Chapter 3, Implementing TCP/IP

 

Chapter 3, Lesson 1

Installing and Configuring TCP/IP

       1.    Introduction

|1|               A.      Windows 2000, like all the current Windows operating systems, provides support for the TCP/IP protocol suite through the TCP/IP client.

1.      You install the TCP/IP client from the Windows Control Panel.

                           2.       The TCP/IP client provides support for all the basic protocols needed to transmit data across the network, including

                                     a.      Internet Protocol (IP)

                                     b.      Transmission Control Protocol (TCP)

                                     c.       User Datagram Protocol (UDP)

|2|                        3.       The TCP/IP client also provides support for ancillary protocols, including

                                     a.      Internet Control Message Protocol (ICMP)

                                     b.      Address Resolution Protocol (ARP)

                                     c.       Dynamic Host Configuration Protocol (DHCP) client

                                     d.      Domain Name System (DNS) client

                                     e.      Windows Internet Name Service (WINS) client

                  B.      TCP/IP is the default protocol suite in Windows 2000.

|3|               C.      If the operating system’s Setup program detects a network interface adapter in the computer, the following happens:

                           1.       Plug and Play identifies the adapter.

                           2.       The system installs the appropriate network adapter driver.

                           3.       The system installs the following networking components:

                                     a.      Internet Protocol (TCP/IP)

                                     b.      Client for Microsoft Networks

                                     c.       File and Printer Sharing for Microsoft Networks

       2.    Installing TCP/IP

                  A.      To manually install the TCP/IP protocols, complete the following steps:

                           1.       In the Start menu’s Settings group, select Network And Dial-Up Connections to display the Network And Dial-Up Connections window.

                           2.       Right-click the Local Area Connection icon in the Network And Dial-Up Connections window, and then select Properties from the shortcut menu to display the Local Area Connection Properties dialog box.

                                     a.      If the Network And Dial-Up Connections window does not have a Local Area Connection icon in it, your computer does not have a network adapter driver installed.

                                              (1)     Use the Add/Remove Hardware window, accessed from Control Panel, to install the appropriate driver for your network adapter.

                           3.       In the Local Area Connection Properties dialog box, click Install to display the Select Network Component Type dialog box.

                           4.       In the component list, select Protocol, and then click Add to display the Select Network Protocol dialog box.

                           5.       In the protocol listing, select Internet Protocol (TCP/IP) and then click OK.

                                     a.      This adds the protocol module to the component list in the Local Area Connection Properties dialog box.

                           6.       Click Close to install the TCP/IP protocols, bind them to the client and network adapter driver already installed on the computer, and copy the TCP/IP utilities to the \Winnt\System32 folder.

                                     a.      You might have to insert the Microsoft Windows 2000 Server CD-ROM (this is called the Windows 2000 distribution CD-ROM in the textbook) into the drive so the operating system can copy essential files to the computer.

                           7.       After the installation procedure is completed, reboot the computer to activate the newly installed protocols.

       3.    Configuring TCP/IP

                  A.      By default, Windows 2000, like the other Windows operating systems, configures the TCP/IP client to use its DHCP client capabilities to request configuration settings from a DHCP server on the network.

                           1.       If no DHCP server is available, someone has to configure the TCP/IP client manually.

                  B.      You configure the Windows 2000 TCP/IP client in the Local Area Connection Properties dialog box, which you also used to install the TCP/IP protocols.

                           1.       Before you use the following TCP/IP configuration procedure on a live network, be sure that the values supplied for the TCP/IP parameters, particularly the IP address, are correct for the specific computer and your network. When incorrectly set, some TCP/IP parameters can prevent your computer from communicating with the network or cause conflicts with other computers on the network, preventing them from functioning properly.

                  C.      Configuring basic TCP/IP client properties

                           1.       In the Start menu’s Settings group, select Network And Dial-Up Connections to display the Network And Dial-Up Connections window.

                           2.       Right-click the Local Area Connection icon in the Network And Dial-Up Connections window, and then select Properties from the shortcut menu to display the Local Area Connection Properties dialog box.

                           3.       Select the Internet Protocol (TCP/IP) module in the components list, and then click Properties to display the Internet Protocol (TCP/IP) Properties dialog box.

                           4.       Select the Use The Following IP Address option to activate the IP Address, Subnet Mask, and Default Gateway text boxes, which provide the client’s manual configuration capability.

                                     a.      Although its label does not indicate this, it is the Obtain An IP Address Automatically option that activates the DHCP client.

                           5.       In the IP text box, enter a valid IP address, using the standard dotted decimal notation.

                                     a.      The address must be unique on the network and it must conform to the subnet configuration used on your network.

                                     b.      If you do not know anything about the addresses used on your network, ask an administrator to give you an IP address you can use.

                                              (1)     Do not select an IP address at random or change the last number of the address used by the computer next to yours.

                                     c.       The IP address and the subnet mask are the only two TCP/IP configuration parameters that are required for the computer to communicate with the local area network (LAN).

                                              (1)     Other parameters are required for convenience or for certain types of communication.

                           6.       In the Subnet Mask text box, type an appropriate mask for the IP address you supplied.

                                     a.      Windows 2000 supplies a subnet mask based on the first-byte value of your IP address.

                                              (1)     If your network is subnetted, the subnet mask value supplied by Windows 2000 might not be correct.

                                     b.      Windows 2000 determines its value for the Subnet Mask text box by examining the first three bits of the 32-bit IP address you have supplied.

                                              (1)     If the first bit of the address is 0, Windows 2000 supplies the subnet mask for a Class A address (255.0.0.0).
                                              (2)     If the first two bits are 10, Windows assumes the use of a Class B address and supplies a subnet mask of 255.255.0.0.
                                              (3)     If the first three bits are 110, Windows supplies the subnet mask for a Class C address (255.255.255.0).

                           7.       The Default Gateway text box should contain the IP address of the router on the local network that the computer will use to send TCP/IP traffic to destinations on other networks.

                                     a.      On a private internetwork, the default gateway is a router that provides access to the other networks.

                                     b.      On a stand-alone LAN connected to the Internet, the default gateway refers to the system that provides the shared Internet connection.

                                     c.       If the computer is connected to a LAN that is not part of an internetwork and is not connected to the Internet, leave this text box blank.

                                     d.      The address that you type into the Default Gateway text box becomes an entry in the computer’s routing table with a Network Destination value of 0.0.0.0.

                                              (1)     You can also create, delete, or modify the default gateway (or any other routing table entry) manually, using the Route.exe utility.

                           8.       When you selected the Use The Following IP Address option in the Internet Protocol (TCP/IP) Properties dialog box (in step 4 of this procedure), Windows 2000 deactivated the DHCP client completely, and, as a result, the Obtain DNS Server Address Automatically option became unavailable. Configure for DNS service as follows:

                                     a.      In the Preferred DNS Server and Alternate DNS Server text boxes, type the IP addresses of the DNS servers that your computer will use to resolve DNS names into IP addresses.

                                              (1)     The TCP/IP client uses the Alternate DNS Server address only if the primary DNS server is unreachable.
                                              (2)     If your network is connected to the Internet, you must supply at least one DNS server address to convert the DNS names in your URLs into IP addresses.
                                              (3)     If your computer is part of a Windows 2000 Active Directory domain, you need to supply the address of a Windows 2000 DNS server or a DNS server that is hosting the zone file for the Active Directory service on your internetwork.
                                              (4)     If you are not using Active Directory, the DNS server can be on either your internetwork or that of your Internet service provider (ISP).

                           9.       Click OK to close the Internet Protocol (TCP/IP) Properties dialog box, and click OK again to close the Local Area Connection Properties dialog box.

                  D.      Configuring advanced TCP/IP properties

                           1.       In many cases, a Windows 2000 system needs only the TCP/IP parameters that were configured in the preceding procedure (section C above).

                                     a.      However, the Internet Protocol (TCP/IP) Properties dialog box also has an Advanced button that provides access to the Advanced TCP/IP Settings dialog box, in which you can configure a more complete set of TCP/IP parameters.

|4|                        2.       The IP Settings tab

                                     a.      The IP Settings tab of the Advanced TCP/IP Settings dialog box enables you to specify multiple IP addresses and subnet masks for the network interface adapter in your computer, as well as multiple default gateway addresses.

                                     b.      Most computers with multiple IP addresses have multiple network interface adapters as well, using one address per network interface adapter.

                                     c.       There are situations in which a computer might need more than one IP address for a single network interface adapter, such as when a single physical network hosts multiple TCP/IP subnets.

                                              (1)     In such cases, a computer needs an IP address on each of the two subnets to participate on both.

                                     d.      When you open the Advanced TCP/IP Settings dialog box, the parameters you have already configured elsewhere in the Internet Protocol (TCP/IP) Properties dialog box appear in the listings.

                                              (1)     You can add to the existing settings, modify them, or delete them altogether.

                                     e.      To add a new IP address and subnet mask, click Add, type the desired address and mask values in the TCP/IP Address dialog box, and then click Add to add your entries to the IP Addresses list.

                                              (1)     Windows 2000 supports an unlimited number of IP address/subnet mask combinations for each network interface adapter in the computer.

                                     f.       The procedure for creating additional default gateways is the same as that for adding IP addresses.

                                              (1)     A computer can use only one default gateway at a time, so the ability to specify multiple default gateways in the Advanced TCP/IP Settings dialog box is simply a fault-tolerance mechanism.
                                              (2)     If the first default gateway in the list is unavailable for any reason, Windows 2000 sends packets to the second address listed.
                                                        (a)      This practice assumes that the computer is connected to a LAN that has multiple routers on it, each of which provides access to the rest of the internetwork.

|5|                        3.       The DNS tab

                                     a.      The DNS tab of the Advanced TCP/IP Settings dialog box also provides a fault-tolerance mechanism for the Windows 2000 DNS client.

                                     b.      You can specify more than the two DNS server addresses provided in the main Internet Protocol (TCP/IP) Properties dialog box, and you can modify the order in which the computer uses them if one or more of the servers are unavailable.

                                              (1)     Unlike the IP address, subnet mask, and default gateway settings, which apply only to a specific network interface adapter, the DNS server addresses apply to the entire Windows 2000 TCP/IP client.
                                                        (a)      You cannot specify different DNS server addresses for each network interface adapter.

                                     c.       The other controls in the DNS tab specify how the TCP/IP client resolves unqualified names.

                                              (1)     An unqualified name is an incomplete DNS name that does not indicate the domain in which the host resides.
                                              (2)     The Windows 2000 TCP/IP client can still resolve these names by appending a suffix to the unqualified name before sending it to the DNS server for resolution.
                                                        (a)      For example, with a properly configured TCP/IP client, you can supply only the name www as a URL in your Web browser, and the client appends your company’s domain name (for example, adatum.com) to the URL.
                                                        (b)      Appending the suffix results in the fully qualified DNS name www.adatum.com, which is presumably the name of your network’s intranet Web server.

                                     d.      The DNS controls enable you to configure the client to append the primary and connection-specific DNS suffixes to unqualified names, or to create a list of suffixes that the client will append to unqualified names, one after the other, until the name resolution process succeeds.

                                              (1)     The primary DNS suffix is the domain name you specify for the computer in the Network Identification tab of the System dialog box, accessed from Control Panel.
                                                        (a)      This suffix applies to all the computer’s network interface adapters.
                                              (2)     You can create a connection-specific suffix by typing a domain name in the DNS Suffix For This Connection text box in the DNS tab.
                                              (3)     To add an entry to the list of suffixes, select the Append These DNS Suffixes (In Order) option, click Add, type the suffix you want to add to the list, and then click Add.

                                     e.      The two check boxes at the bottom of the DNS tab enable you to specify whether the computer should register its DNS name with its designated DNS server.

                                              (1)     This option requires a DNS server that supports dynamic updates, such as the DNS Server service supplied with Microsoft Windows 2000 Server.
                                              (2)     The Register This Connection’s Addresses In DNS check box causes Windows 2000 to use the system’s primary DNS suffix to register the addresses.
                                              (3)     The Use This Connection’s DNS Suffix In DNS Registration check box causes the computer to use the connection-specific suffix you entered in the DNS Suffix For This Connection text box.

|6|                        4.       The WINS tab

                                     a.      Windows 2000 includes a WINS client for Network Basic Input/Output System (NetBIOS) name resolution.

                                              (1)     On a Windows 2000 network that uses Active Directory, WINS is not needed because Active Directory uses DNS names for the computers on the network and relies on DNS for its name resolution services.
                                              (2)     If the computers that run Windows 2000 are members of Windows NT domains or do not use a directory service at all, you can use the WINS tab in the Advanced TCP/IP Settings dialog box to configure the TCP/IP client to use WINS.

                                     b.      In the WINS tab, click Add to open the TCP/IP WINS Server dialog box, where you can specify the address of a WINS server on your network.

                                              (1)     You can create a list of WINS servers and specify the order in which Windows 2000 should use them.
                                              (2)     Supplying multiple WINS server addresses is a fault-tolerance feature.

                                     c.       Lmhosts

                                              (1)     The Enable Lmhosts Lookup check box forces the computer to use a file called Lmhosts to resolve NetBIOS names before contacting the designated WINS server.
                                              (2)     Lmhosts is a text file located in the %systemroot%\System32 \Drivers\Etc folder on the computer’s system drive, which contains a list of NetBIOS names and their equivalent IP addresses.
                                              (3)     Lmhosts functions in much the same way as the Hosts file, which was used for host name resolution before the advent of DNS.
                                              (4)     Because each computer must have its own Lmhosts file, Windows 2000 enables you to import a file from a network drive to the local computer.
                                                        (a)      To do this, click Import Lmhosts and browse for the desired file.

                                     d.      You can use the options at the bottom of the WINS tab to specify whether the computer should or should not use NetBIOS over TCP/IP or whether the computer should rely on a DHCP server to specify the NetBIOS setting.

                                              (1)     On an all–Windows 2000 network that uses Active Directory, you can disable NetBIOS over TCP/IP because the computers use DNS names instead of NetBIOS names.

                           5.       The Options tab

                                     a.      The Options tab of the Advanced TCP/IP Settings dialog box contains a list of additional features included with the TCP/IP client.

                                     b.      You can select any item in the list and click Properties to open a dialog box that enables you to configure that option.

                                     c.       Windows 2000 includes two TCP/IP options:

                                              (1)     IP Security
                                              (2)     TCP/IP Filtering

Chapter 3, Lesson 2

Using the Windows 2000 TCP/IP Tools

       1.    Introduction

                  A.      Virtually every operating system with networking capabilities includes support for the TCP/IP protocols.

                  B.      In most cases, the TCP/IP implementation also includes an assortment of programs that enable you to gather information about the various protocols and the network.

                  C.      Traditionally, these programs are run from the command line, although graphical versions are sometimes supplied.

                           1.       In many cases, a program uses the same syntax, even on different operating systems.

|7|     2.    Ping

                  A.      The Ping program is the most basic TCP/IP utility.

                           1.       Virtually every TCP/IP implementation includes a version of the Ping program.

                                     a.      On UNIX systems, the program is called ping.

                                     b.      On Windows systems, the tool is called Ping.exe.

                                     c.       Novell NetWare includes a server-based version called Ping.nlm.

                  B.      The Ping program can tell you if the TCP/IP stack of another system on the network is functioning normally.

                           1.       The Ping program generates a series of Echo Request messages, using ICMP, and transmits them to the computer whose name or IP address you specify on the command line.

                           2.       The basic syntax of Ping.exe is as follows: ping target

                                     a.      The target variable contains the IP address or name of a computer on the network.

                                     b.      You can use either DNS names or NetBIOS names in ping commands.

                                     c.       The program resolves the name into an IP address before sending the Echo Request messages, and it then displays the address in its readout.

                           3.       Most implementations of the Ping program also have command-line switches that enable you to modify the operational parameters of the program, such as the number of Echo Request messages it generates and the amount of data in each message.

|8, 9, 10|        C.      The full syntax for the Windows 2000 Ping.exe program is shown on Slides 8, 9, and 10 and in the textbook on page 93.

                           1.       Loose source routes and strict source routes are lists of router IP addresses that packets must pass through on their way to a destination.

                                     a.      A loose source route allows packets to pass through other routers in addition to those listed.

                                     b.      A strict source route contains a complete list of all the routers on the path to the destination.

                  D.      All TCP/IP computers must respond to any Echo Request messages they receive that are addressed to them by generating Echo Reply messages and transmitting them back to the sender.

                           1.       The payload data included in the request message is copied to the replies before they are transmitted.

|11|              E.      When the pinging computer receives the Echo Reply messages, it produces a display like that shown on Slide 11.

                  F.      In the case of the Windows 2000 Ping program implementation, the display shows the following information:

                           1.       The IP address of the computer receiving the Echo Requests

                           2.       The number of bytes of data included with each request

                           3.       The elapsed time between the transmission of each request and the receipt of each reply

                           4.       The value of the Time To Live (TTL) field in the IP header

                  G.      In the example shown on Slide 11, the target computer is on the same LAN, so the time measurement is very short—less than 10 milliseconds.

                           1.       When you ping a computer on the Internet, the interval is likely to be longer.

                  H.      A successful use of the Ping program, like the example on Slide 11, indicates that the target computer’s networking hardware is functioning properly, as are the protocols, at least as high as the network layer of the Open Systems Interconnection (OSI) reference model.

                  I.        The ping test can fail for either of the following reasons:

                           1.       One or both of the computers is experiencing a problem with its networking hardware or software.

                           2.       Some device on the network is blocking ICMP traffic (as some routers are configured to do).

|12|    3.    Tracert.exe

                  A.      Tracert.exe is a variant of the Ping program that displays the path that packets take to their destination.

                           1.       Paths through an internetwork can change from minute to minute, and Tracert.exe displays a list of the routers that are currently forwarding packets to a particular destination.

                  B.      The program is called traceroute on UNIX systems, Tracert.exe on Windows systems, and Iptrace.nlm on Novell NetWare systems.

                  C.      Tracert.exe uses ICMP Echo Request and Echo Reply messages just like the Ping program, but it modifies the messages by changing the value of the TTL field in the IP header of each message.

                           1.       The TTL field prevents packets from getting caught in router loops that keep them circulating endlessly around the network.

                           2.       The computer generating the packet normally sets a relatively high value for the TTL field.

                                     a.      On Windows systems, the default TTL value is 128.

                                     b.      Each router that processes the packet reduces the TTL value by 1.

                                     c.       If the value reaches 0, the last router discards the packet and transmits an ICMP error message back to the original sender.

|13|              D.      Using Tracert.exe

                           1.       When you run Tracert.exe with the name or IP address of a target computer, the program generates its first set of Echo Request messages with TTL values of 1.

                           2.       When the messages arrive at the first router on their path, the router decrements their TTL values to 0, discards the packets, and reports the errors to the sender.

                           3.       The ICMP error messages contain the router’s address, which Tracert.exe displays as the first hop in the path to the destination.

                           4.       The Traceroute program’s second set of Echo Request messages uses a TTL value of 2, causing the second router on the path to discard the packets and generate error messages.

                           5.       The Echo Request messages in the third set have a TTL value of 3, and so on.

                           6.       Each set of packets travels one hop farther than the previous set, causing a router to return any error messages to the source.

                                     a.      The list of routers displayed by the program as the path to the destination is the result of these error messages.

                  E.      An example of the Tracert.exe display is shown in the textbook on
page 96.

                           1.       In this example, Tracert.exe displays the path between a computer in Pennsylvania and one in the United Kingdom.

                           2.       Each of the entries contains the elapsed times between the transmission and receipt of three sets of Echo Request and Echo Reply packets.

                           3.       In this trace you can clearly see the point at which the packets begin traveling across the Atlantic Ocean.

                           4.       At hop 13, the elapsed times increase from approximately 150 to 230 milliseconds (ms) and stay in that range for the subsequent hops.

                           5.       This additional delay of only 80 ms is the time it takes the packets to travel the thousands of miles across the Atlantic Ocean.

|14|              F.      The Tracert.exe syntax is shown on Slide 14 and in the textbook on page 96.

                  G.      Tracert.exe can be a handy tool for isolating the location of a network communications problem.

                           1.       The Ping program simply tells you whether a problem exists; it cannot tell you where the problem is.

                                     a.      A failure to contact a remote computer could be caused by a problem in your workstation, in the remote computer, or in any of the routers in between.

                           2.       Tracert.exe can tell you how far your packets are going before they run into the problem.

                           3.       Because the configuration of the Internet is constantly changing, there is no guarantee that the route displayed by Tracert.exe is completely accurate.

                                     a.      The IP datagrams that execute each step of the traceroute process might in fact be taking different routes to the same destination, resulting in the display of a composite route between two points that does not actually exist.

|15|      4.    Pathping.exe

                  A.      Pathping.exe is a route-tracing tool that combines features of Ping.exe and Tracert.exe with additional information that neither of those tools provides.

                           1.       The Pathping command sends packets to each router on the way to a final destination over a period of time and then computes results based on the packets returned from each hop.

                           2.       Because the command shows the degree of packet loss at any given router or link, it is easy to determine which routers or links might be causing network problems.

|16, 17|         B.      The Pathping.exe syntax is shown on Slides 16 and 17 and in the textbook on page 97.

                        C.      A typical Pathping.exe report is shown in the textbook on page 98.

                           1.       The compiled statistics that follow the hop list indicate packet loss at each individual router.

                  D.      Using Pathping.exe

                           1.       When you run Pathping.exe, you first see the results for the route as the program tests it for problems.

                                     a.      This is the same path that is shown by the Tracert.exe program.

                           2.       Pathping.exe then displays a busy message for the next 125 seconds. (This time varies according to the hop count.)

                           3.       During this time, Pathping.exe gathers information from all the routers previously listed and from the links between them.

                           4.       At the end of this period, the program displays the test results.

                                     a.      The two rightmost columns—This Node/Link Lost/Sent=Pct and Address—contain the most useful information.

                                     b.      The link between 172.16.87.218 (hop 1) and 192.68.52.1 (hop 2) is dropping 13 percent of the packets. All other links are working normally.

                                     c.       The routers at hops 2 and 4 also drop packets addressed to them (as shown in the This Node/Link column), but this loss does not affect their forwarding path.

                                     d.      The loss rates displayed for the links (marked as a | in the rightmost column) indicate losses of packets being forwarded along the path. This loss indicates link congestion.

                                     e.      The loss rates displayed for routers (indicated by their IP addresses in the rightmost column) indicate that those routers might be overloaded.

                                     f.       These congested routers might also be a factor in end-to-end problems, especially if packets are forwarded by software routers.

       5.    Ipconfig.exe

                  A.      The Windows 2000 TCP/IP client includes a program called Ipconfig.exe that displays the current TCP/IP configuration for the computer’s network interface adapters.

                           1.       Microsoft Windows Me, Microsoft Windows 98, and Microsoft Windows 95 include a graphical version of the utility, called Winipcfg.exe.

|18, 19|         B.      When you run Ipconfig.exe with the /all parameter at the Windows 2000 command line, you see a display like that shown on slides 18 and 19.

                           1.       Running the program with no parameters displays a limited list of configuration data.

                  C.      Running Winipcfg.exe produces a display like the one shown in the textbook on page 100.

                  D.      Ipconfig.exe and Winipcfg.exe are often associated with DHCP because there is no easier way on a Windows system to see what IP address and other parameters the DHCP server has assigned to your computer.

                           1.       These programs also enable you to manually release IP addresses obtained through DHCP and to renew existing leases.

                           2.       By running Ipconfig.exe with the /release and /renew command-line parameters or by using the Release, Renew, Release All, or Renew All buttons in Winipcfg.exe, you can release or renew the IP address assignment of one of the network interfaces in the computer or for all the interfaces at once.

       6.    Arp.exe

                  A.      The Address Resolution Protocol (ARP) enables a computer running TCP/IP to convert IP addresses to the hardware addresses that data-link layer protocols need to transmit frames.

                           1.       IP uses ARP to discover the hardware address to which each of its datagrams will be transmitted.

                           2.       To minimize the amount of network traffic that ARP generates, the computer stores the resolved hardware addresses in a cache in system memory.

                           3.       The information remains in the cache for a short period of time (usually between 2 and 10 minutes), in case the computer has additional packets to send to the same address.

                  B.      Windows systems include a command-line utility called Arp.exe that you can use to manipulate the contents of the ARP cache.

                           1.       You can use Arp.exe to add the hardware addresses of computers you contact frequently to the cache, thus saving time and network traffic during the connection process.

                           2.       Addresses that you add to the cache manually are static, meaning that they are not deleted after the usual expiration period.

                                     a.      The cache is stored in memory only, so it is erased when you reboot the computer.

                           3.       If you want to preload the cache whenever you boot your system, you can create a batch file containing Arp.exe commands and execute it from the Windows Startup group.

|20|              C.      Arp.exe uses the syntax shown on Slide 20 and in the textbook on page 101.

|21|              D.      The ARP table of a computer running Windows 2000, as displayed by Arp.exe, appears as shown on Slide 21.

       7.    Netstat.exe

                  A.      Netstat.exe is a command-line program that displays information about the current network connections of a computer running TCP/IP and about the traffic generated by the various TCP/IP protocols.

                           1.       The program is simply called netstat on UNIX computers, and it is called Netstat.exe on computers running Windows.

                           2.       The command-line parameters differ for the various implementations of the Netstat program, but the information they display is roughly the same.

|22|              B.      The syntax for the Windows version of Netstat.exe is shown on Slide 22 and in the textbook on page 101.

|23|              C.      The Interface Statistics display is shown on Slide 23.

       8.    Nbtstat.exe

                  A.      Nbtstat.exe is a Windows command-line program that displays information about the NetBIOS over TCP/IP connections that Windows uses when communicating with other computers running Windows on the TCP/IP LAN.

|24, 25|         B.      The syntax for Nbtstat.exe is shown on Slides 24 and 25 and in the textbook on page 103.

                           1.       Unlike the other utilities discussed in this section, the command-line parameters for Nbtstat.exe are case-sensitive.

|26|              C.      The NetBIOS cache listing displayed by Nbtstat.exe on a computer running Windows 2000 appears as shown on Slide 26.

|27|              D.      The list of NetBIOS names registered by a computer appears as shown on Slide 27.

       9.    Nslookup.exe

                  A.      Nslookup.exe is a command-line utility that enables you to generate DNS request messages and transmit them to specific DNS servers on the network.

|28|              B.      The basic syntax of Nslookup.exe is shown on Slide 28 and in the textbook on page 104.

|29|              C.      The output generated by the program is shown on Slide 29.

                  D.      The advantage of the Nslookup utility is that you can test the functionality and the quality of the information on a specific DNS server by specifying it on the command line.

                  E.      By running Nslookup.exe with no command-line parameters, you can use the program in interactive mode, which lets you use some of its many options.

|30|    10.  Telnet.exe

                  A.      The Telecommunications Network Protocol (Telnet) is a command-line client/server program that essentially provides remote control capabilities for computers on a network.

                           1.       A user on one computer can run a Telnet client program and connect to the Telnet server on another computer.

                           2.       Once connected, that user can execute commands on the other system and view the results.

                  B.      It is important to distinguish Telnet remote control access from simple access to the remote file system.

                           1.       When you use a Telnet connection to execute a program on a remote computer, the program actually runs on the remote computer.

                           2.       By contrast, if you use Windows to connect to a shared drive on another computer and execute a program, the program runs on your computer.

                  C.      Telnet was originally designed for use on UNIX systems, and it is still an extremely important tool for UNIX network administrators.

                           1.       Windows operating systems all include a Telnet client, but only Windows 2000 and later versions have a Telnet server.

                  D.      The syntax for connecting to a Telnet server is as follows: telnet target

                  E.      Telnet uses a text-based command and response syntax that was the model for several other important application layer protocols, including

1.             File Transfer Protocol (FTP)

2.             Hypertext Transfer Protocol (HTTP)

3.             Simple Mail Transfer Protocol (SMTP)

                  F.      Because all information transmitted during a Telnet session is in clear text, the protocol presents a security hazard when used on unsecured networks.

|31|    11.  Ftp.exe

                  A.      FTP is similar to Telnet, but it is designed for performing file transfers instead of executing remote commands.

                           1.       FTP includes basic file management commands that can create and remove directories, rename and delete files, and manage access permissions.

                  B.      FTP has become a mainstay of Internet communications, but it also performs a vital role in communications between UNIX computers, all of which have both FTP client and server capabilities.

                  C.      All computers running Windows have a character-based FTP client, but FTP server capabilities are built into the IIS application that is included with Windows 2000 Server.

                           1.       Many other FTP clients are also available that offer graphical interfaces and other usability features.

                  D.      Generally speaking, computers running Windows do not need FTP for communications on a LAN because they can access the shared files on other computers directly.

                           1.       On many UNIX networks, however, FTP is an important tool for transferring files to and from remote computers.