Lowe D. Networking For Dummies
Подождите немного. Документ загружается.
Book IV
Chapter 6
TCP/IP Tools and
Commands
377
Using the netdiag Utility
Using the netdiag Utility
netdiag is a powerful, network-testing utility that performs a variety of
network diagnostic tests that can help you to pinpoint a networking problem.
Listing 6-1 shows the output from a typical execution of the Netdiag
command. (I took the liberty of editing it somewhat to make it more compact.)
You can scan this listing to see the types of tests that the netdiag command
performs.
Unfortunately, the netdiag command is not available for Windows 9x
computers (including Windows Me), and it isn’t installed by default in
Windows XP or Vista. However, you can install it in Windows XP or Vista by
inserting your Windows installation disc in your computer’s optical drive.
If you’re asked to reinstall Windows, say no. Instead, choose to browse the
install CD. Navigate your way down to the \Support\Tools folder on the
install CD and then double-click the Setup.exe icon in the \Support\Tools
folder.
The netdiag command has several switches that let you control the output
generated by the command:
✦ /q: Lists only those tests that fail
✦ /v: Generates verbose output (even more verbose than usual)
✦ /debug: Generates extremely verbose output — way more than when
you use /v
✦ /l: Stores the output from the command in a file named NetDiag.log
✦ /fix: Attempts to fix DNS problems that are discovered
Listing 6-1: Output from the netdiag Command
...............................
Computer Name: DOUG
DNS Host Name: Doug
System info : Windows 2000 Professional (Build 2600)
Processor : x86 Family 15 Model 2 Stepping 4, GenuineIntel
List of installed hotfixes :
Q147222
Q308677
Q308678
Q310601
Q311889
Q315000
Netcard queries test . . . . . . . : Passed
Per interface results:
Adapter : Local Area Connection
Netcard queries test . . . : Passed
Host Name. . . . . . . . . : Doug
IP Address . . . . . . . . : 192.168.168.21
Subnet Mask. . . . . . . . : 255.255.255.0
(continued)
35_625873-bk04ch06.indd 37735_625873-bk04ch06.indd 377 9/21/10 10:31 PM9/21/10 10:31 PM
378
Using the netstat Command
Listing 6-1 (continued)
Default Gateway. . . . . . : 192.168.168.254
Dns Servers. . . . . . . . : 192.168.168.10
168.215.210.50
192.9.9.3
AutoConfiguration results. . . . . . : Passed
Default gateway test . . . : Passed
NetBT name test. . . . . . : Passed
WINS service test. . . . . : Skipped
There are no WINS servers configured for this interface.
Global results:
Domain membership test . . . . . . : Passed
Dns domain name is not specified.
Dns forest name is not specified.
NetBT transports test. . . . . . . : Passed
List of NetBt transports currently configured:
NetBT_Tcpip_{4A526104-BAEB-44F0-A2F6-A804FE31BBAA}
1 NetBt transport currently configured.
Autonet address test . . . . . . . : Passed
IP loopback ping test. . . . . . . : Passed
Default gateway test . . . . . . . : Passed
NetBT name test. . . . . . . . . . : Passed
Winsock test . . . . . . . . . . . : Passed
DNS test . . . . . . . . . . . . . : Passed
Redir and Browser test . . . . . . : Passed
List of NetBt transports currently bound to the Redir
NetBT_Tcpip_{4A526104-BAEB-44F0-A2F6-A804FE31BBAA}
The redir is bound to 1 NetBt transport.
List of NetBt transports currently bound to the browser
NetBT_Tcpip_{4A526104-BAEB-44F0-A2F6-A804FE31BBAA}
The browser is bound to 1 NetBt transport.
DC discovery test. . . . . . . . . : Skipped
DC list test . . . . . . . . . . . : Skipped
Trust relationship test. . . . . . : Skipped
Kerberos test. . . . . . . . . . . : Skipped
LDAP test. . . . . . . . . . . . . : Skipped
Bindings test. . . . . . . . . . . : Passed
WAN configuration test . . . . . . : Skipped
No active remote access connections.
Modem diagnostics test . . . . . . : Passed
IP Security test . . . . . . . . . : Passed
Service status is: Started
Service startup is: Automatic
IPSec service is available, but no policy is assigned or active
Note: run “ipseccmd /?” for more detailed information
The command completed successfully
Using the netstat Command
Using the Netstat command displays a variety of statistics about a
computer’s active TCP/IP connections. It’s a useful tool to use when you’re
having trouble with TCP/IP applications, such as File Transfer Protocol
(FTP), HyperText Transport Protocol (HTTP), and so on.
35_625873-bk04ch06.indd 37835_625873-bk04ch06.indd 378 9/21/10 10:31 PM9/21/10 10:31 PM
Book IV
Chapter 6
TCP/IP Tools and
Commands
379
Using the netstat Command
Displaying connections
If you run netstat without specifying any parameters, you get a list of
active connections, something like this:
C:\>netstat
Active Connections
Proto Local Address Foreign Address State
TCP Doug:1463 192.168.168.10:1053 ESTABLISHED
TCP Doug:1582 192.168.168.9:netbios-ssn ESTABLISHED
TCP Doug:3630 192.168.168.30:9100 SYN_SENT
TCP Doug:3716 192.168.168.10:4678 ESTABLISHED
TCP Doug:3940 192.168.168.10:netbios-ssn ESTABLISHED
C:\>
This list shows all the active connections on the computer and indicates the
local port used by the connection, as well as the IP address and port number
for the remote computer.
You can specify the -n switch to display both local and foreign addresses in
numeric IP form:
C:\>netstat -n
Active Connections
Proto Local Address Foreign Address State
TCP 192.168.168.21:1463 192.168.168.10:1053 ESTABLISHED
TCP 192.168.168.21:1582 192.168.168.9:139 ESTABLISHED
TCP 192.168.168.21:3658 192.168.168.30:9100 SYN_SENT
TCP 192.168.168.21:3716 192.168.168.10:4678 ESTABLISHED
TCP 192.168.168.21:3904 207.46.106.78:1863 ESTABLISHED
TCP 192.168.168.21:3940 192.168.168.10:139 ESTABLISHED
C:\>
Finally, you can specify the -a switch to display all TCP/IP connections and
ports that are being listened to. I won’t list the output from that command
here because it would run several pages, and I want to do my part for the
rainforests. Suffice it to say that it looks a lot like the netstat output shown
previously, but a lot longer.
Displaying interface statistics
If you use an -e switch, netstat displays various protocol statistics, like
this:
C:\>netstat -e
Interface Statistics
Received Sent
Bytes 672932849 417963911
Unicast packets 1981755 1972374
Non-unicast packets 251869 34585
Discards 0 0
Errors 0 0
Unknown protocols 1829
C:\>
35_625873-bk04ch06.indd 37935_625873-bk04ch06.indd 379 9/21/10 10:31 PM9/21/10 10:31 PM
380
Using the netstat Command
The items to pay attention to in this output are the Discards and Errors.
These numbers should be zero, or at least close to it. If they’re not, the
network may be carrying too much traffic or the connection may have a
physical problem. If no physical problem exists with the connection, try
segmenting the network to see whether the error and discard rates drop.
You can display additional statistics by using an -s switch, like this:
C:\>netstat -s
IPv4 Statistics
Packets Received = 9155
Received Header Errors = 0
Received Address Errors = 0
Datagrams Forwarded = 0
Unknown Protocols Received = 0
Received Packets Discarded = 0
Received Packets Delivered = 14944
Output Requests = 12677
Routing Discards = 0
Discarded Output Packets = 71
Output Packet No Route = 0
Reassembly Required = 0
Reassembly Successful = 0
Reassembly Failures = 0
Datagrams Successfully Fragmented = 0
Datagrams Failing Fragmentation = 0
Fragments Created = 0
IPv6 Statistics
Packets Received = 3
Received Header Errors = 0
Received Address Errors = 0
Datagrams Forwarded = 0
Unknown Protocols Received = 0
Received Packets Discarded = 0
Received Packets Delivered = 345
Output Requests = 377
Routing Discards = 0
Discarded Output Packets = 0
Output Packet No Route = 0
Reassembly Required = 0
Reassembly Successful = 0
Reassembly Failures = 0
Datagrams Successfully Fragmented = 0
Datagrams Failing Fragmentation = 0
Fragments Created = 0
ICMPv4 Statistics
35_625873-bk04ch06.indd 38035_625873-bk04ch06.indd 380 9/21/10 10:31 PM9/21/10 10:31 PM
Book IV
Chapter 6
TCP/IP Tools and
Commands
381
Using the netstat Command
Received Sent
Messages 6 14
Errors 0 0
Destination Unreachable 6 14
Time Exceeded 0 0
Parameter Problems 0 0
Source Quenches 0 0
Redirects 0 0
Echo Replies 0 0
Echos 0 0
Timestamps 0 0
Timestamp Replies 0 0
Address Masks 0 0
Address Mask Replies 0 0
Router Solicitations 0 0
Router Advertisements 0 0
ICMPv6 Statistics
Received Sent
Messages 3 7
Errors 0 0
Destination Unreachable 0 0
Packet Too Big 0 0
Time Exceeded 0 0
Parameter Problems 0 0
Echos 0 0
Echo Replies 0 0
MLD Queries 0 0
MLD Reports 0 0
MLD Dones 0 0
Router Solicitations 0 6
Router Advertisements 3 0
Neighbor Solicitations 0 1
Neighbor Advertisements 0 0
Redirects 0 0
Router Renumberings 0 0
TCP Statistics for IPv4
Active Opens = 527
Passive Opens = 2
Failed Connection Attempts = 1
Reset Connections = 301
Current Connections = 1
Segments Received = 8101
Segments Sent = 6331
Segments Retransmitted = 301
TCP Statistics for IPv6
Active Opens = 1
Passive Opens = 1
35_625873-bk04ch06.indd 38135_625873-bk04ch06.indd 381 9/21/10 10:31 PM9/21/10 10:31 PM
382
Using the nslookup Command
Failed Connection Attempts = 0
Reset Connections = 1
Current Connections = 0
Segments Received = 142
Segments Sent = 142
Segments Retransmitted = 0
UDP Statistics for IPv4
Datagrams Received = 6703
No Ports = 0
Receive Errors = 0
Datagrams Sent = 6011
UDP Statistics for IPv6
Datagrams Received = 32
No Ports = 0
Receive Errors = 0
Datagrams Sent = 200
C:\>
Using the nslookup Command
The nslookup command is a powerful tool for diagnosing DNS problems.
You know you’re experiencing a DNS problem when you can access a
resource by specifying its IP address but not its DNS name. For example, if
you can get to www.ebay.com by typing 66.135.192.87 in your browser’s
address bar but not by typing www.ebay.com, you have a DNS problem.
Looking up an IP address
The simplest use of nslookup is to look up the IP address for a given DNS
name. For example, how did I know that 66.135.192.87 was the IP address
for ebay.com? I used nslookup to find out:
C:\>nslookup ebay.com
Server: ns1.orng.twtelecom.net
Address: 168.215.210.50
Non-authoritative answer:
Name: ebay.com
Address: 66.135.192.87
C:\>
As you can see, just type nslookup followed by the DNS name you want to
look up. Nslookup issues a DNS query to find out. This DNS query was sent
to the server named ns1.orng.twtelecom.net at 168.215.210.50. It
then displayed the IP address that’s associated with ebay.com: namely,
66.135.192.87.
35_625873-bk04ch06.indd 38235_625873-bk04ch06.indd 382 9/21/10 10:31 PM9/21/10 10:31 PM
Book IV
Chapter 6
TCP/IP Tools and
Commands
383
Using the nslookup Command
In some cases, you may find that using an nslookup command gives you the
wrong IP address for a host name. To know that for sure, of course, you have
to know with certainty what the host IP address should be. For example, if
you know that your server is 203.172.182.10 but Nslookup returns a
completely different IP address for your server when you query the server’s
host name, something is probably wrong with one of the DNS records.
Using nslookup subcommands
If you use nslookup without any arguments, the nslookup command
enters a subcommand mode. It displays a prompt character (>) to let you
know that you’re in nslookup subcommand mode rather than at a normal
Windows command prompt. In subcommand mode, you can enter various
subcommands to set options or to perform queries. You can type a question
mark (?) to get a list of these commands. Table 6-2 lists the subcommands
you’ll use most.
Table 6-2 The Most Commonly Used nslookup Subcommands
Subcommand What It Does
name
Queries the current name server for the specified name.
server name
Sets the current name server to the server you specify.
root
Sets the root server as the current server.
(continued)
One of my pet peeves is that it seems as if every
program that uses subcommands chooses a
different command to quit the application. I
can never remember whether the command
to get out of nslookup is quit, bye, or
exit. I usually end up trying them all. And no
matter what program I’m using, I always seem
to choose the one that works for some other
program first. When I’m in nslookup, I
use bye first. When I’m in FTP, I try exit
first. Arghh! If I were King of the Computer
Hill, every program that had subcommands
would respond to the following commands by
exiting the program and returning to a
command prompt:
Quit Sayonara
Exit Ciao
Bye Mañana
Leave Makelikeatree
Of course, the final command to try would be
Andgetouttahere (in honor of Biff from
the Back to the Future movies).
Get me out of here!
35_625873-bk04ch06.indd 38335_625873-bk04ch06.indd 383 9/21/10 10:31 PM9/21/10 10:31 PM
384
Using the nslookup Command
Table 6-2 (continued)
Subcommand What It Does
set type=x Specifies the type of records to be displayed, such as A,
CNAME, MX, NS, PTR, or SOA. Specify ANY to display all
records.
set debug
Turns on Debug mode, which displays detailed information
about each query.
set nodebug
Turns off Debug mode.
set recurse
Enables recursive searches.
set norecurse
Disables recursive searches.
exit Exits the nslookup program and returns you to a
command prompt.
Displaying DNS records
One of the main uses of nslookup is to examine your DNS configuration to
make sure that it’s set up properly. To do that, follow these steps:
1. At a command prompt, type nslookup without any parameters.
nslookup displays the name of the default name server and displays
the > prompt.
C:\>nslookup
Default Server: ns1.orng.twtelecom.net
Address: 168.215.210.50
>
2. Type the subcommand set type=any.
nslookup silently obeys your command and displays another prompt:
> set type=any
>
3. Type your domain name.
nslookup responds by displaying the name servers for your domain:
> lowewriter.com
Server: ns1.orng.twtelecom.net
Address: 168.215.210.50
Non-authoritative answer:
lowewriter.com nameserver = NS000.NS0.com
lowewriter.com nameserver = NS207.PAIR.com
lowewriter.com nameserver = NS000.NS0.com
lowewriter.com nameserver = NS207.PAIR.com
>
35_625873-bk04ch06.indd 38435_625873-bk04ch06.indd 384 9/21/10 10:31 PM9/21/10 10:31 PM
Book IV
Chapter 6
TCP/IP Tools and
Commands
385
Using the nslookup Command
4. Use a server command to switch to one of the domain’s name servers.
For example, to switch to the first name server listed in Step 3, type
server NS000.NS0.com. nslookup replies with a message that indicates
the new default server:
> server ns000.ns0.com
Default Server: ns000.ns0.com
Address: 216.92.61.61
>
5. Type your domain name again.
This time, nslookup responds by displaying the DNS information for
your domain:
> lowewriter.com
Server: ns000.ns0.com
Address: 216.92.61.61
lowewriter.com
primary name server = ns207.pair.com
responsible mail addr = root.pair.com
serial = 2001121009
refresh = 3600 (1 hour)
retry = 300 (5 mins)
expire = 604800 (7 days)
default TTL = 3600 (1 hour)
lowewriter.com nameserver = ns000.ns0.com
lowewriter.com nameserver = ns207.pair.com
lowewriter.com MX preference = 50, mail exchanger =
sasi.pair.com
lowewriter.com internet address = 209.68.34.15
>
6. Type exit to leave the Nslookup program.
You return to a command prompt.
> exit
C:\>
Wasn’t that fun?
Locating the mail server for an e-mail address
If you’re having trouble delivering mail to someone, you can use nslookup
to determine the IP address of the user’s mail server. Then, you can use the
ping command to see whether you can contact the user’s mail server. If not,
you can use the tracert command to find out where the communication
breaks down.
To find a user’s mail server, start nslookup and enter the command set
type=MX. Then, enter the domain portion of the user’s e-mail address.
For example, if the user’s address is Doug@LoweWriter.com, enter
35_625873-bk04ch06.indd 38535_625873-bk04ch06.indd 385 9/21/10 10:31 PM9/21/10 10:31 PM
386
Using the nslookup Command
LoweWriter.com. nslookup will display the MX (Mail eXchanger) information
for the domain, like this:
C:\>nslookup
Default Server: ns7.attbi.com
Address: 204.127.198.19
> set type=mx
> lowewriter.com
Server: ns7.attbi.com
Address: 204.127.198.19
lowewriter.com MX preference = 50, mail exchanger = sasi.pair.com
lowewriter.com nameserver = ns000.ns0.com
lowewriter.com nameserver = ns207.pair.com
ns000.ns0.com internet address = 216.92.61.61
ns207.pair.com internet address = 209.68.2.52
>
Here, you can see that the name of the mail server for the LoweWriter.com
domain is sasi.pair.com.
Taking a ride through DNS-Land
Ever find yourself wondering how DNS really works? I mean, how is it that
you can type a DNS name like www.disneyland.com into a Web browser
and you’re almost instantly transported to the Magic Kingdom? Is it really
magic?
Nope. It isn’t magic; it’s DNS. In Book IV, Chapter 4, I present a somewhat dry
and theoretical overview of DNS. After you have the nslookup command in
your trusty TCP/IP toolbox, take a little trip through the Internet’s maze of
DNS servers to find out how DNS gets from www.disneyland.com to an IP
address in just a matter of milliseconds.
DNS does its whole name resolution thing so fast, it’s easy to take it for granted.
If you follow this little procedure, you’ll gain a deeper appreciation for what DNS
does literally tens of thousands of times every second of every day.
1. At a command prompt, type nslookup without any parameters.
nslookup displays the name of the default name server and displays
the > prompt.
C:\>nslookup
Default Server: ns1.orng.twtelecom.net
Address: 168.215.210.50
>
2. Type root to switch to one of the Internet’s root servers.
nslookup switches to one of the Internet’s 13 root servers and then
displays the > prompt.
> root
Default Server: A.ROOT-SERVERS.NET
Address: 198.41.0.4
35_625873-bk04ch06.indd 38635_625873-bk04ch06.indd 386 9/21/10 10:31 PM9/21/10 10:31 PM