Troubleshooting - Network

When you troubleshoot a TCP/IP networking problem, begin by checking the TCP/IP configuration on the computer that is experiencing the problem. You can use the ipconfig command to get host computer configuration information, including

• IP address
• subnet mask
• default gateway

When you use the ipconfig command with the /all option, a detailed configuration report is produced for all interfaces, including any configured serial ports. With ipconfig /all, you can redirect command output to a file and paste the output into other documents. You can also use this output to confirm the TCP/IP configuration of each computer on the network or to further investigate of TCP/IP network problems.

For example, if a computer is configured with an IP address that is a duplicate of an existing IP address, the subnet mask appears as 0.0.0.0.

The following example shows the output of the ipconfig /all command on a computer that is configured to use the DHCP server for automatic TCP/IP configuration, and WINS and DNS servers for name resolution.

If no problems appear in the TCP/IP configuration, the next step is testing the ability to connect to other host computers on the TCP/IP network.

If the computer that is experiencing the problem is DHCP-enabled and is using a DHCP server to obtain configuration, you can initiate a refresh of the lease by using the ipconfig /renew command.

When you use ipconfig /renew, all network adapters on the computer that uses DHCP (except those that are manually configured) try to contact a DHCP server and renew their existing configuration or obtain a new configuration.

You can also use the ipconfig command with the /release option to immediately release the current DHCP configuration for a host.

You can also use the ipconfig command to:

• immediately release the current DHCP configuration for a host ( /release)
• display the DNS cache (/displaydns)
• remove all entries from the DNS cache (/flushdns)
• refresh registered DNS names (/registerdns)
• display the DHCP class IDs for an adapter (/showclassid < adapter >)
• set the DHCP class IDs for an adapter (/setclassid < adapter > < classID to set >)

The ping command helps to verify IP-level connectivity. When troubleshooting, you can use ping to send an ICMP echo request to a target host name or IP address. Use ping whenever you need to verify that a host computer can connect to the TCP/IP network and network resources. You can also use ping to isolate network hardware problems and incompatible configurations.

It is usually best to verify that a route exists between the local computer and a network host by first using the ping command and the IP address of the network host to which you want to connect. Try pinging the IP address of the target host to see if it responds, as follows:

ping <IP_address>

You should perform the following steps when using ping:

1. Ping the loopback address to verify that TCP/IP is installed and configured correctly on the local computer.

   ping 127.0.0.1

2. Ping the IP address of the local computer to verify that it was added to the network correctly.

   ping <IP_address_of_local_host>

3. Ping the IP address of the default gateway to verify that the default gateway is functioning and that you can communicate with a local host on the local network.

   ping <IP_address_of_default_gateway>

4. Ping the IP address of a remote host to verify that you can communicate through a router.

   ping <IP_address_of_remote_host>

The ping command uses Windows Sockets-style name resolution to resolve a computer name to an IP address, so if pinging by address succeeds, but pinging by name fails, then the problem lies in address or name resolution, not network connectivity.

If you cannot use ping successfully at any point, confirm that:

• the computer was restarted after TCP/IP was installed and configured
• the IP address of the local computer is valid and appears correctly on the General tab of the Internet Protocol (TCP/IP) Properties dialog box
• IP routing is enabled and the link between routers is operational

You may find the following ping options particularly useful:

Switch	Specifies...
-l <size>	the size of packets to use
-n <count>	how many packets to send
-R	whether to record the route used
-i <TTL>	what Time-to-Live (TTL) value to use
-f	whether to set the "don't fragment" flag

For more detail on these (and other) options, type ping -?.

The following example illustrates how to send two pings, each 1,450 bytes in size, to IP address 192.168.0.1:

By default, ping waits 1,000 ms (1 second) for each response to be returned before displaying the Request Timed Out message. If the remote system being pinged is across a high-delay link, such as a satellite link, responses may take longer to be returned. You can use the -w <msecs> (wait) option to specify a longer time-out.

The Address Resolution Protocol (ARP) allows a host to find the media access control address of a host on the same physical network, given the IP address of the host. To make ARP efficient, each computer caches IP-to-media access control address mappings to eliminate repetitive ARP broadcast requests.

You can use the arp command to view and modify the ARP table entries on the local computer. The arp command is useful for viewing the ARP cache and resolving address resolution problems.

NetBIOS over TCP/IP (NetBT) resolves NetBIOS names to IP addresses. TCP/IP provides many options for NetBIOS name resolution, including

• local cache lookup
• WINS server query
• broadcast
• DNS server query
• Lmhosts and Hosts file lookup

nbtstat is a useful tool for troubleshooting NetBIOS name resolution problems. You can use the nbtstat command to remove or correct preloaded entries:

Switch	Action
-n	Displays the names that were registered locally on the system by programs such as the server and redirector
-c	Shows the NetBIOS name cache, which contains name-to-address mappings for other computers
-R	Purges the name cache and reloads it from the Lmhosts file
-RR	Releases NetBIOS names registered with a WINS server and then renews their registration
-a <name>	Performs a NetBIOS adapter status command against the computer specified by name. The adapter status command returns the local NetBIOS name table for that computer plus the media access control address of the adapter
-S	Lists the current NetBIOS sessions and their status, including statistics, as shown in the example below Show example NetBIOS connection table Local name State     In/out Remote Host    Input Output ----------------------------------------------------------------------------- CORP1                    <00>       Connected Out    CORPSUP1<20>   6MB   5MB CORP1                    <00>       Connected Out    CORPPRINT<20>  108KB 116KB CORP1                    <00>       Connected Out    CORPSRC1<20>   299KB 19KB CORP1                    <00>       Connected Out    CORPEMAIL1<20> 324KB 19KB CORP1                    <03>       Listening

You can use the netstat command to display protocol statistics and current TCP/IP connections:

Switch	Action
-a	Displays all connections Show example C:\>netstat -a Active Connections Proto Local Address     Foreign Address        State TCP   myhost:1572       192.168.0.2:nbsession  ESTABLISHED TCP   myhost:1589       192.168.0.2:nbsession  ESTABLISHED TCP   myhost:1606       192.168.0.10:nbsession ESTABLISHED TCP   myhost:1632       192.168.0.11:nbsession ESTABLISHED TCP   myhost:1659       192.168.0.12:nbsession ESTABLISHED TCP   myhost:1714       192.168.0.13:nbsession ESTABLISHED TCP   myhost:1719       192.168.0.14:nbsession ESTABLISHED TCP   myhost:1241       192.168.0.15:nbsession ESTABLISHED UDP   myhost:1025       *:* UDP   myhost:snmp       *:* UDP   myhost:nbname     *:* UDP   myhost:nbdatagram *:* UDP   myhost:nbname     *:* UDP   myhost:nbdatagram *:*
-r	Displays the route table plus active connections
-e	Displays Ethernet statistics Show example C:\>netstat -e Statistics          Received   Sent Bytes               3995837940 47224622 Unicast packets     120099     131015 Non-unicast packets 7579544    3823 Discards            0          0 Errors              0          0 Unknown protocols   363054211
-s	Displays per-protocol statistics Show example C:\>netstat -s IP Statistics Packets Received = 5378528 Received Header Errors = 738854 Received Address Errors = 23150 Datagrams Forwarded = 0 Unknown Protocols Received = 0 Received Packets Discarded = 0 Received Packets Delivered = 4616524 Output Requests = 132702 Routing Discards = 157 Discarded Output Packets = 0 Output Packet No Route = 0 Reassembly Required = 0 Reassembly Successful = 0 Reassembly Failures = 0 Datagrams Successfully Fragmented = 0 Datagrams Failing Fragmentation = 0 Fragments Created = 0 ICMP Statistics         Received Sent Messages                693      4 Errors                  0        0 Destination Unreachable 685      0 Time Exceeded           0        0 Parameter Problems      0        0 Source Quenches         0        0 Redirects               0        0 Echoes                  4        0 Echo Replies            0        4 Timestamps              0        0 Timestamp Replies       0        0 Address Masks           0        0 Address Mask Replies    0        0 TCP Statistics Active Opens = 597 Passive Opens = 135 Failed Connection Attempts = 107 Reset Connections = 91 Current Connections = 8 Segments Received = 106770 Segments Sent = 118431 Segments Retransmitted = 461 UDP Statistics Datagrams Received = 4157136 No Ports = 351928 Receive Errors = 2 Datagrams Sent = 13809
-n	Addresses and port numbers are not converted to names

tracert (Trace Route) is a route-tracing utility that is used to determine the path that an IP datagram takes to reach a destination. The tracert command uses the IP Time-to-Live (TTL) field and ICMP error messages to determine the route from one host to another through a network.

The pathping command is a route tracing tool that combines features of the ping and tracert commands with additional information that neither of those tools provides.

The pathping command sends packets to each router on the way to a final destination over a period of time, and then computes results based on the packets returned from each hop. Since the command shows the degree of packet loss at any given router or link, it is easy to determine which routers or links might be causing network problems.

The following switches are available:

Switch	Action
-n	Does not resolve addresses to host names.
-h <max_hops>	Maximum number of hops to search for target. Default is 30.
-g <host_list>	Loose source route along host list.
-p <period>	Number of milliseconds to wait between pings. Default is 250ms.
-q <num_queries>	Number of queries per hop. Default is 100.
-w <timeout>	Number of milliseconds to wait for each reply. Defaults to 3000ms (3 secs)
-T	Attaches a layer-2 priority tag (for example, for IEEE 802.1p) to the packets and sends it to each of the network devices in the path. This helps in identifying the network devices that do not have layer-2 priority configured properly. The -T switch is used to test for Quality of Service (QoS) connectivity.
-R	Checks to determine whether each router in the path supports the Resource Reservation Protocol (RSVP), which allows the host computer to reserve a certain amount of bandwidth for a data stream. The -R switch is used to test for Quality of Service (QoS) connectivity.

The following is a typical pathping report. The compiled statistics that follow the hop list indicate packet loss at each individual router.

When pathping is run, you first see the results for the route as it is tested for problems. This is the same path that is shown by the tracert command.

The pathping command then displays a busy message for the next 125 seconds (this time varies by the hop count). During this time, pathping gathers information from all the routers previously listed and from the links between them. At the end of this period, it displays the test results.

The two rightmost columns - This Node/Link Lost/Sent=Pct and Address - contain the most useful information. The link between gw-dit.grape-info.com (hop 2), and tpu-gw1.grape-info.com (hop 3) is dropping 13 percent of the packets. All other links are working normally. The routers at hops 3 and 4 also drop packets addressed to them (as shown in the This Node/Link column), but this loss does not affect their forwarding path.

The loss rates displayed for the links (marked as a | in the rightmost column) indicate losses of packets being forwarded along the path. This loss indicates link congestion. The loss rates displayed for routers (indicated by their IP addresses in the rightmost column) indicate that those routers' CPUs might be overloaded. These congested routers might also be a factor in end-to-end problems, especially if packets are forwarded by software routers.