Posted: September 22nd, 2015

Networking Commands

Networking Commands

Purpose:
The purpose of this exercise is to familiarize yourself with the command line console window. Regardless of the operating system you are using, you should practice command prompts as many of the troubleshooting and configurations are easily accessible through the console.

We went over some networking concepts in class such as IP addressing, ARP, DNS, DHCP. We will practice commands to display this information on your screen and to a text file.

Typing a question mark after the command will provide you with a help screen. If you ever get stuck, just type the question mark.

Color:
I dislike the black background and white font. This command will allow you to customize the console foreground and background colors.

Syntax –
color [background] [foreground]  (no space between the background and foreground numbers)
Example –
color 02

Try out several variations of background/foreground combinations. Choose something that you like. To display a help menu type the color command followed by the “?”.

color ?

**TAKE A SCREEN SHOT OF ONE CHANGE

Now that we have our color preferences set we should explore how to display useful information to our screen and also redirect output to a text file. This is useful if you wish to review the information at a later time.

Step 1: Set up the text file
Create a new text file on your desktop. Save it as commands.txt.

Step 2: Create a Log
Open the text file and type .LOG and save it.
Now whenever you save it and return, the date and time will automatically be saved to the file.

Step 3: Get the full path of the file.
Right – Click on the file you just created and select properties. In the properties window find the full path of the file. Note – You will find the directory but you will have to append the actual file name to the path. As you can see in my example – the full path is C:UsersMindoDesktopcommands.txt Remember this. We will need it.

Get the current date:
You can also change the date. We won’t do anything with this. Just hit enter.

Date

*** TAKE A SCREEN SHOT OF THE CURRENT DATE
Redirecting the output of the command to the text file is simple. Just enter the command, the options if it has any, followed by >> and then the file name. The double arrows is the append command. A single arrow would save over your file. We want to append.

Date >> C:UsersMindoDesktopcommands.txt

Nothing displays to the screen because you redirected it to the text file.

Our .LOG worked as expected. The output of the date command has been appended to the text file and the time stamp was automagically added to the file.

Display the computer name:
Hostname

*** TAKE A SCREEN SHOT OF THE HOSTNAME

…and redirect it to our log file.

Display our computer MAC address:
Getmac
Getmac >> C:UsersMindoDesktopcommands.txt

The MAC address is the physical address of your device. Each device that has a network adapter installed has a MAC address. The MAC address is a 12 digit hexadecimal number. The first 6 characters identify the manufacturer of the network card. The second 6 characters represents the serial number of the card. The MAC address generally remains fixed and does not change whereas an IP address can change due to DHCP or changing networks. The MAC address will always remain static*.

*** TAKE A SCREENSHOT OF YOUR MAC ADDRESS

*** Go to http://www.coffer.com/mac_find/ and enter the first 6 digits of your MAC address.

*** What is the manufacturer?

Display your Windows Version:
ver
This displays the version of wondows that is running on your system.

*** Take a screenshot of your OS version

Display your account name:
whoami

*** Take a screenshot of the output

Get your system information:
systeminfo
systeminfo >> C:UsersMindoDesktopcommands.txt

The systeminfo command provides a lot of information. This is a good command to redirect to the text file as you can visualize the output a little better than in the console box. With this cmmand, we can view the hostname, Operating system name and version, configuration, owner, serial, when it was last booted, when the operating system was installed, processor type and more.

*** Take a screenshot of your console window.
*** What is your Operating system name and version?
*** Who is the registered owner?
*** When was the OS installed?
*** When was it last booted?
*** What is the time Zone?
*** How much physical memory is installed?
*** Does the physical memory noted match  the total amount installed?

Display your IP address:
Ipconfig
Ipconfig >> C:UsersMindoDesktopcommands.txt

The ipconfig command displays a lot of information about your network connections. You will find your default gateway (router), your MAC address, your IP address, subnet mask, and DNS server.

*I have several NICs installed on my computer. You will see one IP address starting with 169.
Whenever you see an IP address with 169 you know there is a network error. This is an IP address that DNS provides network devices when something goes wrong. It allows the network devices to communicate but not with outside devices. My working IP address is listed below 192.168.1.75

As you can see, my IP address is 192.168.1.75 255.255.0.0
This is a class B IP address that was provided by ATT. My default gateway is 192.168.1.254. The DNS server is fronteir.com. This means that every time I want to connect to an external IP address, I have to first connect to frontier.com who then redirects me to the destination.

*** What is your IP address?
*** What is your DNS server address?
*** What is your subnet mask?
*** What is your default gaetway?

Display DHCP information:
Ipconfig ?
Ipconfig /all

The ipconfig command has a bunch of options. Use the question mark to see the available options. Here I want to check my DHCP settings. Type ipconfig /all

Scroll down to the correct IP address we looked at earlier (192.168.1.75). My DHCP server is 192.168.1.254. Look familiar? This is also my default gateway/router. Internet service providers bundle everything in those router/modem/wireless access point things they give you when you sign up. These are all actually separate machines in a larger network.

Remember DHCP is in charge of assigning IP addresses. The administrator decides how many addresses will be handed out, what those addresses are, and what addresses to set aside for static devices like faxes, printers, and servers.

These addresses are handed out temporarily and this process is called a lease. The lease is valid for a set period of time. Once the lease is up, the device requests a new IP address and the DHCP server sends a new IP address but always starting with the address that just expired if it’s still available.
The process of obtaining an IP address is as follows:
Device is in the DHCPDISCOVER stage. Basically reaching out to the DHCP server saying “Hey! I need an IP!!”
DHCP server sends a DHCPOFFER to the requesting device. “Hey buddy, I have an IP for you. What do you think of this one?”
Device accepts the offer and makes a formal request called the DHCPREQUEST. “I like that address. I’ll take it!”
DHCP sends and acknowledgement to the device called DHCPACK. “Sign here and its all yours. Pleasure doing business with ya!”.

*** What is your DHCP server address?
*** When was your lease started?
*** When is it up?
*** Take a screenshot

Display DNS information:
Ipcongig ?
Ipconfig /flushdns
Ipconfig /displaydns

The domain name system is responsible for translating readable www.whatever.com to numeric IP addresses and vise-versa. When you type in a URL, the device first checks its own DNS cache to see if the address has been translated (resolved) in its own internal cache. So each website you visit will be stored in this cache for a period of time. This allows the computer to save time and processing power. If the address is not located in its cache, it sends a request to the nearest DNS server.

Let’s start by clearing our cache. We do this by flushing our cache.

Check to make sure your DNS Cache is empty.
Ipconfig /displaydns

Now open your browser and let’s visit some websites.

Opened browser to Google homepage
Yahoo.com
Reddit.com
Newhaven.edu
Closed browser
The contents of the DNS cache is too much to be displayed o the small black box. This is a good time to redirect the output to the text file.

Ipconfig /displaydns >>C:UsersMindoDesktopcommands.txt

You will see  that all of the websites you visited were in the cache. There are other websites you did not visit.

*** Why do you think this is?

Display all of the computers that have been connected to your network recently:
Arp –a

The Address Resolution protocol (ARP) is a mapping of IP address to MAC addresses. You communicate with computers and devices on the Internet using an IP address but your local computers actually communicate using their MAC addresses. When a bunch of devices are connected to one another on a switch, they constantly send out “whois” messages to the entire network asking “Who is IP address xxxxx?” The appropriate device responds back saying “That’s my IP address and while you’re keeping track, here’s my MAC address”. All devices on the network then update their ARP caches. This allows everyone to communicate in an efficient manner.

Let’s look at my ARP cache.

It looks like I have about 10 devices that my computer recently communicated with. This is about right. The 224 devices are the things ATT gave me and the 192 addresses are the devices on my network. Cell phone, tablets, computers, Blueray player etc.

*** Look at your 192 addresses. How many are there? Does the number of devices seem right to you?

Display active connections to your computer/device:
Netstat
Netstat –a

The netstat command will display all of the connections that are being made to your computer. The protocol TCP or UDP will be shown, the local address (your device) is shown, a foreign address along with the port number (the address you are connected to on the Internet), and the state.

You can be in a listening state meaning you have an open port but have nothing connected…basically its saying “Hey! I’m open. Connect to me!” or it can be established. An established connections means the connection is well…established.

The 127 address is what’s called a loopback address which is basically a connection to itself. Don’t worry about those connections for now.

Look up the connections:
Nslookup.exe

Copy any of the IP addresses that are connected to your computer and enter it in the nslookup utility. Choose any website you want to research and find their ipaddress.

** Take a screen shot of at least 3 nslookups.
Ping:
The ping utility sends a small message to the receiving device and waits for a response. If the device responds, you know it is live. If not, it could either be down or programmed not to respond. Either way – it doesn’t want to talk to you.

*** Ping the school’s email address (do an NSlookup to obtain the IP address).
*** Does the website respond? Why or why not?
*** Show a screenshot.
*** Does ping www.newhaven.edu work the same as with the IP address?
*** Ping Google.com. Does this reply back?

Follow the path of your connection:
Tracert.exe [ip address or url]
Tracert is like a super ping. It pings a destination address but keeps track of each router it passes through on the way to the destination. We will talk about this more in class when we discuss packets in detail. For now, just pick a few websites and tracert away.

Contacting Google took 15 routers to get to my destination. Pick a website and try it out. How many hops did yours take.

Note – Some places block pinging so you may have to try a few places.

Here is a list of all of the commands I used.

date >> C:UsersMindoDesktopcommands.txt
hostname >> C:UsersMindoDesktopcommands.txt
ipconfig >> C:UsersMindoDesktopcommands.txt
ipconfig /all >> C:UsersMindoDesktopcommands.txt
whoami >> C:UsersMindoDesktopcommands.txt
getmac >> C:UsersMindoDesktopcommands.txt
systeminfo >> C:UsersMindoDesktopcommands.txt
ipconfig /flushdns
ipconfig /displaydns >> C:UsersMindoDesktopcommands.txt
arp –a >> C:UsersMindoDesktopcommands.txt
netstat –a >> C:UsersMindoDesktopcommands.txt
nslookup.exe google.com
nslookup.exe  reddit.com
nslookup.exe Newhaven.edu
tracert.exe www.google.com