Chapter 19

Troubleshooting TCP/IP

The Basis

Determine where the problem is whether its one user, multiple users, or every user.

• Remember there are two ends to every connection. 
• Is this the only user affected?
• Some can use service while others can't
• Can any user access this service?

If you have multiple users, determine if they are on the same subnet.

• Configuration in the router is gone
• Dead Router
• One of the servers is down
• All users have a NetBIOS scope ID.

What has changed?

Server side

• upgrade to server
• file recently restored
• user's rights changed (granted, taken away)
• Is server on?

Client side

• new hardware added
• has hardware ever worked in workstation
• is IP configured properly
• check name resolution
• check connectivity

Tools and Utilities

Ping enables you to verify basic network connectivity and the function of the TCP/IP stack.

IPCONFIG enables you to verify your system is properly configured and that all information is in fact entered. It can also be used with DHCP to renew or release IP addresses.

NETSTAT is used to check the status of the TCP/IP connections. Helps to determine which port or ports are working, it can also verify any services that you are running are using the correct ports.

NBTSTAT is used to check the status of connections you are attempting with other systems over NetBIOS. Will help you to see if you have a name resolution problem too.

ROUTE is used in static environment. Route Print will show the routing table.

TRACERT enables you to check a route taken to destination host

ARP enables you to verify that no static ARP entries exist.  Displays and modifies the IP-to-Physical address translation tables used by
address resolution protocol (ARP).

Network Monitor checks the actual packets flowing on the network. It enables you to check the information moving in and out of your system. (using NetMON in SMS, you can check data going in and out of a remote system).

Performance Monitor enables you to check on not only the network components, but all parts of the NT system. This tools allows you to monitor your network over longer periods of time.

Event Viewer is where all the different parts of the system reports errors. There are three logs: System, Security, and Application.

NT Diagnostics enables you to look at the current system and you can also see other systems on the network.

Checking Connectivity

First verify the TCP/IP stack is configured.

• ipconfig /all or ping 127.0.0.1
• ping your_IP_address
• ping local_IP_address
• ping your_gateway_IP_address
• ping remote_IP_address
• ping host_name
• ping NetBIOS name

(ping is handled at the IP layer)

Next try to establish a session with remote host

• NSLOOKUP (DNS)
• NET VIEW \\computer_name (NBT)
• re-booting system

Troubleshooting TCP/IP services

IIS

• Make sure TCP/IP is functioning properly
• Using the correct port (standard port)
• check IIS service (started)
• ensure the IUSR_computername account exists and the password is correct.

TCP/IP Printing

• Make sure you are using correct print driver (test is garbled)
• if using host names ensure name resolution works
• make sure TCP/IP Print Server is started if you are hosting (not automatic)

DHCP

• must have a scope for the client's subnet
• make sure there is a DHCP boot relay agent if routers don't forward BOOTP broadcasts

WINS

• if client cannot resolve addresses, make sure the client is set up to use WINS and the correct address is entered
• not all clients can resolve to WINS must use LMHOST file (static)
• check pull/push replication
• non-WINS clients need a proxy agent on their subnet.

Browser Service

• LMHOSTS files are required for the domain controllers to facilitate browsing and domain activity
• computers can remain in browser list up to 51 minutes after they crash.
• login is handled by broadcast unless a #DOM: tag exists in the LMHOSTS files.

DNS

• Need a primary and secondary DNS server
• If DNS servers don't have a resolution it must go to the root servers and back down.
• to provide reverse lookup, you must provide the in-addr.arpa domain
• WINS integration is configured differently for the DNS domains and the reverse lookup. Both must be turned on
• Use NSLOOKUP to test the DNS resolution