
HANDS-ON ACTIVITY 5A 191
Figure 5.19, you can see the ping of another computer
my subnet (192.168.1.152) and then see the ARP table
with this new entry. When I pinged 192.168.1.152, my
computer had to find its physical address, so it issued an
ARP request and 192.168.1.152 responded with an ARP
response, which my computer added into the ARP table
before sending the ping.
Deliverables
1. Type ARP-A at the command prompt. What are
the entries in your ARP table?
2. Suppose, that there are no entries in your ARP
table. Is this a problem? Why or why not?
NSLOOKUP: Finding IP Addresses
Remember that in order to send a message to other com-
puters on the Internet, you must know their IP addresses.
Computers use DNS servers to find IP addresses. You can
issue a DNS request by using the NSLOOKUP command.
Type NSLOOKUP and the URL of a computer on the
Internet and press enter. In Figure 5.20, you’ll see that
www.cnn.com has several IP addresses and is also known
as cnn.com
Deliverable
Find the IP address of google.com and of another website
of your choice.
DNS Cache
The IPCONFIG/DISPLAYDNS command can be used to
show the contents of the DNS cache. You can experiment
with this by displaying the cache, visiting a new Web site
with your browser, and then displaying the cache again.
Figure 5.21 shows part of the cache on my computer after
visiting a number of sites. The DNS cache contains infor-
mation about all the Web sites I’ve visited, either directly
or indirectly (by having a Web page on one server pull a
graphics file off of a different server).
C:\Documents and Settings\Administrator>nslookup www.cnn.com
Server: ns1.insightbb.com
Address: 63.240.76.135
Non-authoritative answer:
Name: cnn.com
Addresses: 64.236.16.116, 64.236.24.12, 64.236.24.20, 64.236.24.28
64.236.29.120, 64.236.16.20, 64.236.16.52, 64.236.16.84
Aliases: www.cnn.com
FIGURE 5.20 NSLOOKUP command
For example, the second entry in this figure is ns1.
cisco.com, which has an IP address of 128.107.241.185
(a 4-byte long address). The record type is one, which
means this is a “host”—that is, a computer on the Internet
using IPv4. Because the DNS information might change,
all entries have a maximum time to live set by the DNS
that provides the information (usually 24 hours); the time
to live value is the time in seconds that this entry will
remain in the cache until it is removed.
The very last entry in this figure is for ns1.v6.
telekom.at. The record type of 28 means that this is a
host that uses IPv6, which you can see from the 16-byte
long address in the record (2001:890:600:d1: :100).
Deliverables
1. Display your DNS cache using the command
ipconfig /displaydns.
2. How many entries are there in your cache?
3. Open your browser and visit www.ietf.com. Once
the page loads, display your DNS cache again.
Copy the DNS entry entry for this website.
TRACERT: Finding Routes through
the Internet
The TRACERT command will show you the IP addresses
of computers in the route from your computer to another
computer on the Internet. Many networks have disabled
TRACERT for security reasons, so it doesn’t always work.
Type TRACERT and the URL of a computer on the Inter-
net and press enter. In Figure 5.22, you’ll see the route
from my computer, through the Insight network, through
the AT&T network, through the Level 3 network, and then
through the Google network until it reaches the server.
TRACERT usually sends three packets, so beside each
hop is the total time to reach that hop for each of the
three packets. You’ll see that it took just over 50 ms for a
packet to go from my computer to Google. You’ll also see
that the times aren’t always “right,” in that the first packet