5. Troubleshooting Internet Problems with Windows TCP/IP Utilities
If you think you are connected to your ISP but
you still can’t communicate, you can use some of the command-line tools
provided with Windows to trace TCP/IP problems. (TCP/IP is the network
language or protocol used by the Internet.)
To run the command-line utilities, open a Command
Prompt window with Start, All Programs, Accessories, Command Prompt.
Then, type in the commands as I describe them later. If you’re not
familiar with a particular command-line utility, type the command name
followed by /?, as in this example:
Note
If you’re a UNIX devotee,
you’ll find these utilities familiar, if not identical, to their UNIX
counterparts. If you’re new to TCP/IP networking or debugging, you might
find these utilities a little unfriendly. (Welcome to the world of
networking.) |
Now, let’s go through some of the TCP/IP diagnostic and command-line utilities provided with Windows.
ipconfig
ipconfig is one of the most useful
command-line utilities provided with Windows because it displays the
current IP address information for each of your computer’s network
adapters and active dial-up connections. On networks that assign
addresses automatically, ipconfig can tell you what your computer’s IP address is, if you ever need to know it.
After opening a Command Prompt window, the command ipconfig prints the following information (of course the IP, subnet, and gateway information ipconfig provides will be different for your computer, and you might see a dial-up connection listed instead of a LAN adapter):
Windows IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::8014:cfc7:9a98:cdfe%10
IPv4 Address. . . . . . . . . . . : 192.168.15.106
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.15.1
(You can ignore the Tunnel Adapter information;
this is part of the Version 6 Internet Protocol system, which is used
only on large, managed corporate networks.)
If you type the command
Windows displays additional information about your network settings, including the information shown in Table 1.
Table 1. Information Displayed by ipconfig/all
| Setting | What It Means |
|---|
| Host Name | The name you gave your computer. |
| Primary DNS Suffix | The
Internet domain to which your computer belongs. (You might temporarily
belong to others as well while using a dial-up connection.) This might
be blank; it is not a problem. |
| Node Type | The
method that Windows uses to locate other computers on your LAN when you
use Windows Networking. This usually is Hybrid or Broadcast. |
| DNS Suffix Search List | Alternative domain names used if you type just part of a hostname and the default domain does not provide a match. |
| Connection-specific DNS Suffix | The domain name for this particular connection. This is most applicable to dial-up connections. |
| DHCP Enabled | If set to Yes, this adapter is set to receive its IP address automatically. If set to No, the address was set manually. |
| DNS Servers | IP addresses of domain name servers. |
ipconfig displays most of the
information that can be set in the Network and Dial-Up Connection
Properties dialog box, but it shows their real-world values. This makes
it an invaluable “first stop” when troubleshooting any network problem.
If you determine that an Internet connection problem lies in your
equipment somewhere (because you cannot access any Internet
destinations), typing ipconfig /all can tell you whether your network setup is correct. You need this information at hand before calling your ISP for assistance.
ping
If you try to browse the Internet or share files
with other computers on your LAN and get no response, it could be
because the other computer isn’t receiving your data or isn’t
responding. After ipconfig, ping is the most useful tool to determine where your Internet connection or your network has stopped working.
Tip
You can type ping
x.x.x.x, replacing x.x.x.x
with the default gateway address or the address of any other
operational computer on the Internet or your network (if applicable),
and in an instant, you will know whether your dial-up or high-speed
modem, computer, network hardware, and cabling are operating properly.
If echoes come back, the physical part of your network is functioning
properly. If they don’t, you can use tracert and other tools to see why. |
Here’s how it works:
The ping command sends a few packets of data to any computer you specify.
The other computer should immediately send these packets back to you.
ping lets you know whether the packets come back.
Therefore, ping tests the low-level communication between two computers. If ping works, you know that your network wiring, TCP/IP software, and any routers in between you and the other computer are working. ping
takes
several options that can customize the type and amount of output it
reports back to you. Three especially useful variations of these options
exist; the first two are
where hostname is the name of one of the computers on your network, and
C:\> ping nnn.nnn.nnn.nnn
where nnn.nnn.nnn.nnn is a computer’s numeric IP address, as discovered by ipconfig.
That is, you can ping a computer either by its name or by its IP
address. These variations transmit four packets to the host or IP
address you specify and tell you whether they return. This command
returns the following information:
C:\> ping www.mycompany.com
Pinging sumatra.mycompany.com [202.222.132.163] with 32 bytes of data:
Reply from 202.222.132.163: bytes=32 time<10ms TTL=32
Reply from 202.222.132.163: bytes=32 time<10ms TTL=32
Reply from 202.222.132.163: bytes=32 time<10ms TTL=32
Reply from 202.222.132.163: bytes=32 time<10ms TTL=32
Note
It’s not uncommon for one packet of the four to be lost; when the Internet gets congested, sometimes ping
packets are discarded as unimportant. If any come back, the intervening
networks are working. It’s also not unusual for the name that appears
after “Pinging” to be different from what you typed. Some computers have
alternative names. |
In this example, the fact that the reply packets came back tells us that the computer can communicate with www.mycompany.com. It also tells us that everything in between my computer and mycompany.com is working.
The third useful variation is to add the -t option. This makes ping
run endlessly once per second until you press Ctrl+C. This is
especially helpful if you’re looking at indicator lights on your network
hub, changing cables, and so on. The endless testing lets you just
watch the screen to see whether any changes you make cause a difference.
ping is a great quick test of connectivity to any location. If the ping test fails, use tracert or pathping to tell you where the problem is. ping
is a good, quick tool to use to discover whether an Internet site is
alive. (However, some large companies have made their servers not
respond to ping tests. For example, ping www.microsoft.com
doesn’t work ever, even with a good Internet connection. It’s not just
that Microsoft got tired of being the first site everyone thought of to
test their Internet connections; malicious people also can use ping to suck up all of a company’s Internet bandwidth.)
tracert
tracert is similar to ping: It sends packets to a remote host and sees whether packets return. However, tracert
adds a wrinkle: It checks the connectivity to each individual router in
the path between you and the remote host. (Routers are the devices that
connect one network to another. The Internet itself is the
conglomeration of a few million networks all connected by routers.) If
your computer and Internet connection are working but you still can’t
reach some or all Internet sites, tracert can help you find the blockage.
In the output of tracert, the address
it tests first is your local network’s gateway (if you connect to the
Internet via a high-speed connection or a LAN) or the modem-answering
equipment at your ISP’s office (if you’re using a dial-up connection).
If this first address responds, you know that your modem, LAN, or
broadband connection is working. If the connection stops after two or
three routers, the problem is in your ISP’s network. If the problem
occurs farther out, there might be an Internet outage somewhere else in
the country.
Here’s an example that shows the route between my network and the fictitious web server www.fictitious.net. Typing
C:\> tracert www.fictitious.net
returns the following:
Tracing route to www.fictitious.com [204.179.107.3]
over a maximum of 30 hops:
1 <10 ms <10 ms <10 ms 190.mycompany.com [202.201.200.190]
2 <10 ms <10 ms 10 ms 129.mycompany.com [202.201.200.129]
3 20 ms 20 ms 20 ms w001.z216112073.sjc-ca.dsl.cnc.net [216.112.73.1]
4 10 ms 10 ms 10 ms 206.83.66.153
5 10 ms 10 ms 10 ms rt001f0801.sjc-ca.concentric.net [206.83.90.161]
6 10 ms 20 ms 20 ms us-ca-sjc-core2-f5-0.rtr.concentric.net [205.158.11.133]
7 10 ms 20 ms 10 ms us-ca-sjc-core1-g4-0-0.rtr.concentric.net [205.158.10.2]
8 10 ms 20 ms 20 ms us-ca-pa-core1-a9-0d1.rtr.concentric.net [205.158.11.14]
9 10 ms 20 ms 20 ms ATM2-0-0.br2.pao1.ALTER.NET [137.39.23.189]
10 10 ms 20 ms 20 ms 125.ATM3-0.XR1.PAO1.ALTER.NET [152.63.49.170]
11 10 ms 10 ms 20 ms 289.at-1-0-0.XR3.SCL1.ALTER.NET [152.63.49.98]
12 20 ms 20 ms 20 ms 295.ATM8-0-0.GW2.SCL1.ALTER.NET [152.63.48.113]
13 20 ms 20 ms 20 ms 2250-gw.customer.ALTER.NET [157.130.193.14]
14 41 ms 30 ms 20 ms www.fictitious.com [204.179.107.3]
Trace complete.
You can see that between my computer and this web server, data passes through 13 intermediate routers owned by two ISPs.
Tip
When your Internet connection is working, run tracert
to trace the path between your computer and a few Internet hosts. Print
and save the listings. Someday when you’re having Internet problems,
you can use these listings as a baseline reference. It’s very helpful to
know whether packets are stopping in your LAN, in your ISP’s network,
or beyond when you pick up the phone to yell about it. |
I should point out a couple of tracert oddities. First, notice in the example that on the command line I typed www.fictitious.net, but tracert printed www.fictitious.com. That’s not unusual. Web servers sometimes have alternative names. tracert starts with a reverse name lookup to find the canonical (primary) name for a given IP address.
You might run into another glitch as well. For
security reasons, many organizations use firewall software or devices,
which block tracert packets at the firewall between their LAN and the Internet. In these instances, tracert
will never reach its intended destination, even when regular
communications are working correctly. Instead, you’ll see an endless
list that looks similar to this:
14 * * * Request timed out.
15 * * * Request timed out.
16 * * * Request timed out.
This continues up to the tracert limit of 30 probes. If this happens, just press Ctrl+C to cancel the test. If tracert
could reach routers outside your own LAN or PC, your equipment and
Internet connection are fine—and that’s all you can directly control.
pathping
pathping provides the function of tracert and adds a more intensive network traffic test. pathping performs the route-tracing function faster than tracert because it sends only one test packet per hop, compared to tracert’s three.
After determining the route, pathping does a punishing test of network traffic at each router by sending 100 ping
packets to each router in the path between you and the host you’re
testing. It measures the number of lost packets and the average
round-trip time for each hop, and it displays the results in a table.
The results tell you which routers are
experiencing congestion because they cannot return every echo packet
they’re sent, and they might take some time to do it. Performing the pathping
test can take quite awhile. Fortunately, you can cancel the test by
pressing Ctrl+C, or you can specify command-line options to shorten the
test. A reasonably quick test of the path to a site—say, www.quepublishing.com—can be performed using just 10 queries, instead of the default 100, by using this command:
pathping -q 10 www.quepublishing.com
You can type
to get a full description of the command-line options.
route
Most of us have no more than one modem or one
LAN adapter through which we make our Internet and other network
connections, but Windows networking components are sophisticated enough
to handle multiple LAN and dial-up adapters in one computer. When
multiple connections are made, Windows has to know which connections to
use to speak with another remote computer. For the TCP/IP or Internet
Protocol (IP) data, this information comes from the routing table. This
table stores lists of IP addresses and subnets (blocks of IP addresses)
and also indicates which adapter (or interface) Windows used to reach
each of them.
Now, this is getting into some hardcore
networking that only a few readers will be interested in. Please don’t
think that you need to know about this tool; there will be no quiz next
Friday. I’m discussing this only to cover the details for those few
people who have a complex network setup and need to know how to go to
this information. You don’t have to worry about routing unless one of
the following scenarios is true:
You use a dial-up connection and a LAN adapter simultaneously.
You use multiple LAN adapters.
You use virtual private networking (VPN) connections.
If you have trouble reaching an Internet destination and fall into any of these three categories, type route print at the command line. You’re shown a table that looks similar to this:
===========================================================================
Interface List
10 ...00 03 ff d0 ca 5f ...... Intel 21140-Based PCI Fast Ethernet Adapter
1 ........................... Software Loopback Interface 1
13 ...00 00 00 00 00 00 00 e0 isatap.{3C3E0C23-191B-4E11-9713-97D239EA2995}
11 ...02 00 54 55 4e 01 ...... Teredo Tunneling Pseudo-Interface
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.15.1 192.168.15.106 20
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.15.0 255.255.255.0 On-link 192.168.15.106 276
192.168.15.106 255.255.255.255 On-link 192.168.15.106 276
192.168.15.255 255.255.255.255 On-link 192.168.15.106 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.15.106 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.15.106 276
===========================================================================
Persistent Routes:
None
IPv6 Route Table
...
(You can ignore the IPv6 section for now.)
There’s a lot of information here, but
for our purpose, we can boil it down to this: The entry for network
destination 0.0.0.0 is the effective gateway address for general
Internet destinations. This can be different from your LAN’s specified
default gateway, especially while a dial-up or VPN connection is active.
That, in turn, might mean that you can’t get to the Internet. If you
have multiple LAN adapters, the issues are more complicated. Contact
your network administrator for assistance.
