IP Security Monitor

The IP Security Monitor (IPSecMon) is a Windows-based tool used to confirm whether your secured, IP-based communications are successful by displaying the active security associations on local or remote computers.

For example, you can use IPSecMon to determine whether there has been a pattern of authentication or security association failures, possibly indicating incompatible security policy settings.

IPSecMon can be run locally or remotely if you have a network connection to the remote computer. From the Start menu, click Run, and then type:

ipsecmon <computer name>

An entry is displayed for each active security association, as shown in Figure 31.7. The information contained in each entry includes the name of the active IPSec policy, the active Filter Action and IP Filter List (including details of the active filter), and the tunnel endpoint (if one was specified in the active IPSec policy).

Figure 31.7 IP Security Monitor

Entry information can also provide statistics for tuning and troubleshooting, including the following:

The number and type of active security associations.

The total number of master and session keys (Main and Quick modes). Successful IPSec security associations initially cause one master key and one session key. Subsequent key regenerations are shown as additional session keys.

The total number of confidential (Encapsulating Security Payload or ESP) or authenticated (ESP or Authentication Header—AH) bytes sent or received.

NOTE

---

Because ESP provides authenticity and confidentiality, both counters are incremented.

The total number of soft associations.

The refresh rate is the only configurable option in IPSecMon. By default, the statistics update every 15 seconds and are accumulated with each communication that uses IPSec.

A Bad SPI (Security Parameters Index) error might occur if a key lifetime value is set too low, or if the security agent has expired but the sender continues to transmit data. To determine and correct the problem, run IPSecMon, and then examine the number of rekeys.

If the number of rekeys is very large compared to the amount of time the connections have been active, set the key lifetimes in the policy longer. Good values for high-traffic Ethernet connections are greater than 50 MB and longer than five minutes.

This is likely to significantly reduce bad SPIs.

For more information about IPSec, see "Internet Protocol Security" in the Microsoft® Windows® 2000 Server Resource Kit TCP/IP Core Networking Guide.