Windows Commands

Question 1

Arp

Answer 1

used to view what layer 2 MAC address corresponds to as a known layer 3 IP address, can also use to statically add a "MAC address to IP address mapping" to a PCs Address Resolution Protocol (ARP)_ MAC Address Lookup table (ARP cache)
Syntax:
* arp -s inet_addr eth_addr [if_addr]
* arp -d inet_addr [if_addr]
* arp -a [inet_addr] [-N if_addr] [-v]

• -a or -g: displays current entries in PC ARP table
• -v: v = verbose, includes any invalid and loopback interface entries in an ARP table
• inet_addr: this option is a specific IP address
• -d: an ARP entry for a host can be deleted, in combination with the “intet_addr” parameter. Wildcard character * can delete all host entries
• -s: used in conjunction with the “inet_addr” and “eth_addr” adds a host entry in the ARP table
• eth_addr: 48 bit MAC address
• if_addr: can be used for strategically adding or deleting and ARP entry to or from a specified interface

Question 2

Ipconfig

Answer 2

displays IP address configuration parameters in windows PC, can also release/renew a DHCP lease
Syntax:
ipconfig [/all | /renew | /release | /renew6 | /release6]

• /all: gives more verbose information, such as DNS< MAC address, IPv6 information
• /release and /release6: release a DHCP lease for IPv4/IPv6 address respectively
• /renew and /renew6: renew DHCP lease for IPv4/IPv6 address respectively

Question 3

nbtstat

Answer 3

displays NetBIOS information for IP based networks, can display a list of NetBIOS device names learned by windows PC
Syntax:
nbtstat [ [-a remote_name] [-A ip_address] [-c] [-n] [-r] [-R] [-S] ]

• -a remote_name: allows you to see the NetBIOS table of a remote PC with a NetBIOS name specified by the “remote_name” argument
• -A ip_address: allows you to see the NetBIOS table of a remote PC with an IP address specified by the “ip_address” argument
• -c: displays the contents of a PCs NetBIOS name cache along with the IP addresses corresponding to those NetBIOS names
• -n: displays NetBIOS names that have been registered by an application, such as a server application
• -r: shows statistical NetBIOS information, such as number of NetBIOS names resolved by broadcasting and number of NetBIOS names resolved by a WINS server
• -R: purges a PCs NetBIOS cache and reloads entries from a PCs LMHOSTS file (text file containing NetBIOS to IP address mappings)
• -S: provides a listing of the NetBIOS session table, along with the IP addresses of the listed NetBIOS names

Question 4

Netstat

Answer 4

displays various information about IP-based connections on PC, view information about current sessions, including source and destination IP addresses and port numbers, display protocol statistics
Syntax:
netstat [-a] [-b] [-e] [-f] [-p proto] [-r] [-s]

• -a: displays all active IP based sessions, along with TCP/UDP ports of each session
• -b: shows names of program that opened up a session
• -e: show statistical information for an interfaces IP based traffic (number of bytes sent/received)
• -f: displays fully qualified domain names of destination addresses appearing in a listing of active sessions
• -p proto: displays connections for a specific protocol (icmp, icmpv6, ip, ipv6, tcp, tcpv6, upd, udpv6)
• -r: displays a PCs IP routing table
• -s: displays statistical information for protocols (icmpv4, icmpv6, ipv4, ipv6, tcpv4/6, udpv4/6

Question 5

Nslookup

Answer 5

resolves a FQDN to an IP address
can be issues along with an FQDN or be used in interactive mode, where you are prompted to enter command parameters
Syntax:
nslookup [fqdn]

Question 6

Ping

Answer 6

checks connectivity between two network devices
Syntax:
ping [-t] [-n count] [-l size] [-f] [-i TTL] [-S srcaddr] target_name

• -t: repeatedly sends pings (ICMP echo message) until stopped by pressing Ctrl+C
• -n count: specifies the number of pings to send
• -f: sets the “dont fragment” bit in a packets header, if packer tries to cross a router that attempts to fragment - will be dropped and ICMp error message returned
• -i TTL: sets the TTL value in a packets header, decremented for each hop, packet is discarded when value reaches 0
• -S srcaddr: specifies the source IP address from which the ICMP echo messages should be sent
• target_name: specifies the name or IP address of the device which you are sending ICMP echo messages

Question 7

Ping with IPv6

Answer 7

• Ping - 6 ipv6destinationaddress

* PING6 ipv6destinationaddress

Question 8

Route

Answer 8

displays a PCs current IP routing table, can add/delete entries to or from that routing table
Syntax:
C:>route [-f] [-p] command [destination] [mask netmask] [gateway]
[metric metric] [if interface]

• -f: clears gateway entries from the routing table, if used with other options, clearing of gateways occurs first
• -p: can be used with the add command to make a statically configured route persistent, meaning the route will remain in the routing table after reboot
• command: supported commands include PRINT (list entries in PC routing table), ADD (adds a route entry), DELETE (removes a route), CHANGE (modifies a route)
• destination: specifies the destination host or subnet to add to the PCs routing table
• mask netmask: used with the destination option, specifies the subnet mask of the destination
• gateway: specifies the IP address of the next hop router used to reach a destination
• metric metric: specifies the cost to reach a spcified destination
• if interface: used if you want to forward traffic to a specified destination out of a specific interface

Question 9

Tracert

Answer 9

pings every router hop from the source to the destination and reports the rountrip time for each router hop, can help identify any slow links connecting routers along the path from source to destination
Syntax:
C:>tracert destination

Question 10

Tracert with IPv6

Answer 10

similar to tracert, IPv6 path through a network can be verified
Syntax:
* tracert destinationipv6addr
* tracert6 destinationipv6addr
* tracert -6 destinationipv6addr

Question 11

PathPing

Answer 11

combines features of ping and tracert over a period of time, shows the amount of packet loss at any given router so you can identify routers that are causing issues

• -g host-list: loose source rout along “host-list”, loose source routing permits you to specify a set of destinations the packet must visit in transit
• -h maximum_hops: max number of hops to search for target
• -i address: use the specified source address
• -n: do not resolve addresses to hostnames
• -p period: wait period milliseconds between pings
• -q num_queries: number of queries per hop
• -w timeout: wait timeout milliseconds for each reply
• -4: force using IPv4
• -6 force using IPv6