Open Internet Explorer and connect to www.google.com. Move to step 3 right away. Type the netstat command again. Now you should see additional entries, as shown in

Implementing TCPIP in the Command Line | 109 The host names are followed by the inbound port called http, which is the equivalent of port 80. The local computer is making connections to Google on outbound ports 2472 and 2473. Note that the ports used by your computer will be different because they are dynamically assigned. This command and the following two commands can be helpful when tracking applications and the network connections they make.

4. Type the command netstat –a. This displays TCP and UDP connections.

5. Type the command netstat –an. This displays TCP and UDP connections in numeric for-

mat. For many administrators, being able to view IP addresses and port numbers is easier than going by name. Netstat –n produces numerical results but for TCP connections only.

6. Type the command netstat –e. This displays Ethernet statistics such as the number of

packets and bytes sent and received, as shown in Figure 5-13. Figure 5-13 Netstat –e

7. Type the command netstat –r. This displays the route table, which is the same result

you would get if you were to type the route print command that we describe later. 8. Type the command netstat –s. This displays statistics per protocol, such as TCP, UDP, ICMP, IP, and so on. Check out the rest of the options for netstat. You will note that you can fine tune the results of the netstat command in several ways. Now, let’s move on to nbtstat.

9. Type the command nbtstat. This displays the help file for the command. Nbtstat will

display NetBIOS over TCPIP statistics for local and remote computers. NetBIOS was developed in the 1980s to allow applications to communicate over a network via the session layer of the OSI model. NetBIOS over TCPIP sends the NetBIOS protocol within TCP and UDP sessions. 10. Type the command nbtstat –a [local computername]; for example: nbtstat –a desktop-lamp1, as shown in Figure 5-14. The same results can also be achieved by typing nbtstat –n. Figure 5-14 Nbtstat –a 110 | Lesson 5 11. Type the command nbtstat –a [remotename]. Use the name of a computer on your network that you can connect to with ping. The results of the nbtstat command will display the major services that are running on that machine. For example, 00 is the workstation service, used to allow connections to remote computers. 20 is the server service, used to allow other computers to connect to the local computer. If you see 03, this is the messenger service. Many organizations have policies stating that this should be turned off. This command works well to discern the services running on a local or remote machine and can help when troubleshooting why a computer cannot make particular network connections. You can also connect by IP address. 12. Type the command nbtstat –A [IPAddress]; for example, nbtstat –A 10.254.254.205. This produces the same information but allows you to connect via IP address. So, the lowercase “a” option is used for names and the uppercase “A” is used for IP addresses. Let’s attempt to stop a service and view the results with nbtstat:

a. Stop the workstation service on a remote computer. This can be done in the

Computer Management console window or by typing the command net stop workstation.

b. Next, run the nbtstat –A command to that remote computer’s IP address. You

should see that the 00 service is no longer listed.

c. Restart the service on the remote computer within Computer Management.

d. Run the nbtstat –A command again to verify that it is listed. A restart of the remote computer might be necessary.

13. Type the command nbtstat –r. This displays NetBIOS name resolution statistics.

14. Type the command nbtstat –R. This purges the contents of the NetBIOS name cache

table.

15. Type the command nbtstat –RR. This releases and refreshes NetBIOS names.

The previous two commands are used in conjunction with Lmhosts and WINS, respectively, and they are not commonly employed in today’s networks.

16. Type the command nbtstat –s. This displays NetBIOS sessions and attempts to con-

vert the remote IP addresses to names. You might have to make a network connection or two before this command will display any results.

17. Type the command nbtstat –S. This displays the same sessions as with the –s

parameter. The only difference is that remote computers will be listed by IP address. Generally, it is wise to use uppercase options such as –A and –S. These provide results by IP address, which is usually preferred by network administrators. ANALYZE NETWORK PATHS WITH TRACERT AND PATHPING GET READY. In this exercise, we analyze network paths with tracert and pathping. Both show paths to remote destinations, extending beyond one or more routers, but their syntax and results differ. Plus, pathping analyzes the trace after it makes it, further differentiating it from tracert. An Internet connection is required. 1. Type the command tracert and view the results. This or tracert ? will display the help file for the command. Review the details in the help file. The tracert command shows paths to a destination on another network. It does this by pinging each step along the way three times. The time to live TTL for the pings increases with each “hop” to another network.