HOW TO
-
Use nbtscan to quickly sweep your subnet and get really cool NetBIOS/MAC address/ IP address info.
-
Go install Microsoft Support Tools to make your life a bit easier.

We look at netcap and dhcploc
TIPS
Create a SUPER ADMIN or Master menu by simply creating a folder with the following MASTER.{ED7BA470-8E54-465E-825C-99712043E01C} in Windows 7.
A really cool trick that will enable you to quickly open a CMD window in Windows 7:
- open Windows Explorer
- find the required folder and right-click it while holding the shift button down.
One of the context menus is the "Open Command Prompt Here" option.
Change your IP address with a batch file
I created a batch file to set my ethernet adapter to a static address of
10.10.10.1.
Just paste the code into notepad and save it with a BAT
extension;
netsh interface ip set address name="Local Area Connection"
source=static addr=10.10.10.1 mask=255.255.255.0
netsh interface ip set address name="Local Area Connection"
gateway=10.10.10.1 gwmetric=0 netsh interface ip set dns name="Local
Area Connection" source=static addr=10.10.10.1
netsh interface ip add dns name="Local Area Connection" addr=10.10.10.1
--------------------------------------------
Then I created another one to put me back to DHCP;
Rem set LAN card to
DHCP
netsh interface ip set address name="Local Area Connection" source=dhcp
netsh interface ip set dns name="Local Area Connection" source=dhcp
register=PRIMARY
netsh interface ip set wins name="Local Area Connection" source=dhcp
Windows Support Tools(Windows 2000/XP)
netsh(Windows 2000/XP)
From Microsoft's web site;
Netsh is a command-line scripting utility that allows you to, either
locally or remotely, display or modify the network configuration of a
computer that is currently running. Netsh also provides a scripting
feature that allows you to run a group of commands in batch mode against
a specified computer. Netsh can also save a configuration script in a
text file for archival purposes or to help you configure other servers.
Favorite examples;
netsh diag gui
- Shows troubleshooting GUI
Pathping (Windows 2000/XP)
From Microsoft's web site;
"Provides information about network latency and network loss at
intermediate hops between a source and a destination. Pathping sends
multiple Echo Request messages to each router between a source and
destination over a period of time and then computes results based on the
packets returned from each router. Because pathping displays the degree
of packet loss at any given router or link, you can determine which
routers or subnets might be having network problems. Pathping performs
the equivalent of the tracert command by identifying which routers are
on the path. It then sends pings periodically to all of the routers over
a specified time period and computes statistics based on the number
returned from each. Used without parameters, pathping displays help."
Sample output with a WAN problem;
C:\Documents and Settings\Tony Fortunato>pathping 206.210.104.90
Tracing route to 206.210.104.90 over a maximum of 30 hops
0 MARVIN.13819_linksys [10.44.10.101]
1 13819_linksys.13819_linksys [10.44.10.1]
2 172.16.4.1
3 E0-0.BMTNON01BR0.iasl.com [206.210.96.129]
4 FA00-106.MISSON10.iasl.com [206.210.107.251]
5 fa00-207.MISSON07BR0.iasl.com [206.210.109.81]
6 atm0-0-0-40.uaca6.WNDSON01.iasl.com [206.210.104.45]
7 206.210.104.90
Computing statistics for 175 seconds...
Source to
Here This Node/Link
Hop RTT Lost/Sent = Pct Lost/Sent = Pct
Address
0
MARVIN.13819_linksys[10.44.10.101]
0/ 100 = 0% |
1 0ms 0/ 100 = 0%
0/ 100 = 0% 13819_linksys.13819_linksys [10.44.10.1]
0/ 100 = 0% |
2 19ms 0/ 100 = 0%
0/ 100 = 0% 172.16.4.1
10/ 100 = 10% | 3 25ms
19/ 100 = 19% 9/ 100 = 9%
E0-0[206.210.96.129]
0/ 100 = 0% |
4 27ms 12/ 100 = 12%
2/ 100 = 2% FA00-106.MIS.com [206.210.107.251]
0/ 100 = 0% |
5 38ms 10/ 100 = 10%
0/ 100 = 0% fa00-207.com [206.210.109.81]
0/ 100 = 0% |
6 43ms 14/ 100 = 14%
4/ 100 = 4% atm0-0-0-40 [206.210.104.45]
0/ 100 = 0% |
7 43ms 10/ 100 = 10%
0/ 100 = 0% 206.210.104.90
Display Network Error Statistics (Windows 2000/XP)
This registry entry will display error statistics on the Network
Connection Status page for LAN and WAN connections.
Registry Settings System Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\Connections\
StatMon
Value Name: ShowLanErrors
Data Type: REG_DWORD (DWORD Value)
Value Data: (0 = default, 1 = enable error count)
Disclaimer:
Modifying the registry can cause serious problems that may
require you to reinstall your operating system.
The Technology Firm will not guarantee that problems
resulting from modifications to the registry can be solved.
Use this information at your own risk.
Bugs
TCP Checksum Errors
I just figured out why I had a bunch of
"TCP CHECKSUM Errors" reported by my protocol analyzer.
WIN2K
Authentication Problem
Daniel Cayer, P.Eng, CCNA documented an authentication problem.
Thanks Dan.
Bug -SSDP UDP 1900 - June 12, 2004
Alain Lacasse
If you find a lot of ICMP unreachable packets (debug ip icmp on Cisco
rtr) sent by your router to specific workstations, you may have Windows
XP PC(s) running either the SSDP service or using SSDP via Windows
Messenger to find WM gateways. In both cases, the PC sends UDP packets
to port 1900 (SSDP) and the router answers every packet (every 15 secs)
with an ICMP unreachable.
http://support.microsoft.com/default.aspx?scid=kb;en-us;317843
(Solution: find the PC and turn off the service/un-install WM)
Bug -Windows 2000 Does Not Use Configured TCPWindowSize Registry
Parameter When Accepting a Connection (Q263088) - July 22, 2002
Windows 2000 does not use the configured TCPWindowSize registry
parameter when accepting a connection (SYN-ACKing) if you configure the
parameter per interface and if the value is equal to or greater than
64240 (it uses a window size of 17520 instead, if you are using
Ethernet).
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q263088
Bug -Windows TCP/IP May Retransmit Packets Prematurely - January 21,
2001
When you are transmitting data over high-delay networks (for example,
satellite links), transfer throughput may be lower than expected and the
number of packets retransmitted may be unnecessarily high.
http://support.microsoft.com/support/kb/articles/Q236/9/26.ASP
http://support.microsoft.com/support/kb/articles/Q232/5/12.ASP
Bug - Microsoft/Cisco - April 27, 2001
From the folks at EDS...
- Interesting Microsoft/Cisco article.
Titled, 'Microsoft XP, Cisco Switch Conflict Crashes Network '
Bug - Microsoft NT Servers - NOVEMBER 29, 2000
Alfio Constantino, Glenn Davies & Tony Fortunato
The Remote Access Service (RAS) queries for the following name every two
minutes by default:
JSPNRMPTGSBSSDIR .
From Microsoft:
If you have a RAS server configured to use WINS or DNS resolution, the
queries may be sent across routers or dial-up lines.
As A result, the following event may be written to the system log during
the initial startup of your Remote Access Server (RAS) set up to receive
TCP/IP dial-in clients:
Event ID: 20026
Source: RemoteAccess
Type: Error
Description: Remote Access Server Security Failure. A network error has
occurred when trying to establish a session with the security agent on
LANA x. The error code is the data.
NOTE: x is the LANA number of your network card.
In some cases the Remote Access Server service fails to start.
CAUSE
The name JSPNRMPTGSBSSDIR is announced regularly and is a normal
occurrence from a Windows NT Server or Workstation computer running the
Windows NT Remote Access Service (RAS).
WORKAROUND
In some cases, a WINS or DNS server may be across a dial-up router on
the network. This behavior may cause unnecessary traffic across these
interfaces. A trace from Network Monitor may show queries for the name
JSPNRMPTGSBSSDIR.
Use one of the following methods to prevent this name query from being
broadcast:
* Create an LMHOSTS file with the following entry:
x.x.x.x JSPNRMPTGSBSSDIR #PRE
where x.x.x.x is an IP address associated with the RAS server's network
interface card.
-or-
* If you are using DNS, create an A record for JSPNRMPTGSBSSDIR in the
domain for which the DNS server is authoritative.
NOTE: The client (resolver) must have the domain name field in
TCPIP/DNS/Domain name populated with the domain name that the A record
is created in on the DNS server. If there are entries listed in the
domain suffix search order of the client, this must be the first domain
listed.

