Windows 7 Resource Kit- P33

Tools for Troubleshooting CHAPTER 31 1553 9 266 ff00::/8 On-link 8 276 ff00::/8 On-link 11 286 ff00::/8 On-link =========================================================================== Persistent Routes: None Fully interpreting the routing configuration requires a detailed understanding of IP networking; however, you can quickly identify default routes for traffic being sent to your default gateway by locating the Active Route with a Network Destination and Network Mask of 0.0.0.0 for IPv4 routes and an Active Route with the prefix ::/0 for IPv6 routes. Other Active Routes with a Gateway assigned cause traffic for the specific Network Destination and Network Mask to be sent through that gateway, with a preference for the route with the lowest metric. MoRe inFo For additional information on IPv6 networking, read Chapter 28, “Deploying IPv6.” If you must manually update the IPv4 routing table (you should typically make changes to the network infrastructure that assigned the routes to the client), you can use the route add, route change, and route delete commands. For more information, type route –? at a command prompt. To update the IPv6 routing table, you must use the netsh interface ipv6 add|set|delete route commands. Task Manager Task Manager (Taskmgr.exe) is a GUI tool that you can use to view or end a process or an unresponsive application. You can also use Task Manager to gather other information, such as CPU statistics. To start Task Manager, click Start, type Taskmgr, and then press Enter. Alternatively, you can right-click the taskbar and then click Task Manager. The Windows Task Manager window contains six tabs: Applications, Processes, Services, Performance, Networking, and Users. n The Applications and Processes tabs provide a list of applications or processes that are currently active on your system. These lists are valuable because active tasks do not always display a user interface, which can make it difficult to detect activity. Task Man- ager displays active processes and lets you end most items by clicking End Process. You cannot end some processes immediately; you might need to use the Services snap-in or Taskkill to end them. You can also customize Task Manager to increase or decrease the level of detail shown on the Processes tab. n The Services tab displays running services and their PID. If you determine that a specific PID is using network resources and you find the PID on this tab, you know that a service Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 31 Troubleshooting Network Issues 1554 is causing the network utilization. To stop a service, right-click it and then click Stop Service, as shown in Figure 31-4. FIGURE 31-4 Use the Services tab to identify services by PID and stop them. n The Performance tab graphically displays process and memory utilization. Viewing this tab quickly reveals the total utilization of all programs and services on the computer. The Performance tab also shows key performance counters including the number of processes, the number of threads, and the total physical memory installed in the system. n The Networking tab shows the utilization of all network interfaces. n With the Users tab, you can disconnect and log off active users. To view detailed information about processes, follow these steps: 1. Start Task Manager and then click the Processes tab. 2. Optionally, click Show Processes From All Users. 3. On the View menu, click Select Columns. 4. Select or clear the columns that you want to add to, or remove from, the Processes tab. 5. Click OK to return to Task Manager. To identify the cause of high processor utilization, follow these steps: 1. Start Task Manager and then click the Performance tab. 2. Click the View menu and then select Show Kernel Times (if it is not already selected). 3. Examine the CPU Usage History graph. If the graph shows values close to 100 percent, one process or multiple processes are consuming the bulk of the computer’s process- Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Tools for Troubleshooting CHAPTER 31 1555 ing capability. The red line shows the percentage of the processor consumed by the kernel, which includes drivers. If the bulk of the processing time is consumed by the kernel, verify that you are using signed drivers and have the latest version of all drivers installed. If the kernel is not responsible for the majority of the processor usage, con- tinue following these steps to identify the process. 4. Click the Processes tab. 5. Click the CPU column heading twice to sort the processes by processor utilization with the highest utilization at the top of the list. The process or processes consuming the processor will show high CPU utilization values. When the processor is not being used heavily, the System Idle Process shows high CPU utilization. To find the PID of an application, follow these steps: 1. Start Task Manager and verify that the Process ID (PID) column is displayed on the Processes tab. If it is not displayed, open the View menu, click Select Columns, and then select PID. Click OK. 2. Click the Applications tab. 3. Right-click the application and then click Go To Process. Task Manager will display the Processes tab. The process associated with the application will be highlighted. The PID is shown in the PID column. To stop a process, follow these steps: 1. Start Task Manager and then click the Processes tab. 2. Right-click the process you want to stop and then click End Process. Task Manager will attempt to end the process. If Task Manager fails, use Taskkill. To identify the network utilization, start Task Manager and then click the Networking tab. Task Manager shows the utilization of each network adapter. The percentage of utilization is measured in relation to the reported Link Speed of the adapter. In most cases, network adapters are not capable of 100 percent utilization; peak utilization is approximately 60 per- cent to 70 percent. MoRe inFo For additional information on using Task Manager, refer to Chapter 21. TCPView TCPView, shown in Figure 31-5, monitors both incoming and outgoing connections, as well as listening applications, in real time. You can use TCPView to identify exactly which servers a client connects to, including the port numbers, or identify the clients connecting to a server. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 31 Troubleshooting Network Issues 1556 FIGURE 31-5 TCPView allows you to monitor network connections in real time. To download TCPView, visit http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx. You do not need to install TCPView; simply copy the executable file to a folder that allows applications to be run (such as C:\Program Files\) and then double-click Tcpview.exe. TCPView also includes Tcpvcon.exe, a command-line tool that provides similar functionality. Telnet Client Although it is not primarily a troubleshooting tool, Telnet Client is extremely useful for determining whether TCP-based network services are reachable from a client. Most commonly used network services are TCP based, including Web services, mail services, and file transfer services. Telnet Client is not useful for troubleshooting UDP-based network services such as DNS and many streaming media communications. Telnet Client is not installed by default in Windows 7. To install it, run the following command from a command prompt with administrative privileges. start /w pkgmgr /iu:"TelnetClient" Alternatively, you can install it by following these steps: 1. Click Start and then click Control Panel. 2. Click Programs. 3. Click Turn Windows Features On Or Off. 4. In the Windows Features dialog box, select the Telnet Client check box. Click OK. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Tools for Troubleshooting CHAPTER 31 1557 Telnet Client is useful only for determining whether a service is reachable, and it will not provide information that you can use for troubleshooting name resolution, network perfor- mance, or network connectivity problems. Use Telnet Client only after you have used Ping to eliminate the possibility of name resolution problems. For more information about Ping, see the section titled “Ping” earlier in this chapter. Testing Service Connectivity After you have identified the port number for the service, you can use Telnet Client to test connectivity to that service. To test connectivity to a service, open a command prompt and run the following command. telnet destination portnumber For example, to test HTTP connectivity to www.microsoft.com, type the following command at the command line. telnet www.microsoft.com 80 The destination might be a host name, computer name, or IP address. The response you receive will indicate whether a connection was established. If you receive the message “Could not open connection to the host,” the host did not respond to the request for a connection on the port number you specified, and the service you are testing is unreachable. If you receive any other response, including all text disappearing from the command window, the connection was successfully established. This eliminates the possibility that the problem you are troubleshooting is caused by a connectivity issue between the client and the server. Depending on the service you are testing, Telnet Client can be automatically discon- nected, or the session might remain open. Either circumstance indicates a successful connec- tion. If the Telnet Client session remains open, you should disconnect Telnet Client to close the connection. To disconnect Telnet Client, follow these steps: 1. Press Ctrl+]. 2. When the Microsoft Telnet> prompt appears, type quit. Test TCP With Test TCP, you can both initiate TCP connections and listen for TCP connections. You can also use the Test TCP tool for UDP traffic. With Test TCP, you can configure a computer to listen on a specific TCP or UDP port without having to install the application or service on the computer. This allows you to test network connectivity for specific traffic before the services are in place. Test TCP (Ttcp.exe) is a tool that you can use to listen for and send TCP segment data or UDP messages between two nodes. Ttcp.exe is provided with Windows Server 2003 in the Valueadd\Msft\Net\Tools folder of the Windows Server 2003 or Windows XP Service Pack 2 (SP2) product CD-ROM. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 31 Troubleshooting Network Issues 1558 Test TCP differs from Port Query in the following ways: n With Test TCP, you can configure a computer to listen on a specific TCP or UDP port without having to install the application or service on the computer. This allows you to test network connectivity for specific traffic before the services are in place. For example, you could use Test TCP to test for domain replication traffic to a computer before you make the computer a domain controller. n Test TCP also supports IPv6 traffic. When you are using a TCP port, the following code shows the basic syntax for Ttcp.exe on the listening node (the receiver): ttcp -r –pPort When using a UDP port, use the following syntax. ttcp -r –pPort -u After starting Test TCP in receive mode, the tool will wait indefinitely for a transmission before returning you to the command prompt. The first time you use Test TCP to listen from a computer running Windows 7, you might be prompted to create a Windows Firewall exception. You must create the exception for Test TCP to work. If you choose to unblock the application, Windows Firewall will allow all traffic for that computer on the specified port in the future. Therefore, you will not need to create a new exception for that network type, even if you listen on a different port. In Windows Firewall, the exception is named Protocol Independent Perf Test Command. When you are using a TCP port, the following code shows the basic syntax for Ttcp.exe on the sending node (the transmitter): ttcp -t -pPort hostname When using a UDP port, use the following syntax. ttcp -t –pPort -u hostname If the two computers are able to communicate, the transmitting computer will display output such as the following. ttcp-t: Win7 -> 192.168.1.132 ttcp-t: local 192.168.1.196 -> remote 192.168.1.132 ttcp-t: buflen=8192, nbuf=2048, align=16384/+0, port=81 tcp -> Win7 ttcp-t: done sending, nbuf = -1 ttcp-t: 16777216 bytes in 1423 real milliseconds = 11513 KB/sec ttcp-t: 2048 I/O calls, msec/call = 0, calls/sec = 1439, bytes/call = 8192 Meanwhile, the receiving computer will display output similar to the following. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Tools for Troubleshooting CHAPTER 31 1559 ttcp-r: local 192.168.1.132 <- remote 192.168.1.196 ttcp-r: buflen=8192, nbuf=2048, align=16384/+0, port=81 tcp ttcp-r: 16777216 bytes in 1416 real milliseconds = 11570 KB/sec ttcp-r: 3492 I/O calls, msec/call = 0, calls/sec = 2466, bytes/call = 4804 You can use Test TCP to connect to any computer listening for incoming TCP connections, even if that computer is not running Test TCP. However, to accurately test UDP connectivity, Test TCP must be running on both the receiver and transmitter. For example, to attempt a connection to www.microsoft.com on TCP port 80, you would run the following command. ttcp -t -p80 www.microsoft.com ttcp-t: local 192.168.1.196 -> remote 10.46.20.60 ttcp-t: buflen=8192, nbuf=2048, align=16384/+0, port=80 tcp -> www.microsoft.com send(to) failed: 10053 ttcp-t: done sending, nbuf = 2037 ttcp-t: 81920 bytes in 16488 real milliseconds = 4 KB/sec ttcp-t: 11 I/O calls, msec/call = 1498, calls/sec = 0, bytes/call = 7447 In this example, the TCP connection was successful, even though the output includes the line “send(to) failed.” If the connection was unsuccessful, the output would have included the phrase “connection refused.” Alternatively, some servers will simply not respond to invalid communications, which will cause the Test TCP transmitter to pause indefinitely while it awaits a response from the server. To cancel Test TCP, press Ctrl+C. Each instance of Test TCP can listen on or send to only a single port. However, you can run it in multiple command prompts to listen or send on multiple ports. For additional command- line options, type Ttcp at the command prompt. Windows Network Diagnostics Troubleshooting network problems is complicated, especially for users. Many users discover network problems when they attempt to visit a Web page with Internet Explorer. If the Web page is not available, Internet Explorer returns the message “Internet Explorer cannot display the webpage.” The problem could be any one of the following, however: n The user mistyped the address of the Web page. n The Web server is not available. n The user’s Internet connection is not available. n The user’s LAN is not available. n The user’s network adapter is misconfigured. n The user’s network adapter has failed. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 31 Troubleshooting Network Issues 1560 The cause of the problem is important for the user to understand. For example, if the Web server is not available, the user does not need to take any action—the user should simply wait for the Web server to become available. If the Internet connection has failed, the user might need to call her Internet service provider (ISP) to troubleshoot the problem. If the user’s network adapter has failed, she should attempt to reset it and contact her computer manu- facturer’s technical support for additional assistance. Windows Network Diagnostics and the underlying Windows Troubleshooting Platform assist users in diagnosing and, when possible, resolving network connectivity issues. When Windows 7 detects network problems, it will prompt the user to diagnose them. For example, Internet Explorer displays a link to start Windows Network Diagnostics if a Web server is unavailable, and the Network And Sharing Center will display a diagnostic link if a network is unavailable. Applications might prompt users to open Windows Network Diagnostics in response to connectivity problems. To start Windows Network Diagnostics manually, open Network And Sharing Center, click Troubleshoot Problems, and follow the prompts that appear. Unlike many of the tools described in this chapter, Windows Network Diagnostics is designed to be useful without a deep understanding of network technologies. For more information about Windows Network Diagnostics, see Chapter 25. The Process of Troubleshooting Network Problems To most users, the term connectivity problems describes a wide range of problems, including a failed network connection, an application that cannot connect because of firewall filtering, and serious performance problems. Therefore, the first step in troubleshooting connectivity problems is to identify the scope of the connectivity problem. To identify the source of a connectivity problem, follow these steps and answer the ques- tions until you are directed to a different section: 1. Open the Network And Sharing Center by clicking the network icon in the system tray and then clicking Open Network And Sharing Center. At the bottom of the page, click Troubleshoot Problems and follow the prompts that appear. If Windows Network Diagnostics does not identify or resolve the problem, please choose to send the infor- mation to Microsoft to help improve Windows Network Diagnostics. Then, continue following these steps. 2. Are you attempting to connect to a wireless network, but your connection attempt is rejected? If so, see the section titled “How to Troubleshoot Wireless Networks” later in this chapter. 3. Are you attempting to connect to a remote network using a VPN connection, but your connection attempt is rejected? If so, see Chapter 27, “Connecting Remote Users and Networks.” Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. The Process of Troubleshooting Network Problems CHAPTER 31 1561 4. Can you occasionally access the network resource, but it is unreliable or slow? If so, see the section titled “How to Troubleshoot Performance Problems and Intermittent Connectivity Issues” later in this chapter. 5. Can you access other network resources using different applications, such as e-mail or different Web sites? If not, you have a network connectivity problem or a name resolu- tion problem. If you can contact servers using the IP address instead of the host name, see the section titled “How to Troubleshoot Name Resolution Problems” later in this chapter. If servers are not accessible when you specify an IP address or if you do not know an IP address, see the next section, “How to Troubleshoot Network Connectivity Problems.” 6. Are you trying to join a domain or log on to your computer using a domain account but are receiving an error message that the domain controller is unavailable? If so, see the section titled “How to Troubleshoot Joining or Logging on to a Domain” later in this chapter. 7. Open a command prompt and run the command Nslookup servername. If Nslookup does not display an answer similar to the following, you have a name resolution prob- lem. See the section titled “How to Troubleshoot Name Resolution Problems” later in this chapter for information on solving these problems. C:\>nslookup contoso.com Non-authoritative answer: Name: contoso.com Addresses: 10.46.232.182, 10.46.130.117 8. Are you trying to connect to a shared folder? If so, see the section titled “How to Troubleshoot File and Printer Sharing” later in this chapter. 9. If other network applications work and name resolution succeeds, you might have a firewall problem. See the section titled “How to Troubleshoot Application Connectivity Problems” later in this chapter. How to Troubleshoot Network Connectivity Problems If you have a network connectivity problem, you will be unable to reach any network resource that can normally be accessed using the failed network. For example, if your Internet connection has failed, you will be unable to access Internet resources, but you might still be able to access resources on your LAN. If your LAN fails, however, nothing will be accessible. Most network connectivity problems result from one of the following issues: n Failed network adapter n Failed network hardware n Failed network connection n Faulty network cables Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 31 Troubleshooting Network Issues 1562 n Misconfigured network hardware n Misconfigured network adapter note Often, people jump to the conclusion that the network has failed when only a single network resource has failed. For example, a failed DNS server will stop your computer from resolving host names, which would prevent the computer from finding resources on the network by name. Similarly, if the only network resource a user accesses is her e-mail server and that server has failed, the failure might appear to that user to be a total loss of connectivity. To avoid spending time troubleshooting the wrong problem, the processes in this chapter always start by isolating the cause of the problem. After you isolate the failed feature, you can work to resolve that specific problem or you can escalate the problem to the correct support team. For example, if you determine that the network adapter has failed, you will need to contact the hardware manufacturer for a replacement part. If you determine that the Internet connection has failed, you will need to contact your ISP. To isolate the cause of a network connectivity problem, follow these steps: 1. Open the Network And Sharing Center by clicking the network icon in the system tray and then clicking Open Network And Sharing Center. At the bottom of the page, click Troubleshoot Problems and follow the prompts that appear. If Windows Network Diagnostics does not identify or resolve the problem, continue following these steps. 2. Open a command prompt on the computer experiencing the problems. Run the command ipconfig /all. Examine the output as follows: n If no network adapters are listed, the computer either lacks a network adapter or (more likely) it does not have a valid driver installed. Refer to Chapter 30, “Trouble- shooting Hardware, Driver, and Disk Issues,” for more information. n If all network adapters show a Media State of Media Disconnected, the computer is not physically connected to a network. If you are using a wireless network, see the section titled “How to Troubleshoot Wireless Networks” later in this chapter. If you are using a wired network, disconnect and reconnect both ends of the network cable. If the problem continues, replace the network cable. Attempt to connect a different computer to the same network cable; if the new computer can connect successfully, the original computer has a failed network adapter. If neither com- puter can connect successfully, the problem is with the network wiring, the network switch, or the network hub. Replace the network hardware as necessary. n If the network adapter has an IPv4 address in the range of 169.254.0.1 through 169.254.255.254, the computer has an APIPA address. This indicates that the computer is configured to use a DHCP server, but no DHCP server is available. With administrative credentials, run the following commands at a command prompt. ipconfig /release ipconfig /renew ipconfig /all Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. [...]... ge-1-1-ur01.gardner.ma.boston.contoso.com [10. 87. 144.225] 5 10g-9-1-ur01.sterling.ma.boston.contoso.com [10. 87. 144.2 17] 6 te-9-2-ur01.marlboro.ma.boston.contoso.com [10. 87. 144 .77 ] 7 10g-8-1-ur01.natick.ma.boston.contoso.com [10. 87. 144.1 97] 8 10g-9-1-ur01.sterling.ma.boston.contoso.com [10. 87. 144.2 17] 9 te-9-2-ur01.marlboro.ma.boston.contoso.com [10. 87. 144 .77 ] 10 10g-8-1-ur01.natick.ma.boston.contoso.com [10. 87. 144.1 97] 11 10g-9-1-ur01.sterling.ma.boston.contoso.com... must be running Windows 7 Professional, Windows 7 Enterprise, or Windows 7 Ultimate  Windows 7 Starter, Windows 7 Home Basic, and Windows 7 Home Premium operating systems cannot join a domain How to Troubleshoot Network Discovery With Network Discovery, users can browse shared network resources from the Network window On private networks, this is convenient because users can connect to resources without... te-9-2-ur01.marlboro.ma.boston.contoso.com [10. 87. 144 .77 ] 10 10g-8-1-ur01.natick.ma.boston.contoso.com [10. 87. 144.1 97] 11 10g-9-1-ur01.sterling.ma.boston.contoso.com [10. 87. 144.2 17] 12 te-9-2-ur01.marlboro.ma.boston.contoso.com [10. 87. 144 .77 ] 13 10g-8-1-ur01.natick.ma.boston.contoso.com [10. 87. 144.1 97] How to Troubleshoot Joining or Logging on to a Domain Administrators often encounter problems when joining a computer running Windows to... c-3-0-ubr01.winchendon.ma.boston.contoso.com [10.165.8.1] 3 ge-3- 37- ur01.winchendon.ma.boston.contoso.com [10. 87. 148.129] 4 ge-1-1-ur01.gardner.ma.boston.contoso.com [10. 87. 144.225] 5 10g-9-1-ur01.sterling.ma.boston.contoso.com [10. 87. 144.2 17] 6 te-9-2-ur01.marlboro.ma.boston.contoso.com [10. 87. 144 .77 ] 7 10g-8-1-ur01.natick.ma.boston.contoso.com [10. 87. 144.1 97] 8 10g-9-1-ur01.sterling.ma.boston.contoso.com [10. 87. 144.2 17] 9 te-9-2-ur01.marlboro.ma.boston.contoso.com... whether the edition of Windows supports joining a domain, search for the keyword NetpDomainJoinLicensingCheck (most recent entries are at the bottom of the log file) If the ulLicenseValue is anything other than 1, it indicates that the edition of Windows cannot join a domain To join a domain, a computer must be running the Windows 7 Professional, Windows 7 Enterprise, or Windows 7 Ultimate operating... 10 10g-8-1-ur01.natick.ma.boston.contoso.com [10. 87. 144.1 97] 11 10g-9-1-ur01.sterling.ma.boston.contoso.com [10. 87. 144.2 17] 12 te-9-2-ur01.marlboro.ma.boston.contoso.com [10. 87. 144 .77 ] 13 n d820.hsd1.nh.contoso.com [192.168.1.196] 1 10g-8-1-ur01.natick.ma.boston.contoso.com [10. 87. 144.1 97] If any routers on line 2 or above respond (it doesn’t matter if the final host responds), the client computer... Misconfiguring Windows Firewall can cause several different types of connectivity problems On a computer running Windows 7 that is acting as the client, Windows Firewall might block outgoing communications for the application (though blocking outgoing communications is not enabled by default) On a computer running Windows 7 that is acting as the server (for example, a computer that is sharing a folder), Windows. .. www.microsoft.com [10.46.19.30] over a maximum of 30 hops: 0 win7.hsd1.nh.contoso.com [192.168.1.132] 1 192.168.1.1 2 c-3-0-ubr01.winchendon.ma.boston.contoso.com [10.165.8.1] 3 ge-3- 37- ur01.winchendon.ma.boston.contoso.com [10. 87. 148.129] 4 ge-1-1-ur01.gardner.ma.boston.contoso.com [10. 87. 144.225] 5 10g-9-1-ur01.sterling.ma.boston.contoso.com [10. 87. 144.2 17] The 0 line is your client computer The 1 line is the... includes information about configuring and troubleshooting Internet Explorer and Windows Mail n Chapter 25, “Configuring Windows Networking,” includes information about configuring network settings n Chapter 26, “Configuring Windows Firewall and IPsec,” includes information about configuring Windows Firewall n Chapter 27, “Connecting Remote Users and Networks,” includes information about virtual private... account is not on the list, add it to the list 5 Check the Windows Firewall exceptions to verify that it is configured properly by following these steps: a Click Start and then click Control Panel b Click Security and then click Windows Firewall c In the Windows Firewall dialog box, note the Network Location Click Change Settings d In the Windows Firewall Settings dialog box, click the Exceptions . 10g-9-1-ur01.sterling.ma.boston.contoso.com [10. 87. 144.2 17] 6 te-9-2-ur01.marlboro.ma.boston.contoso.com [10. 87. 144 .77 ] 7 10g-8-1-ur01.natick.ma.boston.contoso.com [10. 87. 144.1 97] 8 10g-9-1-ur01.sterling.ma.boston.contoso.com. 10g-9-1-ur01.sterling.ma.boston.contoso.com [10. 87. 144.2 17] 9 te-9-2-ur01.marlboro.ma.boston.contoso.com [10. 87. 144 .77 ] 10 10g-8-1-ur01.natick.ma.boston.contoso.com [10. 87. 144.1 97] 11 10g-9-1-ur01.sterling.ma.boston.contoso.com