Charles M. Kozierok The TCP-IP Guide

Подождите немного. Документ загружается.

Windows netstat

The Windows netstat utility is quite a bit simpler than the UNIX one, because it has a lot

fewer options. This is good for those of us learning about the program, but not so wonderful

for those who want maximum power and flexibility in using it.

Windows netstat Option Groups, Options and Parameters

Like the UNIX netstat, the Windows one has a set of options groups that dictate the general

type of information shown, and a few universal options that can be used with multiple

groups. The option groups and generic options are shown in Table 301 and Table 302.

Table 300: Sample IP Statistics From UNIX netstat Utility

%netstat -s -p ip

ip:

57156204 total packets received

0 bad header checksums

4 with size smaller than minimum

0 with data size < data length

0 with ip length > max ip packet size

0 with header length < data size

0 with data length < header length

0 with bad options

0 with incorrect version number

138 fragments received

6 fragments dropped (dup or out of space)

128 fragments dropped after timeout

2 packets reassembled ok

57085912 packets for this host

24736 packets for unknown/unsupported protocol

0 packets forwarded (0 packets fast forwarded)

44957 packets not forwardable

4 packets received for unknown multicast group

0 redirects sent

66183465 packets sent from this host

177 packets sent with fabricated ip header

0 output packets dropped due to no bufs, etc.

0 output packets discarded due to no route

0 output datagrams fragmented

0 fragments created

0 datagrams that can't be fragmented

0 tunneling packets that can't find gif

22 datagrams with bad address in header

Sample Windows netstat Output

The output from the Windows netstat program is fairly similar to that of the UNIX utility when

the same or similar options are given, but the UNIX version usually provides more details. I

have shown in Table 303 an example illustrating TCP/IP statistics on my home Windows XP

machine, using “-p icmp” to restrict the output to ICMP stats only. Table 304 shows the

routing table display from netstat (which I modified slightly to fit the size limits of the table.)

You would get similar output as these from the UNIX “netstat -s -p icmp” or “netstat -r”

commands, but additional information would be provided.

Table 301: Typical Windows netstat Option Groups, Options and Parameters

Option Group, Options and

Parameters

Description

netstat [-n] [-o] [<interval>]

When called with no mandatory options, netstat displays information

about active TCP connections.

netstat -a [-n] [-o]

[-p <protocol> [<interval>]

Displays all active TCP connections, as well as both TCP and UDP ports

to which the host is listening.

netstat -e [<interval>] Shows statistics for Ethernet interfaces.

netstat -r [<interval>] Displays the current routing table for the device.

netstat -s [-p <protocol>]

[<interval>]

Displays TCP/IP statistics for the system by protocol.

Table 302: Typical Windows netstat Universal Options and Parameters

Option / Parameters Description

-n

Displays network addresses in numeric form instead of symbolic name

form. Also shows ports in numeric form instead of displaying standard

process names associated with well-known UDP or TCP port numbers.

-o Displays the process ID associated with each connection.

-p <protocol>

Limits the display to only the information associated with the specified

protocol.

Causes the netstat command to be repeated every “<interval>” seconds,

rather than just displaying its information once. This can be used with any

of the netstat option groups.

For example, “netstat -s 5” would display TCP/IP statistics every five

seconds.

Table 303: Sample ICMP Statistics From Windows netstat Utility

D:\aa>netstat -s -p icmp

ICMPv4 Statistics

Received Sent

Messages 243 248

Errors 0 0

Destination Unreachable 9 4

Time Exceeded 7 0

Parameter Problems 0 0

Source Quenches 0 0

Redirects 0 0

Echos 224 20

Echo Replies 3 224

Timestamps 0 0

Timestamp Replies 0 0

Address Masks 0 0

Address Mask Replies 0 0

Table 304: Sample Routing Table Display From Windows netstat Utility

D:\aa>netstat -r

Route Table

=================================================================

Interface List

0x1 ........................... MS TCP Loopback interface

0x2 ...00 04 76 4e 75 3f ...... 3Com 10/100 Mini PCI Ethernet

=================================================================

Active Routes:

Network Dest Netmask Gateway Interface Met

0.0.0.0 0.0.0.0 148.64.128.1 148.64.133.73 30

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1

148.64.128.0 255.255.192.0 148.64.133.73 148.64.133.73 30

148.64.133.73 255.255.255.255 127.0.0.1 127.0.0.1 30

148.64.255.255 255.255.255.255 148.64.133.73 148.64.133.73 30

224.0.0.0 240.0.0.0 148.64.133.73 148.64.133.73 30

255.255.255.255 255.255.255.255 148.64.133.73 148.64.133.73 1

Default Gateway: 148.64.128.1

=================================================================

Persistent Routes:

None

Key Concept: TCP/IP implementations include the netstat utility to allow information

about network status to be displayed. On UNIX systems, netstat is a full-featured

program with many options arranged into option groups, each of which shows a

particular type of information about the operation of TCP/IP protocols. On Windows

systems, netstat is somewhat more limited in function but still allows a considerable amount

of information to be displayed.

TCP/IP Configuration Utilities (ipconfig, winipcfg and ifconfig)

A significant part of any network administrator’s job is setting up and maintaining the

devices that make a TCP/IP network function, a process generally called configuration.

Networked hosts consist of both hardware and software that work together to implement all

the layers and functions of the protocol stack. An administrator uses hardware tools to

configure physical devices, performing tasks such as installing network interface cards,

connecting cables, and manipulating switches and other hardware settings. Similarly, tools

are required to configure the software that runs TCP/IP interfaces and controls the

operation of higher-layer protocols on networked hosts.

The ifconfig Utility

On UNIX systems, the interface configuration utility, ifconfig, is used to view and modify the

software settings that control how TCP/IP functions on a host. It is a very powerful program

that allows an administrator to set up and manage a very wide array of network settings.

The implementation of ifconfig varies greatly even between flavors of UNIX—while most are

similar in general terms, they may have rather different options and syntaxes.

The ifconfig program can be used for a variety of purposes: to create or remove a network

interface, change its settings, or simply examine the existing configuration. Thus, like the

netstat utility, ifconfig is really like several related programs combined into one, with the

particular mode in which the program is used depending on the syntax used to invoke it.

And also like netstat, ifconfig has a number of universal options that can be applied to many

of its different uses.

ifconfig Syntaxes, Options and Parameters

Table 305 provides a simplified summary of the different functions that ifconfig can perform,

and the syntaxes that are used to specify each in a typical UNIX implementation (NetBSD in

this case). Table 306 describes the common options and parameters that can be used for

many of these different modes. When ifconfig is used to modify an interface’s configuration,

this is done by setting any of several dozen configuration parameters, using the syntax

shown in the last row of Table 305; I have provided a brief description of some sample

parameters in Table 307 (see your ifconfig documentation for a complete list).

Table 305: Typical UNIX ifconfig Syntaxes, Options and Parameters

Syntax, Options and

Parameters

Description

ifconfig [-L] [-m] <interface>

When ifconfig is called with just an interface specification and no other

options (other than possibly “-L” and “-m”), it displays the configuration

information for that network interface.

Note that entering “ifconfig” by itself with no interface just causes help

information for the parameter to be displayed; to see all interfaces, the

“-a” parameter should be used.

ifconfig -a [-L] [-m] [-b] [-d]

[-u] [-s] [<family>]

Displays information about all the interfaces on the host. The output

may be restricted using the universal parameters shown, or by speci-

fying an address family (see Table 306).

ifconfig -l [-b] [-d] [-u] [-s] Lists all available interfaces on the system.

ifconfig <interface> create

Creates the specified logical network interface on the host, which is

then configured using the syntax shown in the last row of this table.

Note that some variations of UNIX allow certain parameters to be set

at the time of creation.

ifconfig <interface> destroy Destroys the specified logical interface.

ifconfig <interface> [<family>]

[<address> [<dest_address>]]

[<parameters>]

Configures parameters for a particular interface on the host. If the

address is being set, it is the first parameter specified, after the

optional address family, if present. The “<dest_address>” is used to

specify a destination address for a point-to-point link. After this, any of

several dozen parameters may be specified for the interface, some of

which are shown in Table 307.

Table 306: Typical UNIX ifconfig Universal Options and Parameters

Option / Parameter Description

-L Displays the address lifetime for IPv6 addresses.

-m Displays all supported media for the interface.

-b Limits the display of interface information to broadcast interfaces.

-d Shows only interfaces that are presently down (disabled).

-u Shows only interfaces that are presently up (operational).

-s Shows only interfaces that may be connected.

Specifies a particular address family, either to limit output or indicate what

address type is being configured. The value “inet” is used for IPv4 and

“inet6” for IPv6.

Note: Since creating, destroying or modifying interfaces can cause a host to stop

working properly, administrative (super-user) rights are generally required on most

systems in order to do anything with ifconfig other than examining the existing

configuration.

ifconfig Sample Output

In Table 308, I have provided a sample output of the “ifconfig -a” command on one of the

UNIX machines I use regularly, showing the settings for its interfaces.

The ipconfig Utility

Windows takes a somewhat different approach to network configuration than UNIX. As we

have seen, the UNIX ifconfig program can be used both to view and modify a wide range of

configuration parameters. In Windows, however, most setup and parameter modification is

done using the Windows Control Panel. Windows does include a utility that is somewhat

Table 307: Typical UNIX ifconfig Interface Configuration Parameters

Parameters Description

alias / -alias Establishes or removes a network address alias.

arp / -arp Enables / disables the use of ARP on this interface.

delete Removes the specified network address.

down Marks an interface as being “down”, disabling it.

media <type> Sets the media type of the interface to a particular value.

mtu <n> Sets the maximum transmission unit (MTU) of the interface.

netmask <mask> Sets the network or subnet mask for the interface’s address.

prefixlen <n>

Same as “netmask” but allows the mask to be specified using a CIDR-

style prefix length.

up Sets an interface “up”, enabling it.

Table 308: Sample Routing Table Display From Windows netstat Utility

%ifconfig -a

fxp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500

address: 00:a0:c9:8c:f4:a1

media: Ethernet autoselect (100baseTX full-duplex)

status: active

inet 166.84.1.3 netmask 0xffffffe0 broadcast 166.84.1.31

inet alias 166.84.1.13 netmask 0xffffffff broadcast 166.84.1.13

lo0: flags=8009<UP,LOOPBACK,MULTICAST> mtu 33228

inet 127.0.0.1 netmask 0xff000000

similar to UNIX’s ifconfig, but it has far less functionality, and is used mainly to inspect the

existing configuration, not change it. It also allows an administrator to easily perform a few

simple functions on a host.

ipconfig Options and Parameters

On most newer versions of Windows, the equivalent of ifconfig is a command-line utility

called ipconfig. Like ifconfig, the Windows utility is controlled using options that are supplied

to the program. However, because it is so much simpler than ifconfig, there are only a few

different options that can be used. These are summarized in Table 309.

As mentioned earlier, ipconfig is most often used to just examine the existing configuration.

When simplified information is needed it is called with no options; an example of the output

from this use of the command is shown in Table 310. For detailed information on interfaces,

the “/all” option is used; an example is in Table 311 (slightly modified so it is easier to read).

Table 309: Typical Windows ipconfig Options and Parameters

Option / Parameters Description

(none)

When called with no options or parameters, ipconfig displays the IP

address, subnet mask and default gateway for each interface on the

host.

/all

Similar to calling ipconfig with no options, but displays more detailed

configuration information about the host’s interfaces.

/release [<adapter>]

Releases (terminates) the DHCP lease on either the specified adapter

(interface), or all interfaces if none is provided.

/renew [<adapter>]

Manually renews the DHCP lease for either the specified adapter

(interface), or all adapters if none is mentioned.

/displaydns Displays the contents of the host’s DNS resolver cache.

/flushdns Clears the host’s DNS resolver cache.

/registerdns

Refreshes (renews) all DHCP leases and also re-registers any DNS

names associated with the host.

/showclassid <adapter>

Displays DHCP class IDs associated with this adapter (these are used

to arrange clients into groups that are given different treatment by

DHCP servers.) The adapter must be specified, even if there is only

one.

/setclassid <adapter> [<classid>] Modifies the DHCP class ID for the specified adapter.

ipconfig Sample Output

You can see from the list of options in Table 309 that most of the non-viewing uses of

ipconfig are actually related not to configuring a host but rather controlling the operation of

protocols such as DNS and DHCP. One common use of ipconfig is to force a host to seek

out a new DHCP lease, which an be done using “ipconfig /release” followed by “ipconfig /

renew”.

Table 310: Simplified Configuration Information From Windows ipconfig Utility

D:\aa>ipconfig

Windows IP Configuration

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : 148.64.133.73

Subnet Mask . . . . . . . . . . . : 255.255.192.0

Default Gateway . . . . . . . . . : 148.64.128.1

Table 311: Detailed Configuration Information From Windows ipconfig Utility

D:\aa>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : ixl

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Hybrid

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : 3Com PCI Ethernet Adapter

Physical Address. . . . . . . . . : 00-04-76-4E-75-3F

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 148.64.133.73

Subnet Mask . . . . . . . . . . . : 255.255.192.0

Default Gateway . . . . . . . . . : 148.64.128.1

DHCP Server . . . . . . . . . . . : 148.64.128.1

DNS Servers . . . . . . . . . . . : 148.78.249.200

148.78.249.201

Lease Obtained. . . . . . . . . . : April 19, 2003 11:51:37 AM

Lease Expires . . . . . . . . . . : April 19, 2003 12:21:37 PM

The winipcfg Utility

In earlier versions of Windows, a graphical tool called winipcfg is supplied (either instead of,

or in addition to, the ipconfig command-line utility). This program allows configuration

parameters to be examined in much the same way as ipconfig, and also allows DHCP

leases to be released and renewed, but does not support the other options of ipconfig (such

as displaying the host’s DNS cache). An example of the main winipcfg screen is shown in

Figure 322.

Key Concept: On UNIX systems, the ifconfig utility can be used to display or modify

a large number of TCP/IP configuration settings. Windows systems provide either

the command-line utility ipconfig or the graphical tool winipcfg. Both let an adminis-

trator see basic TCP/IP configuration information for a host and allow tasks to be performed

such as renewing a DHCP lease, but they are otherwise quite limited compared to the UNIX

ifconfig program.

Figure 322: Windows 95/98/ME winipcfg Utility

The winipcfg utility can be used in older consumer-oriented versions of Windows to check the configuration of

a host and release/renew DHCP leases.

Miscellaneous TCP/IP Troubleshooting Protocols: Echo, Discard,

Character Generator, Quote Of The Day, Active Users, Daytime,

Time

The old quip says that the only guarantees in life are death and taxes. When it comes to

networking, you can add a few more, including this one: as soon as you set up a network, it

will very quickly develop problems that you will need to address. Recognizing that the

complexity of TCP/IP internetworks would make diagnosing certain problems difficult, the

suite’s architects defined a number of miscellaneous utility protocols that can be helpful in

testing and troubleshooting networks. Despite having been around for over 20 years, these

protocols are somewhat obscure and get little attention. I too will not devote much time to

them (since they are no longer implemented on many systems) but I do feel they are worth

a quick look.

These simple protocols are designed to be implemented as services that run on TCP/IP

servers. Each listens for requests on a dedicated well-known port number, and then

responds with a particular type of information. These protocols can be used with both TCP

and UDP, enabling each transport protocol to be tested. In the case of UDP, the server

counts each UDP sent to it as a request, and sends a response to it. When used with TCP,

a connection is of course first established by the client to the server. In some of the

protocols, this connection is then used to send data continuously between the client and

server; in others, the establishment of the connection is considered an implied request to

the server, which will immediately send a response and then close the connection.

Table 312 provides a brief description of each of these troubleshooting protocols/services

under both UDP and TCP. I have shown for each the port number that the service uses, and

also the RFC that defines it, if you want additional information.

Table 312: Miscellaneous TCP/IP Troubleshooting Protocols (Page 1 of 2)

Protocol

Well-

Known

Port

Number

Defining

RFC

Description

Echo Protocol 7 862

Echoes received data back to its originator. When used on

UDP, the payload of each message is simply packaged

into a return UDP datagram and sent back. For TCP, each

byte sent by the client is echoed back by the server until

the connection is closed.

Discard Protocol 9 863

Throws away all data that is sent to it. I think this should be

called the “Black Hole Protocol”. ☺