TCP/IP utilities are categorised as follows: Connectivity utilities - These utilities are used to interact with resources to check connectivity of devices on a variety of windows-based and UNIX-based operating systems. Commonly used connectivity utilities are as follows:
FTP - It is used to transfer files between computers.
Remote Procedure Call (RPC) - Remote Procedure Call." Most computer programs run procedures, or sets of instructions, using the computer's CPU. In other words, the instructions are processed locally on the same computer that the software is running from. Remote procedure calls, however, run procedures on other machines or devices connected to a network. Once the instructions have been run, the results of the procedure are usually returned to the local computer.
For example, a computer without a hard drive may use an RPC to access data from a network file system (NFS). When printing to a network printer, a computer might use an RPC to tell the printer what documents to print. A client system connected to a database server may execute an RPC to process data on the server..
FTP - It is used to transfer small files between computers.
Diagnostic utilities - These utilities are used for troubleshooting and resolve networking problems. Commonly used diagnostic utilities are as follows:
Address Resolution Protocol (ARP) - It resolves IP address to MAC address and vice versa.
Hostname - It displays hostname of the computer.
Ipconfig - It display current TCP/IP settings such as IP address, subnet mask, MAC address of the computer and so on.
Tracert - It traces the path of packet to a destination.
Path - It verifies configurations and tests IP connectivity in a network.
Nbstate - It displays the local NetBIOS name table, and the table that lists cache listing of NetBIOS computers names that are resolves.
Server software utilities - These utilities provides printing and publishing services for Windows operating systems. Commonly used server software utilities are as follows:
Internet Information Server (IIS) - It is used to host Web pages and files for FTP server for internal network in the organisation.
TCP/IP Printing service - It is used to configure printer server in the organisation that manages printing in the organisation.
7.2 ARP
It is Address Resolution Protocol (ARP) used to resolve computer IP address to MAC address. It is a layer 3 protocol of OSI layer. Address resolution is the process of finding MAC address of the host on the network. To perform this task computers sends broadcasts message to all computers, those all computers reply to the sent packet with MAC address information, in this way computer maintain ARP table that maintains IP address of the computers connected in the network and MAC address associates with it. When the computer sends back MAC address information to the source it used Reverse ARP (RARP) protocol.
'ARP' can be used with multiple option, some of them are listed as follows:
Arp /? ïƒ It shows help for the 'arp' command, that displays different options that can be used with arp command.
Arp -a ïƒ it shows the 'arp' table if the current resolved MAC addresses (Refer to Figure 7.1).
Arp -d ïƒ It is used to clear the arp table.
Figure 7.1: 'arp -a' Command
7.3 Netstat
It is protocol that shows current status of the network, it also determines the Trojan attack if any. There are different options that can be used to with netstat and some of them are as follows:
Netstat /? ïƒ It shows help for the command and shown various option available with the command.
Netstat -a ïƒ It shows status of all connection with protocol, MAC address and status of the network (Refer to Figure 7.2).
Net stat -s ïƒ It shows statistics such as total sent packets, receive packets, error occurs and so on. By default is shows the statistics for IPv4, IPv6, ICMP and so on.
Netstat -e ïƒ It shows the statistics of the interface that shows sent packets, receive packet, error occurs and so on the interface.
Figure 7.2: 'netstat -a' Command
7.4 Nbtstat NBT (NetBios over TCP/IP) STAT (Statistics) is a critical tool for problem solving and depends on the Microsoft's use of NetBIOS in Windows. The foundation for file and print sharing for Microsoft's windows networks is the Server Message Block (SMB) protocol (later renamed to CIFS, Common Internet File System). Every Windows computer is assigned a user friendly NetBIOS name to allow them to communicate with each other. Workgroup and domain names are also NetBIOS names. The NetBIOS protocol is not routeable. NetBIOS over TCP/IP is. Thus tools NetBIOS tools like Nbtstat are valuable for discovery and problem solving on Windows-based networks. It is a tool to view and manipulate the NetBIOS name table and the name cache.
It is possible to discover who is logged onto a networked PC using the Windows NT utility NBTSTAT since its in the logged on account is part of the naming info maintained locally by NBT. NBT runs on each Windows PC and functions as a local naming agent for TCP/IP. If a network address is not locally cached, NBT gets the info from WINS or LMHOSTs
7.5 Ping
It is utility that use to check connectivity with computers. It sends a series of packets to the computer to which connectivity need to check, that computer again sent reply back to the computer. The reply shows that the connectivity is there or not. Means if the remote computer is not reachable then we will get reply as 'request time out', if remote computer IP address is given wrong or that computer is not in the name network then we will get 'destination host unreachable', if there is hardware problem then we will get reply such as 'hardware error', if the connection is correct then we will get reply such as 'reply from remote computer' as shown in Figure 7.3. Ping command can be used with different options; some of them are as follows:
Ping 'IP address' ïƒ used to check connectivity with the connectivity with assigned IP address. With this command we will get only four replies from remote computer.
Ping 'IP address' -t ïƒ used to get continuous reply from the destination computer.
Figure 7.3: Reply from Remote Computer
Figure 7.4: Request time out Message from Remote Computer
Figure 7.5: Image with Destination host Unreachable
Figure 7.6: 'Hardware Error' Message
Winipcfg
It is used to review current TCP/IP network protocol settings. It is available only with Windows 98 and previous operating system to troubleshoot network connectivity issue.
Ipconfig
It is a utility that is available in Windows-based operating systems from Windows. This command used to get IP settings information such as IP address, subnet mask, default gateway and so on of the computer. It is a advance version of 'winipcfg' command.
Ipconfig command can be used with different option, some of them are as follows:
Ipconfig /? ïƒ shows help to used different available option with 'ipconfig' command.
Ipconfig ïƒ It show IP address, subnet mask, default gateway of the computer as shown in the figure 7.7.
Ipconfig /all ïƒ it shows as 'ipconfig' in addition it shows, MAC address, DHCP server status, DNS address and so on (Refer to Figure 7.8).
Ipconfig /release ïƒ It releases IP address associated with computer (Refer to Figure 7.9).
Ipconfig /renew ïƒ it sends request to the DHCP server to get new IP settings.
Figure 7.7: Ipconfig
Figure 7.8: ipconfig /all
Figure 7.9: ipconfig /release
Tracert
It traces the route for the destination computer. It allows testing the network infrastructure of organisation, it also helps to diagnose the problem. It shows the route through which packet flows. Figure 7.10 shows how tracert command shows route to the Google.com.
Figure 7.10: Router to the 'Google.com'
NSLOOKUP
It is used to check whether computer is able to resolve computer name with DNS server or not. This utility shows that which DNS server is resolving the computer name. As shown in Figure 7.11, it shows that 202.149.208.92 is the DNS server and server name is 'smtp.ttml.co.in'. This command is used with DNS server clients.
Note: Domain Name Service (DNS) is a service that resolves IP address to Fully qualified Domain Name (FQDN) and vice versa. It is used only with sever-based network.
