CHAPTER 12 : Network Troubleshooting Methodology 616 (for example, how much hard disk space is available). To install the SNMP service on a Windows computer, you need to be logged on as a member of the Administrators group. The SNMP agent software is installed as a Windows Component and runs as a service. Telnet Telnet is a TCP/IP-based service that allows users to log onto a computer from a remote location, run character-mode or command-line utilities on the remote computer or device, and view files on a remote device. Windows 2000 and 2003 Server computers include both Telnet server and Telnet client software, while Windows client operating systems such as Windows 2000 and XP Professional only include the Telnet client. Telnet differs from FTP in that you cannot transfer files from one computer to another (upload or download). Telnet is often used to access a UNIX shell account on an ISP’s server and delete e-mail messages directly from the server without downloading them to the local machine. The Telnet server service uses TCP port 23 to listen for Telnet requests. SMTP The Simple Mail Transfer Protocol is used for sending e-mail messages, typically across the Internet. SMTP is a simple ASCII protocol and is not vendor-specific. Because SMTP has limited capability in queuing messages at the receiving end, most e-mail client programs use SMTP for sending e-mail only, and either Post Office Protocol version 3 (POP3) or Internet Message Access Protocol (IMAP) for storing any messages that are received by an e-mail server. The SMTP service uses TCP port 25 to send messages using SMTP. HTTP The HyperText Transfer Protocol is perhaps the most familiar of the application layer protocols because it is used on the World Wide Web, the most popular Internet service. HTTP allows Exam Warning SNMP management software is not currently included with the Windows operating system and has to be purchased and installed separately. Exam Day Tip Because it usually sends usernames and passwords in clear-text the use of Telnet has been almost entirely superseded by Secure Shell Host (SSH). If you are troubleshooting a remote device like a router or a switch, you can use SSH for better security whenever required. Troubleshooting the Application Layer 617 computers to exchange files in various formats (text, graphic images, sound, video, and other multimedia files) via client software called a Web browser. A computer running a Web server program, such as Microsoft’s Internet Information Server, stores files in HyperText Markup Language (HTML) format that can be accessed by the client browser. These HTML pages often contain hyperlinks for quickly and automatically connecting to other files on the Internet, on an intranet, or on the local machine. The HTTP protocol uses TCP port 80 to send and receive information to Web servers and clients. NNTP Network News Transfer Protocol (NNTP) is used for managing messages posted to private and public newsgroups. NNTP servers provide for storage of newsgroup posts, which can be downloaded by client software called a newsreader. Windows 2000 and 2003 Server include an NNTP server as a part of IIS. Outlook Express, which is part of the Internet Explorer software included with Windows 2000, XP, and 2003, provides both an e-mail client and a newsreader. The NNTP service defaults to using TCP port 119. DNS The Domain Name System is used by most of the other applications in the TCP/IP suite to resolve hostnames to IP addresses. A Web browser, for example, cannot establish a connection to a Web server unless it knows the IP address of the server. DNS is used to resolve hostnames, such as www.microsoft.com, to IP addresses. DNS is a distributed database that is essential for TCP/IP to be used on a massive Internet-sized scale. It provides a function that hides the complexity of IP addresses from users, and makes things such as e-mail and the World Wide Web much easier to use. DHCP The Dynamic Host Control Protocol is used to dynamically assign TCP/IP addresses and configuration information to clients and servers. IP addressing information is leased by a DHCP server for a specific period of time, usually three days, before the lease must be renewed by the client. You can also use a DHCP server to centrally configure TCP/IP client options such as the default gateway, subnet mask, and DNS servers for your DHCP clients. This is particularly convenient because if you need to change one of these options you can change it once on the DHCP server rather than needing to make a change on every single client in your environment. Windows NT, 2000, 2003, and UNIX/Linux servers can act as a DHCP server; all Windows and UNIX/Linux can act as clients. You can use the ipconfig /release and ipconfig /renew commands to refresh the DHCP configuration on a particular workstation. CHAPTER 12 : Network Troubleshooting Methodology 618 Determining the Impact of Modifying, Adding or Removing Network Services for Network Resources and Users Because the application layer is the layer at which name resolution services like DNS and WINS (Windows Internet Naming Service) function, this is the layer you’ll be working at if you run into a troubleshooting scenario involving clients that cannot access resources using their Fully Qualified Domain Names (FQDNs) or NetBIOS names. This builds from the troubleshooting that you performed at all of the layers below: at the physical layer, you looked for broken cables or malfunctioning NICs to isolate physical connectivity problems. At the network layer, you used ping and tracert (or traceroute for a UNIX/Linux computer) to determine if network packets were being properly routed from one host to another. Troubleshooting the application layer means that all of the underlying layers are functioning properly, but your clients are still running into problems. If you can ping a remote host using its IP address, but pinging its FQDN returns a Request Timed Out error, then you have an issue with DNS name resolution. You can use nslookup or dig to troubleshoot an existing DNS server, as we discussed in the previous chapter. If, on the other hand, you are working on an internal network that doesn’t have a DNS server in place, you should consider implementing one so that your clients can access remote resources by using easy-to-remember hostnames rather than IP addresses. Likewise, if your clients are unable to access remote hosts using their NetBIOS names, but they are able to access computers using their associated IP addresses, then you need to put a mechanism in place to allow your clients to perform NetBIOS name resolution. This is especially necessary to allow access to file and print services on a Windows network, because these services rely heavily on NetBIOS name resolution. On a small network with only two or three hosts, you can do this by placing an lmhosts file on each computer. An lmhosts file is a plain text file that includes the IP address of the host in question, followed by its NetBIOS name, as you can see here: 10.0.0.8 SERVER1 10.0.0.1 SERVER2 10.0.0.105 SERVER3 Exam Warning Windows DHCP clients are able to use Automatic Private IP Addressing (APIPA) if they are unable to contact a DHCP server. This allows for limited connectivity using the 169.254.0.0 Class B address that does not include DNS name resolution or a default gateway. Troubleshooting the Application Layer 619 Once you go beyond a small number of clients and hosts, though, lmhosts files become difficult to manage. For larger networks, you should install a WINS server to provide NetBIOS name resolution on a larger scale, and configure your network clients to use this WINS server to reg- ister their NetBIOS names so that other clients can locate the resources that they need. You can think of a WINS server as performing the same function for NetBIOS name resolution that DNS does for Internet-based name resolution. Layer 7 Troubleshooting You’ll probably spend quite a bit of time troubleshooting application layer issues, because these are the most visible to an end user. This can be some- thing as simple as “My Internet Explorer won’t work” to troubleshooting mail routing issues for an e-mail server that’s running SMTP. One of the most useful utilities for troubleshooting application layer protocols is Telnet, because you can use this tool to connect to many different application layer services by specifying the port that’s used by the service. So you can Telnet to a Web server, specifying port 80, to see if the Web server is listening on that port. If the Web server doesn’t respond, then you know that something is wrong with the Web service on that particular server. On the other hand, if you can successfully Telnet to port 80, then you know that the problem lies elsewhere and you can concentrate your troubleshooting efforts on problems with client configuration or name resolution. Identifying a Client’s Remote Network Access Problem There are multiple reasons that a client may encounter connectivity problems in gaining access to the network or network resources. In Exercise 12.3, we’ll go through the steps of troubleshooting the SMTP service on an e-mail server by using Telnet. Test Day Tip For a small number of clients, you can use a local host file for basic DNS resolution. A host file provides a similar format as an lmhosts file, except that it will use FQDNs instead of NetBIOS names. Exam Day Tip To troubleshoot name resolution problems, you can use the nslookup utility that we discussed at length in Chapter 11. CHAPTER 12 : Network Troubleshooting Methodology 620 EXERCISE 12.3 Using Telnet to Troubleshoot FTP Click 1. Start | All Programs | Accessories | Command Prompt to access the Windows command prompt. Type 2. telnet servername 25. Servername indicates the IP address or DNS name of the e-mail server that you are troubleshooting. 25 specifies that you are Telnetting to port 25 of that server. So to con- nect to the mail.example.com server, you would type telnet mail. example.com 25 at the command prompt. If this is successful, you’ll see something like this: 220 mail.example.com Microsoft Exchange Internet Mail Connector From here, you can try to send a test e-mail message directly from 3. the Telnet window. Begin by typing the following (substitute the domain of a valid e-mail address for example.com): HELO example.com If this command works, you’ll see the following:4. 250 OK Next, specify the e-mail address that the test message is from by 5. entering the following, using a valid e-mail address: MAIL FROM:user@example.com If this was successful, you’ll see the following:6. 250 OK – MAIL FROM user@example.com Next, specify the e-mail address to send the test message to. Type 7. the following, using a valid recipient address that’s located on the server you’re testing (so if you’re troubleshooting the example.com e-mail server, try sending a test message to jenny@example.com rather than joe@mycompany.com). Use the following syntax to specify the recipient’s e-mail address: RCPT TO: jenny@example.com If this was successful, you’ll see the following:8. 250 OK – Recipient jenny@example.com Type 9. DATA to begin entering the text of your message. Then type the text of the test message that you want to send. Summary of Exam Objectives 621 To let the SMTP server know that you’re finished, type a period (.) 10. on a blank line and then press Enter. If the message was created successfully, you’ll see the following: 250 OK Type 11. QUIT to exit the Telnet session. Verify that the recipient received the test message. If it did not, you can check the error logs generated by the e-mail server, as well as the configuration of the recipient’s e-mail client. SUMMARY OF EXAM OBJECTIVES Troubleshooting TCP/IP and other network connectivity issues is made easier if you follow the “10 Commandments of Troubleshooting”: Know thy network.1. Use the tools of the trade.2. Take it one change at a time.3. Isolate the problem.4. Recreate the problem.5. Don’t overlook the obvious.6. Try the easy way first.7. Document what you do.8. Practice the art of patience.9. Seek help from others when you need it.10. There is a great deal of troubleshooting information for TCP/IP and other network issues. Be sure to take advantage of the following: Microsoft documentation, including Help files, the resource kits, white papers, TechNet, official newsgroups, and the Microsoft Web site. Third-party documentation, including Internet mailing lists, Usenet public newsgroups, Web resources, local user groups, and books and magazines. Following an organized set of troubleshooting steps allows you to organize the troubleshooting process and makes it less likely that you will CHAPTER 12 : Network Troubleshooting Methodology 622 overlook something important along the way. The problem-solving models used by other professions can be applied to network troubleshooting as well. Gathering information is always one of the first steps in problem solving. In network troubleshooting, as in most areas, this involves asking questions. Which questions to ask (and of whom) vary according to the situation, but the following can serve as a guideline to get you started:: Exactly what task were you trying to perform when the problem occurred? Were you doing anything else in addition to this primary task at the time? What error message(s), if any, were displayed? Is anyone else on the network experiencing the same problem? Have you ever been able to perform this task on this computer? When was the last time you were able to do so? What changes have occurred since the last time you were able to do so? To make a diagnosis or analysis of the information, you must organize it in a logical manner. This means learning to sift through and discard irrelevant information, and looking for patterns in the data. This also means setting priorities according to such factors as who is affected by the problem, how many are affected by the problem, and what production activities are affected by the problem, and how often the problem occurs. Solutions, once formulated, should also be prioritized according to cost, time involved, longevity, and long-term effect on performance. EXAM OBJECTIVES FAST TRACK How to Use the OSI Model in Troubleshooting Being able to isolate which layer a problem stems from allows you to identify the types of components that may be involved in the issue, thus helping you troubleshoot the problem. You should remember that the OSI model consists of seven lay- ers. When one computer communicates with another one, data at the sending computer is passed from one layer to the next until the physical layer finally puts it out onto the network cable. The most important thing that you can do when troubleshooting is to be organized and methodical in your approach to solving Exam Objectives Fast Track 623 problems. If you work in a rushed fashion, you’re likely to miss a crucial troubleshooting step or forget what you did to solve the problem the next time it occurs. When you are troubleshooting, remember the seven general steps outlined in this chapter. Troubleshooting the Physical Layer The physical layer is the lowest layer of the OSI model, and it is concerned with the physical cabling and network devices that connect you to the network. Troubleshooting often begins at the physical layer, where you need to determine if your network cards, hubs, and cabling are functioning and connected correctly. Be sure that you are using the correct type of NIC for your network type and the correct cabling to allow for network connectivity. Troubleshooting the Data Link Layer The data link layer is responsible for taking the information it gets from the physical layer and organizing it into frames. The devices that operate at the data link layer are switches and bridges. Troubleshooting these devices includes verifying that the correct frame type is being used and that any VLANs are configured correctly. The Spanning Tree Protocol (STP) can be used to prevent the possibility of loops on a switched or bridged network. Troubleshooting the Network Layer A great deal of your troubleshooting time will be spent at the network layer, as this actually controls how traffic is transmitted or routed between two computers. The most important device that operates at the network layer is the router, and router troubleshooting will include troubleshooting the physical device as well as how it is configured. ICMP operates at the network layer, and it is used to provide troubleshooting information for TCP/IP troubleshooting utilities such as ping, tracert, and traceroute. CHAPTER 12 : Network Troubleshooting Methodology 624 Troubleshooting the Transport Layer The TCP and the UDP both exist at the transport layer, which controls whether communications between computers are connection-oriented and acknowledged, or connectionless with low overhead. Use netstat –a to see a list of which TCP and UDP ports are currently listening on a particular server. You can use Telnet to test connectivity at the transport layer in addition to testing the application layer. Troubleshooting the Session Layer The session layer controls how two computers will create, maintain, and tear down a conversation (also called a session) between them. The session layer also controls whether a connection is full-duplex (able to transmit in both directions simultaneously), or half-duplex (only able to transmit in one direction at a time). A mismatch in full- versus half-duplex can create significant performance degradation between two computers that are attempting to communicate. Troubleshooting the Presentation Layer The presentation layer handles the way that data is formatted between different systems, such as translating text from a system that uses EBCDIC encoding and one that uses ASCII. In many cases, the function of the presentation layer is handled by the application layer service like HTTP, so isolating presentation layer problems can be difficult. Certain types of gateways also function at the presentation layer, such as Gateway Service for Netware in Windows 2000 Server. Troubleshooting the Application Layer The application layer is the top layer of the OSI model, and it pro- vides services to actual end user applications on the desktop or server. Be sure that you understand the difference between the application layer protocol, like HTTP, and the actual application that it supports, like Internet Explorer. Exam Objectives Frequently Asked Questions 625 You can use Telnet to connect to specific ports on a server to see if the HTTP, SMTP, and FTP protocols are functioning. EXAM OBJECTIVES FREQUENTLY ASKED QUESTIONS Is it possible for me to disable NetBIOS over TCP/IP (NetBT)?Q: Microsoft states that you can remove NetBT once you have a pure A: Windows 2000 environment. Because WINS relies on NetBT, you cannot disable NetBT until you are no longer relying on WINS for name resolution. Additionally, legacy applications and logon scripts often use NetBIOS names, and these must be modified to use DNS name resolution before you can remove NetBT. You can disable NetBT via DHCP on Windows 2000 clients when you are ready to make the change. What types of networks are most likely to use OSPF instead of RIP?Q: Large enterprise networks and very large internetworks, A: such as corporate campuses and global networks. Microsoft documentation generally recommends that OSPF be used for internetworks that include more than 50 networks. OSPF is also appropriate for networks in which the topology changes frequently, and those that include more than one path between pairs of end- points. What is a gateway, and why would I need one?Q: The word A: gateway has many different meanings in the Information Technology (IT) world. A protocol-translating gateway translates between different protocols. Think of it as the United Nations inter- preter of the networking world. If the president of the United States needs to exchange information with the chancellor of Germany, but neither speaks the other’s language, they can call in someone who is fluent in both to help them get their messages across. Similarly, if a mainframe system and a Windows 2000 computer need to com- municate with one another – perhaps the mainframe has important files that need to be accessed by the PC – but they don’t know how to “talk” to each other, you can install a gateway to clear up the con- fusion. The gateway is even more skilled than the interpreter is; it actually fools the mainframe into believing it’s communicating with another mainframe, and makes the PC think it is having a “con- versation” with a fellow PC. Gateway is also the term used to refer to the address of a router that connects your network to another, acting as the gateway to the “outside world”. . called a newsreader. Windows 2000 and 2003 Server include an NNTP server as a part of IIS. Outlook Express, which is part of the Internet Explorer software included with Windows 2000, XP, and. options such as the default gateway, subnet mask, and DNS servers for your DHCP clients. This is particularly convenient because if you need to change one of these options you can change it once. can use the ipconfig /release and ipconfig /renew commands to refresh the DHCP configuration on a particular workstation. CHAPTER 12 : Network Troubleshooting Methodology 618 Determining the Impact