TCP/IP

Transmission Control Protocol/Internet Protocol (TCP/IP) is a suite of standard protocols for connecting computers and building networks. TCP/IP is network protocol software provided with Microsoft operating systems that implements and supports the TCP/IP protocol suite:

  • Before you begin using TCP/IP with this computer, see Checklist: Installing and configuring TCP/IP.

  • To find features that have been moved in Windows 2000, see New ways to do familiar tasks.

  • For tips about using TCP/IP, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Checklist: Installing and configuring TCP/IP

Step | Reference
Review TCP/IP concepts such as IP addressing, subnet masks, and default gateways. | Understanding TCP/IP
Review TCP/IP name resolution concepts and options for resolving NetBIOS and DNS names to IP addresses. | Name resolution
Determine how computers on your network will obtain IP addresses. | DHCP
Determine how computers on your network will register and resolve NetBIOS names. | WINS
Determine how computers on your network will resolve and register DNS names. | Domain Name System (DNS)
Determine how this computer will be used with your TCP/IP network. | Installing TCP/IP
Verify that network adapter hardware is installed, or install hardware if needed. | Installing devices
Determine whether you will configure TCP/IP properties manually, dynamically, or automatically. | Configure TCP/IP
(Manual configuration only) Obtain and record the following TCP/IP information from your network administrator:
  • IP address
  • Subnet mask
  • Default gateways
  • DNS servers
  • DNS domain
  • WINS servers
Install TCP/IP on this computer. | To install TCP/IP
(Manual configuration only) Configure IP address, subnet mask, and default gateway settings. | Configure TCP/IP for static addressing
(Manual configuration only) Use WINS to obtain and resolve NetBIOS names. | Configure TCP/IP to use WINS
(Manual configuration only) Use DNS to obtain and resolve DNS names. | Configure TCP/IP to use DNS
(Optional) Configure additional or secondary methods to obtain and resolve NetBIOS names. | Advanced configuration
(Optional) Configure additional or secondary methods to obtain and resolve DNS names. | Advanced configuration
Use the ipconfig /all command to verify all current TCP/IP network configuration values. | Ipconfig
Use the ping command to verify that you have TCP/IP installed and working properly. | To test a TCP/IP configuration by using the ping command
Use the nslookup command to verify that you are able to obtain and resolve DNS names. | Nslookup


New ways to do familiar tasks

The following table lists common tasks for configuring TCP/IP in Windows 2000. The user interface for performing these tasks is different in Windows 2000 from the way it was in Windows NT version 4.0.

If you want to | In Windows NT 4.0 use | In Windows 2000 use
Install, configure, and remove TCP/IP | The Protocols tab of Network in Control Panel | The properties of a connection in Network and Dial-up Connections


Best practices

The following list provides best practices for implementing the TCP/IP protocol. Review this list before you begin to build your TCP/IP network.

  • If your network does not already use TCP/IP, develop a comprehensive IP addressing plan for your network.

    • You need to know the following information to help make a workable plan:

    1. How many physically separate network segments are contained within your network?
    2. How many host systems on each network segment will use TCP/IP?
    3. Will your network be connected to the Internet?
      • If so, will your network be directly connected to the Internet by using a router (which uses public addresses allocated by your Internet service provider), or will your network be indirectly connected to the Internet by using an network address translator (NAT) or an application layer gateway such as a proxy server (which uses private addresses)?
      • If not, then it is technically possible to use any IP addressing scheme. However, it is highly recommended that you use private addresses so that an eventual connection to the Internet does not force you to renumber your network.

    For more information about connecting a small office or home office (SOHO) network to the Internet, see Internet connection sharing and network address translation.

  • If you are using private IP addressing, use addresses from the private address ranges reserved by the Internet Assigned Numbers Authority (IANA).

    • For more information, see Numbering your network.

  • Configure a default gateway on only one network adapter.

    • This practice reduces confusion and assures the results you intended. For example, if you have two network adapters and configure a default gateway for each, the default gateway of the first network adapter is used. The default gateway for the second network adapter is only used if the first default gateway becomes unavailable.


How to...

This section provides instructions for installing and configuring the TCP/IP protocol:

  • Install and configure TCP/IP
  • Manage routes
  • Diagnose connections


Concepts

This section provides general background information about building TCP/IP for Windows 2000 networks:

  • TCP/IP overview
  • Understanding TCP/IP
  • Using TCP/IP
  • Resources


TCP/IP overview

This section covers:

  • TCP/IP for Windows 2000
  • TCP/IP background
  • The TCP/IP model
  • TCP/IP utilities
  • New TCP/IP features for Windows 2000
  • Security features of TCP/IP for Windows 2000


TCP/IP for Windows 2000

TCP/IP for Windows 2000 is:

  • Networking software based on industry-standard networking protocols.
  • A routable, enterprise networking protocol that supports the connection of your Windows-based computer to both LAN and WAN environments.
  • Core technologies and utilities for connecting your Windows-based computer with dissimilar systems and sharing information.
  • A foundation for gaining access to global Internet services, such as the World Wide Web and File Transfer Protocol (FTP) servers.
  • A robust, scalable, cross-platform, client/server framework.

Because most modern operating systems support the TCP/IP protocol suite, you can use TCP/IP to share information with a wide variety of systems and resources, as shown in the following illustration.

How TCP/IP supports open system use

TCP/IP for Windows 2000 provides basic TCP/IP utilities that enable a computer running Windows 2000 to connect and share information with other Microsoft and non-Microsoft systems, including:

  • Internet hosts
  • Apple Macintosh systems
  • IBM mainframes
  • UNIX systems
  • Open VMS systems
  • Microsoft Windows NT and Windows 2000
  • Microsoft Windows 98
  • Microsoft Windows 95
  • Microsoft Windows for Workgroups
  • Microsoft LAN Manager
  • Network-ready printers, such as HP LaserJet series printers that use HP JetDirect cards


TCP/IP background

Transmission Control Protocol/Internet Protocol (TCP/IP) is an industry-standard suite of protocols designed for large-scale internetworks that span LAN and WAN environments.

As the following timeline shows, the origins of TCP/IP began in 1969, when the U.S. Department of Defense (DoD) commissioned the Advanced Research Projects Agency Network (ARPANET).

Timeline for TCP/IP

The ARPANET was the result of a resource-sharing experiment. The purpose was to provide high-speed network communication links between various supercomputers located at various regional sites within the United States.

Early protocols such as Telnet (for virtual terminal emulation) and the File Transfer Protocol (FTP) were first developed to specify basic utilities needed for sharing information across the ARPANET. As the ARPANET grew in size and scope, two other important protocols appeared:

  • In 1974, the Transmission Control Protocol (TCP) was introduced as a draft specification that described how to build a reliable, host-to-host data transfer service over a network.
  • In 1981, the Internet Protocol (IP) was introduced in draft form and described how to implement an addressing standard and route packets between interconnected networks.

On January 1, 1983, ARPANET began to require standard use of the TCP and IP protocols for all network traffic and essential communication. From this date forward, ARPANET started to become more widely known as the Internet and its required protocols started to become more widely known as the TCP/IP protocol suite.

The TCP/IP protocol suite is implemented in a variety of TCP/IP software offerings available for use with many computing platforms. Today, TCP/IP software remains widely in use on the Internet and is used often for building large routed private internetworks.


The TCP/IP model

TCP/IP is based on a four-layer reference model. All protocols that belong to the TCP/IP protocol suite are located in the top three layers of this model.

As shown in the following illustration, each layer of the TCP/IP model corresponds to one or more layers of the seven-layer Open Systems Interconnection (OSI) reference model proposed by the International Standards Organization (ISO).

OSI layer model and TCP/IP model

The types of services performed and protocols used at each layer within the TCP/IP model are described in more detail in the following table.

Layer | Description | Protocols
Application | Defines TCP/IP application protocols and how host programs interface with transport layer services to use the network. | HTTP, Telnet, FTP, TFTP, SNMP, DNS, SMTP, X Windows, other application protocols
Transport | Provides communication session management between host computers. Defines the level of service and status of the connection used when transporting data. | TCP, UDP, RTP
Internet | Packages data into IP datagrams, which contain source and destination address information that is used to forward the datagrams between hosts and across networks. Performs routing of IP datagrams. | IP, ICMP, ARP, RARP
Network interface | Specifies details of how data is physically sent through the network, including how bits are electrically signaled by hardware devices that interface directly with a network medium, such as coaxial cable, optical fiber, or twisted-pair copper wire. | Ethernet, Token Ring, FDDI, X.25, Frame Relay, RS-232, v.35

For more information about ARP, IP, ICMP, IGMP, UDP, and TCP, see Understanding TCP/IP.

Note

  • The OSI reference model is not specific to TCP/IP. It was developed by the ISO in the late 1970s as a framework for describing all functions required of an open interconnected network. It is a widely known and accepted reference model in the data communications field and is used here only for comparison purposes.


TCP/IP utilities

Windows 2000 includes three types of TCP/IP-based utilities:

  • Connectivity utilities that you can use to interact with and use resources on a variety of Microsoft and non-Microsoft hosts, such as UNIX systems.
  • Diagnostic utilities that you can use to detect and resolve networking problems.
  • TCP/IP server software that provides printing and publishing services to TCP/IP-based clients on Windows 2000.

The following tables describe the TCP/IP-based utilities.

Connectivity utilities
Utility | Description
Ftp | Transfers files of any size between Windows 2000 and any computer running File Transfer Protocol (FTP) server software. For more information, see Ftp.
Lpr | Sends print jobs to remote UNIX printers managed by Line Printer Daemon (LPD) print server software. For more information, see Lpr.
Rcp | Copies files between Windows 2000 and computers running Remote Copy Protocol (RCP) server software. For more information, see Rcp.
Rexec | Executes processes on remote computers. For more information, see Rexec.
Rsh | Runs commands on a computer running Remote Shell (RSH) server software. For more information, see Rsh.
Telnet | Uses terminal-based login to remotely access network devices that are running Telnet server software. For more information, see Telnet.
Tftp | Transfers small files between Windows 2000 and computers running Trivial File Transfer Protocol (TFTP) server software. For more information, see Tftp.

Diagnostic utilities
Utility | Description
Arp | Displays and modifies the Address Resolution Protocol (ARP) cache. This cache is a local table used by Windows 2000 to resolve IP addresses to media access control addresses used on the local network. For more information, see Arp and Troubleshooting hardware addresses by using arp.
Hostname | Returns the host name of the local computer. For more information, see Hostname.
Ipconfig | Displays the current TCP/IP configuration. Also used to manually release and renew TCP/IP configurations assigned by a DHCP server. For more information, see Ipconfig and Command-line utilities.
Lpq | Obtains print queue status information from computers running Line Printer Daemon (LPD) print server software. For more information, see Lpq.
Nbtstat | Displays the local NetBIOS name table, a table of NetBIOS names registered by local applications, and the NetBIOS name cache, a local cache listing of NetBIOS computer names that have been resolved to IP addresses. For more information, see Nbtstat and Troubleshooting NetBIOS names by using nbtstat.
Netstat | Displays TCP/IP protocol session information. For more information, see Netstat and Displaying connection statistics by using netstat.
Nslookup | Checks records, domain host aliases, domain host services, and operating system information by querying DNS servers. For more information, see Nslookup.
Ping | Verifies configurations and tests IP connectivity. For more information, see Ping and Testing connections by using ping.
Route | Displays or modifies the local routing table. For more information, see Route.
Tracert | Traces the route a packet takes to a destination. For more information, see Tracert and Tracing network connections by using tracert.
Pathping | Traces the route a packet takes to a destination and displays information on packet losses for each router in the path. Pathping can also be used to troubleshoot Quality of Service (QoS) connectivity. For more information, see Testing routers by using Pathping.
Server-based software
Server software | Description
TCP/IP Printing service | The TCP/IP Printing service offers a Line Printer Daemon (LPD) printing service for computers running Windows 2000. This service allows UNIX computers to send print jobs to computers running Windows 2000 by using the Line Printer Remote (Lpr) utility for printing.
Internet Information Services | Internet Information Services (IIS) offers Web, Gopher, and FTP server software for providing TCP/IP-based publishing services. IIS is provided with Windows 2000 Server to offer an enterprise-ready Web server to use with an unlimited number of simultaneous connections.
Peer Web Services | Peer Web Services is provided with Windows 2000 Professional to provide Web-publishing services similar to those offered by IIS for serving fewer than 10 simultaneous connections.


New TCP/IP features for Windows 2000

TCP/IP for Windows 2000 has been updated to include several features that simplify configuration on a single subnet and optimize TCP performance in high-bandwidth network environments.

These new features include support for:

  • Automatic private address configuration.
  • Large TCP windows.
  • Selective acknowledgments.
  • Better roundtrip time (RTT) estimation.
  • ICMP router discovery.
  • DNS caching.
  • Disabling NetBIOS over TCP/IP.

Automatic private address configuration

You use Automatic Private IP Addressing (APIPA) to automate TCP/IP address configuration for single-subnet networks that do not contain a DHCP server.

By default, a computer running Windows 2000 first tries to contact a DHCP server on the network to dynamically obtain configuration for each installed network connection.

  • If a DHCP server is reached and the leased configuration is successful, TCP/IP configuration is completed.
  • If a DHCP server is not reached, the computer instead uses APIPA to automatically configure TCP/IP. When you use APIPA, Windows 2000 determines an address in the reserved IP address range from 169.254.0.1 through 169.254.255.254. This address is used as a temporary IP address configuration until a DHCP server is located. The subnet mask is set to 255.255.0.0.

The APIPA range of IP addresses is reserved by the Internet Assigned Numbers Authority (IANA). Any IP addresses within this range are not used on the Internet.

APIPA eliminates IP address configuration for single-network small office or home office networks that are not connected to the Internet.

Large TCP windows

Window size reflects the maximum number of packets that can be sent without waiting for positive acknowledgment. Large TCP windows improve TCP/IP performance when large amounts of data are in transit between the sender and receiver. In typical TCP-based communication, the maximum window size is usually fixed at the onset of connection and limited to 64 kilobytes.

With large window support, you can dynamically recalculate and scale the actual window size by using a TCP option as needed during longer sessions. With this option, more data packets are in transit on the network at one time, which increases throughput.

For more information about large TCP windows, see RFC 1323, "TCP Extensions for High Performance."

Selective acknowledgments

In typical TCP-based communication, acknowledgments are cumulative. TCP only acknowledges segments received that are contiguous with previously acknowledged segments. Noncontiguous segments—segments received out of sequence—are not explicitly acknowledged. TCP requires that segments are received and acknowledged within a brief time period, or the missing segment, and all subsequent segments that follow it, must be retransmitted.

Selective acknowledgments are a recent TCP option that allow the receiver to selectively notify and request that a sender resend only data that is actually missing. This results in smaller amounts of data that require retransmission and better use of network bandwidth.

For more information about selective acknowledgments, see RFC 2018, "TCP Selective Acknowledgment Options."

Better RTT estimation

Roundtrip time (RTT) is used by TCP to estimate the amount of time that is needed for roundtrip communication between a sender and a receiver. Windows 2000 supports the use of the TCP Round Trip Time Measurement option to improve how RTT is estimated. By calculating more accurate RTT information more often, TCP uses better estimates for setting retransmission timers, which helps improve overall TCP speed and performance.

Improvements in estimating RTT help significantly over longer roundtrip network links, such as WANs that span continents or that use either wireless or satellite communication links.

For more information about TCP roundtrip time measurement, see RFC 1323, "TCP Extensions for High Performance."

ICMP router discovery

Internet Control Message Protocol (ICMP) router discovery is the use of ICMP messages to discover the default gateway on a network segment when a default gateway is not manually configured or assigned by using DHCP. ICMP router discovery consists of two ICMP messages: the router solicitation and the router advertisement. A router solicitation is sent by a host to discover the routers on the network. A router advertisement is sent by a router in response to a router solicitation and periodically to notify hosts on the network that the router is still available. ICMP router discovery is enabled by default on TCP/IP for Windows 2000 hosts.

You can configure a Windows 2000 Server computer running the Routing and Remote Access service to support ICMP router discovery as a router. For more information, see Routing overview.

ICMP router discovery is described in RFC 1256, "ICMP Router Discovery Messages".

DNS caching

The Domain Name System (DNS) resolver in TCP/IP for Windows 2000 caches DNS name queries. You can view and flush the contents of the DNS cache by using the Ipconfig utility. For more information, see Client features and Using ipconfig to view or reset a client resolver cache.

Disabling NetBIOS over TCP/IP

With Windows 2000, you can disable NetBIOS over TCP/IP (NetBT) for each network connection. This feature is intended for computers that only use DNS name registration and resolution techniques and communicate by using the Client for Microsoft Networks and the File and Print Sharing for Microsoft Networks components with other computers where NetBT is disabled. Examples of disabling NetBT include computers in specialized or secured roles for your network, such as an edge proxy server or bastion host in a firewall environment, where NetBT support is not required or desired.

The following are considerations for disabling NetBT on computers running Windows 2000:

  • The computer no longer listens for traffic to the NetBIOS datagram service at User Datagram Protocol (UDP) port 138, the NetBIOS name service at UDP port 137, and the NetBIOS session service at Transmission Control Protocol (TCP) port 139.
  • TCP/IP-based connections that use the Client for Microsoft Networks and the File and Print Sharing for Microsoft Networks components are only possible to other computers that have NetBT disabled. This affects the ability to see computers on the network and connect to file shares and network printers.
  • NetBIOS name resolution techniques such as WINS, local subnet broadcasts, and the Lmhosts file are no longer used. All name resolution occurs through DNS queries and the Hosts file.
  • If the computer needs to participate in WINS as a client, it must have NetBT enabled on at least one network connection.
  • If a Windows 2000 Server computer needs to run the WINS service, it must have NetBT enabled on at least one network connection.

A good example of disabling NetBT is for a server computer that has a connection to a private network and connection to an external network, such as the Internet. In this case, NetBT is not required for the Internet connection. By disabling NetBT on only the Internet connection, the dual-homed computer continues to function as either a WINS server or client for the internal network, and WINS clients are still serviced for connections made by using other physical network adapters installed on the computer.

You can disable NetBT on the WINS tab in the properties of the TCP/IP protocol. For more information, see To configure TCP/IP to use WINS. You can also disable NetBT through DHCP by using a Microsoft vendor-specific DHCP option. For more information, see Microsoft vendor-specific options.

Additional feature information

For additional information about TCP/IP performance enhancements and features in Windows 2000, see the RFC documents previously listed. For information about obtaining RFC documents, see Obtaining RFCs.


Security features of TCP/IP for Windows 2000

TCP/IP for Windows 2000 incorporates security features that provide protection of the TCP/IP data as it is sent on the network and configuration of the types of local host traffic that are processed.

Internet Protocol security

Internet Protocol security (IPSec) is a set of Internet standards that uses cryptographic security services to provide the following:

  • Confidentiality

    • IPSec traffic is encrypted. Captured IPSec traffic is unintelligible without knowledge of the encryption key.

  • Authentication

    • IPSec traffic is digitally signed with the shared encryption key so that the receiver can verify that it was sent by the IPSec peer.

  • Data integrity

    • IPSec traffic contains a cryptographic checksum that incorporates the encryption key. The receiver can verify that the packet was not modified in transit.

For more information about IPSec, see Internet Protocol security (IPSec)

For information about configuring IPSec policies for the TCP/IP protocol, see To configure TCP/IP to use an IPSec policy.

TCP/IP filtering

With TCP/IP filtering, a feature known as TCP/IP Security in Windows NT version 4.0, you can specify exactly which types of incoming TCP/IP traffic are processed for each IP interface. This feature is designed to isolate the traffic that is processed by Internet or intranet servers in the absence of other TCP/IP filtering provided by the Routing and Remote Access service or other TCP/IP applications or services. TCP/IP filtering is disabled by default.

TCP/IP filtering is a set of filters for inbound local host TCP/IP traffic. Local host traffic is traffic that is processed by the host because the destination IP address of inbound TCP/IP traffic is addressed to an assigned interface addresses, appropriate subnet broadcast addresses, or a multicast address. TCP/IP filtering does not apply to routed traffic that is forwarded between interfaces.

With TCP/IP filtering, you can confine local host inbound TCP/IP traffic based on the:

  • Destination TCP port
  • Destination UDP port
  • IP protocol

For information about configuring TCP/IP filtering, see To configure TCP/IP to use TCP/IP filtering.


Understanding TCP/IP

This section covers:

  • Core protocols of TCP/IP
  • IP addressing and routing
  • Name resolution


Core protocols of TCP/IP

This section covers:

  • Address Resolution Protocol (ARP)
  • Internet Protocol (IP)
  • Internet Control Message Protocol (ICMP)
  • Internet Group Management Protocol (IGMP)
  • User Datagram Protocol (UDP)
  • Transmission Control Protocol (TCP)


Address Resolution Protocol (ARP)

Address Resolution Protocol (ARP) is a required TCP/IP standard defined in RFC 826, "Address Resolution Protocol (ARP)." ARP resolves IP addresses used by TCP/IP-based software to media access control addresses used by LAN hardware. ARP provides the following protocol services to hosts located on the same physical network:

  • Media access control addresses are obtained by using a network broadcast request in the form of the question "What is the media access control address for a device that is configured with the enclosed IP address?"
  • When an ARP request is answered, both the sender of the ARP reply and the original ARP requester record each other's IP address and media access control address as an entry in a local table called the ARP cache for future reference.

Hardware addressing

Hardware built for use on LANs must contain a unique address programmed into the device by the manufacturer. For Ethernet and Token Ring LAN hardware, this address is known as a media access control address.

Each media access control address identifies the device within its own physical network with a 6-byte number programmed into read-only memory (ROM) on each physical hardware device, such as a network adapter. Media access control addresses are typically displayed in hexadecimal (for example, 00-AA-00-3F-89-4A).

Authority and registration of media access control addresses are overseen by the Institute of Electrical and Electronics Engineers (IEEE). Currently, the IEEE registers and assigns unique numbers for the first three bytes of the media access control address to individual manufacturers. Each manufacturer can then assign the last three bytes of the media access control address to individual network adapters.

How ARP resolves media access control addresses for local traffic

The following illustration shows how ARP resolves IP addresses to hardware addresses for hosts on the same local network.

How ARP resolves media access control addresses for local traffic

In this example, two TCP/IP hosts, Hosts A and B, are both located on the same physical network. Host A is assigned the IP address of 10.0.0.99 and Host B is assigned the IP address of 10.0.0.100.

When Host A tries to communicate with Host B, the following steps resolve Host B's software-assigned address (10.0.0.100) to Host B's hardware-assigned media access control address:

  1. Based on the contents of the routing table on Host A, IP determines that the forwarding IP address to be used to reach Host B is 10.0.0.100. Host A then checks its own local ARP cache for a matching hardware address for Host B.
  2. If Host A finds no mapping in the cache, it broadcasts an ARP request frame to all hosts on the local network with the question "What is the hardware address for 10.0.0.100?" Both hardware and software addresses for the source, Host A, are included in the ARP request.

    3. Each host on the local network receives the ARP request and checks for a match to its own IP address. If a host does not find a match, it discards the ARP request.

  3. Host B determines that the IP address in the ARP request matches its own IP address and adds a hardware/software address mapping for Host A to its local ARP cache.
  4. Host B sends an ARP reply message containing its hardware address directly back to Host A.
  5. When Host A receives the ARP reply message from Host B, it updates its ARP cache with a hardware/software address mapping for Host B.

Once the media access control address for Host B has been determined, Host A can send IP traffic to Host B by addressing it to Host B's media access control address.

How ARP resolves media access control addresses for remote traffic

ARP is also used to forward IP datagrams to local routers for destinations that are not on the local network. In this situation, ARP resolves the media access control address of a router interface on the local network.

The following illustration shows how ARP resolves IP addresses to hardware addresses for two hosts on different physical networks connected by a common router.

How ARP resolves media access control addresses for remote traffic

In this example, Host A is assigned an IP address of 10.0.0.99 and Host B uses an IP address of 192.168.0.99. Router interface 1 is on the same physical network as Host A and uses the IP address 10.0.0.1. Router interface 2 is on the same physical network as Host B and uses the IP address 192.168.0.1.

When Host A tries to communicate with Host B, the following steps resolve Router interface 1's software-assigned address (10.0.0.1) to its hardware-assigned media access control address:

  1. Based on the contents of the routing table on Host A, IP determines that the forwarding IP address to be used to reach host B is 10.0.0.1, the IP address of its default gateway. Host A then checks its own local ARP cache for a matching hardware address for 10.0.0.1.
  2. If Host A finds no mapping in the cache, it broadcasts an ARP request frame to all hosts on the local network with the question "What is the hardware address for 10.0.0.1?" Both hardware and software addresses for the source, Host A, are included in the ARP request.

    3. Each host on the local network receives the ARP request and checks for a match to its own IP address. If a host does not find a match, it discards the ARP request.

  3. The router determines that the IP address in the ARP request matches its own IP address and adds a hardware/software address mapping for Host A to its local ARP cache.
  4. The router then sends an ARP reply message containing its hardware address directly back to Host A.
  5. When Host A receives the ARP reply message from the router, it updates its ARP cache with a hardware/software address mapping for 10.0.0.1.

Once the media access control address for Router interface 1 has been determined, Host A can send IP traffic to Router interface 1 by addressing it to the Router interface 1 media access control address. The router then forwards the traffic to Host B through the same ARP process as discussed in How ARP resolves media access control addresses for local traffic.

The ARP cache

To minimize the number of broadcasts, ARP maintains a cache of IP address–to–media access control address mappings for future use. The ARP cache can contain both dynamic and static entries. Dynamic entries are added and removed automatically over time. Static entries remain in the cache until the computer is restarted.

Each dynamic ARP cache entry has a potential lifetime of 10 minutes. New entries added to the cache are timestamped. If an entry is not reused within 2 minutes of being added, it expires and is removed from the ARP cache. If an entry is used, it receives two more minutes of lifetime. If an entry keeps getting used, it receives an additional two minutes of lifetime up to a maximum lifetime of 10 minutes.

You can view the ARP cache by using the arp command. To view the ARP cache on a computer running Windows 2000, type arp –a at a Windows 2000 command prompt. To view arp command-line options, type arp /? at a command prompt.

Note

  • There is a separate ARP cache for each network adapter on a computer running Windows 2000.


Internet Protocol (IP)

IP is a required TCP/IP standard defined in RFC 791, "Internet Protocol (IP)." IP is a connectionless, unreliable datagram protocol primarily responsible for addressing and routing packets between hosts.

Connectionless means that a session is not established before exchanging data. Unreliable means that delivery is not guaranteed. IP always makes a best-effort attempt to deliver a packet. An IP packet might be lost, delivered out of sequence, duplicated, or delayed. IP does not attempt to recover from these types of errors. The acknowledgment of packets delivered and the recovery of lost packets is the responsibility of a higher-layer protocol, such as TCP.

An IP packet, also known as an IP datagram, consists of an IP header and an IP payload, as shown in the following illustration.

An IP datagram

The IP header contains the following fields for addressing and routing:

IP header field | Function
Source IP address | The IP address of the original source of the IP datagram.
Destination IP address | The IP address of the final destination of the IP datagram.
Time-to-Live (TTL) | Designates the number of network segments on which the datagram is allowed to travel before being discarded by a router. The TTL is set by the sending host and is used to prevent packets from endlessly circulating on an IP internetwork. When forwarding an IP packet, routers are required to decrease the TTL by at least 1.


Internet Control Message Protocol (ICMP)

Internet Control Message Protocol (ICMP) is a required TCP/IP standard defined in RFC 792, "Internet Control Message Protocol (ICMP)." With ICMP, hosts and routers that use IP communication can report errors and exchange limited control and status information.

ICMP messages are usually sent automatically in one of the following situations:

  • An IP datagram cannot reach its destination.
  • An IP router (gateway) cannot forward datagrams at the current rate of transmission.
  • An IP router redirects the sending host to use a better route to the destination.

ICMP messages are encapsulated and sent within IP datagrams, as shown in the following illustration.

ICMP encapsulation in an IP datagram

Different types of ICMP messages are identified in the ICMP header. Because ICMP messages are carried in IP datagrams, they are unreliable.

The most common ICMP messages are listed and described in the following table.

ICMP message | Description
Echo request | Determines whether an IP node (a host or a router) is available on the network.
Echo reply | Replies to an ICMP echo request.
Destination unreachable | Informs the host that a datagram cannot be delivered.
Source quench | Informs the host to lower the rate at which it sends datagrams because of congestion.
Redirect | Informs the host of a preferred route.
Time exceeded | Indicates that the Time-to-Live (TTL) of an IP datagram has expired.

You can use the ping command to send ICMP echo request messages and record the receipt of ICMP echo reply messages. With these messages, you can detect network or host communication failures and troubleshoot common TCP/IP connectivity problems.

For more information about ICMP, see RFC 792, "Internet Control Message Protocol (ICMP)." For more information about obtaining RFCs, see Obtaining RFCs.


Internet Group Management Protocol (IGMP)

The use of IP multicasting in TCP/IP networks is defined as a TCP/IP standard in RFC 1112, "Internet Group Management Protocol (IGMP)." In addition to defining address and host extensions for how IP hosts support multicasting, this RFC also defines the Internet Group Management Protocol (IGMP) version 1. RFC 2236, "Internet Group Management Protocol (IGMP), version 2" defines IGMP version 2. Both versions of IGMP provide a protocol to exchange and update information about host membership in specific multicast groups

What is IP multicasting?

Multicast IP traffic is sent to a single address but is processed by multiple hosts. IP multicasting is similar to a newsletter subscription. When only subscribers receive the newsletter when it is published, only host computers that belong to the multicast group receive and process IP traffic sent to the group's reserved IP address. The set of hosts listening on a specific IP multicast address is called a multicast group.

Other important aspects of IP multicasting include the following:

  • Group membership is dynamic, allowing hosts to join and leave the group at any time.
  • The ability of hosts to join multicast groups is performed through the sending of IGMP messages.
  • Groups are not limited by size and members can be spread out across multiple IP networks (if connecting routers support the propagation of IP multicast traffic and group membership information).
  • A host can send IP traffic to the group's IP address without belonging to the corresponding group.

Multicast addressing

IP multicast addresses are reserved and assigned from within the Class D address range from 224.0.0.0 through 239.255.255.255. The following table is a partial list of well-known Class D addresses used by Windows 2000 components that are reserved for IP multicasting and registered with the Internet Assigned Numbers Authority (IANA).

IP multicast address | Description
224.0.0.0 | Base address (reserved).
224.0.0.1 | The All Hosts multicast group that contains all systems on the same network segment.
224.0.0.2 | The All Routers multicast group that contains all routers on the same network segment.
224.0.0.5 | The Open Shortest Path First (OSPF) AllSPFRouters address. Used to send OSPF routing information to all OSPF routers on a network segment.
224.0.0.6 | The OSPF AllDRouters address. Used to send OSPF routing information to OSPF designated routers on a network segment.
224.0.0.9 | The RIP Version 2 group address. Used to send RIP routing information to all RIP v2 routers on a network segment.
224.0.1.24 | WINS server group address. Used to support autodiscovery and dynamic configuration of replication for WINS servers. For more information, see WINS replication.

For a full and current listing of additional IP addresses that are reserved for multicasting, see the Internet Multicast Addresses Web site (http://www.isi.edu/in-notes/iana/assignments/multicast-addresses).

A single IP address within the Class D reserved range identifies each multicast group. Each group's reserved IP address is shared by all host members of the group who listen and receive any IP messages sent to the group's IP address.

IP multicast addresses are mapped to a reserved set of media access control multicast addresses.

Note

IGMP messages

IGMP is used to exchange membership status information between IP routers that support multicasting and members of multicast groups. Host membership in a multicast group is reported by individual member hosts, and membership status is periodically polled by multicast routers.

IGMP message types are described in the following table.

IGMP message type | Description
Host membership report | When a host joins a multicast group, it sends an IGMP host membership report message, declaring its membership in a specific host group. IGMP host membership report message are also sent in response to an IGMP host membership query sent by a router.
Host membership query | Used by a multicast router to periodically poll a network for group members.
Leave group | Sent by a host when they leave a host group and are the last member of that group on the network segment.

IGMP messages are encapsulated and sent within IP datagrams as shown in the following illustration.

IGMP encapsulation in an IP datagram


User Datagram Protocol (UDP)

The User Datagram Protocol (UDP) is a TCP/IP standard defined in RFC 768, "User Datagram Protocol (UDP)." UDP is used by some programs instead of TCP for fast, lightweight, unreliable transportation of data between TCP/IP hosts.

UDP provides a connectionless datagram service that offers best-effort delivery, which means that UDP does not guarantee delivery or verify sequencing for any datagrams. A source host that needs reliable communication must use either TCP or a program that provides its own sequencing and acknowledgment services.

UDP messages are encapsulated and sent within IP datagrams, as shown in the following illustration.

UDP encapsulation in an IP datagram

UDP ports

UDP ports provide a location for sending and receiving UDP messages. A UDP port functions as a single message queue for receiving all datagrams intended for the program specified by each protocol port number. This means UDP-based programs can receive more than one message at a time.

The server side of each program that uses UDP listens for messages arriving on their well-known port number. All UDP server port numbers less than 1,024 (and some higher numbers) are reserved and registered by the Internet Assigned Numbers Authority (IANA).

Each UDP server port is identified by a reserved or well-known port number. The following table shows a partial list of well-known UDP server port numbers that are used by standard UDP-based programs.

UDP port number | Description
53 | DNS name queries
69 | Trivial File Transfer Protocol (TFTP)
137 | NetBIOS name service
138 | NetBIOS datagram service
161 | Simple Network Management Protocol (SNMP)
520 | Routing Information Protocol (RIP)

For an updated, complete list of all currently registered well-known UDP ports, see the Port Numbers Web site (http://www.isi.edu/in-notes/iana/assignments/port-numbers).

Note

UDP and TCP

In general, differences in how UDP and TCP deliver data are similar to the differences between a telephone call and a postcard. TCP works like a telephone call by verifying that the destination is available and ready to communicate. UDP works like a postcard—messages are small and delivery is likely, but not always assured.

UDP is typically used by programs that transmit small amounts of data at one time or have real-time requirements. In these situations, the low overhead and multicasting capabilities of UDP (for example, one datagram, many recipients) are better suited than TCP.

UDP contrasts directly with the services and features provided by TCP. The following table compares differences in how TCP/IP communication is handled depending on whether UDP or TCP is used for transporting data.

UDP | TCP
Connectionless service; no session is established between hosts. | Connection-oriented service; a session is established between hosts.
UDP does not guarantee or acknowledge delivery, or sequence data. | TCP guarantees delivery through the use of acknowledgments and sequenced delivery of data.
Programs that use UDP are responsible for providing any reliability needed to transport data. | Programs that use TCP are provided assurance of reliable data transport.
UDP is fast, has low overhead requirements, and can support point-to-point and point-to-multipoint communication. | TCP is slower, has higher overhead requirements, and only supports point-to-point communication.

Both UDP and TCP use ports to identify communications for each TCP/IP program.


Transmission Control Protocol (TCP)

Transmission Control Protocol (TCP) is a required TCP/IP standard defined in RFC 793, "Transmission Control Protocol (TCP)," that provides a reliable, connection-oriented packet delivery service. The Transmission Control Protocol:

  • Guarantees delivery of IP datagrams.
  • Performs segmentation and reassembly of large blocks of data sent by programs.
  • Ensures proper sequencing and ordered delivery of segmented data.
  • Performs checks on the integrity of transmitted data by using checksum calculations.
  • Sends positive messages depending on whether data was received successfully. By using selective acknowledgments, negative acknowledgments for data not received are also sent.
  • Offers a preferred method of transport for programs that must use reliable session-based data transmission, such as client/server database and e-mail programs.

How TCP works

TCP is based on point-to-point communication between two network hosts. TCP receives data from programs and processes this data as a stream of bytes. Bytes are grouped into segments that TCP then numbers and sequences for delivery.

Before two TCP hosts can exchange data, they must first establish a session with each other. A TCP session is initialized through a process known as a three-way handshake. This process synchronizes sequence numbers and provides control information that is needed to establish a virtual connection between both hosts.

Once the initial three-way handshake completes, segments are sent and acknowledged in a sequential manner between both the sending and receiving hosts. A similar handshake process is used by TCP before closing a connection to verify that both hosts are finished sending and receiving all data.

TCP segments are encapsulated and sent within IP datagrams, as shown in the following illustration.

TCP encapsulation in an IP datagram

TCP ports

TCP ports use a specific program port for delivery of data sent by using Transmission Control Protocol (TCP). TCP ports are more complex and operate differently from UDP ports.

While a UDP port operates as a single message queue and the network endpoint for UDP-based communication, the final endpoint for all TCP communication is a unique connection. Each TCP connection is uniquely identified by dual endpoints.

Each single TCP server port is capable of offering shared access to multiple connections because all TCP connections are uniquely identified by two pairs of IP address and TCP ports (one address/port pairing for each connected host).

TCP programs use reserved or well-known port numbers, as shown in the following illustration.

TCP ports as used by programs

The server side of each program that uses TCP ports listens for messages arriving on their well-known port number. All TCP server port numbers less than 1,024 (and some higher numbers) are reserved and registered by the Internet Assigned Numbers Authority (IANA).

The following table is a partial list of some well-known TCP server ports used by standard TCP-based programs.

TCP port number | Description
20 | FTP server (data channel)
21 | FTP server (control channel)
23 | Telnet server
53 | Domain Name System zone transfers
80 | Web server (HTTP)
139 | NetBIOS session service

For an updated, complete list of all currently registered well-known TCP ports, see the Port Numbers Web site (http://www.isi.edu/in-notes/iana/assignments/port-numbers).

Note


IP addressing and routing

This section covers:

  • IP addressing
  • Subnet masks
  • IP routing
  • The Windows 2000 IP routing table


IP addressing

Each TCP/IP host is identified by a logical IP address. This address is unique for each host that communicates by using TCP/IP. Each 32-bit IP address identifies a location of a host system on the network in the same way that a street address identifies a house on a city street.

Just as a street address has a standard two-part format (a street name and a house number), each IP address is separated internally into two parts—a network ID and a host ID:

  • The network ID, also known as a network address, identifies a single network segment within a larger TCP/IP internetwork (a network of networks). All the systems that attach and share access to the same network have a common network ID within their full IP address. This ID is also used to uniquely identify each network within the larger internetwork.
  • The host ID, also known as a host address, identifies a TCP/IP node (a workstation, server, router, or other TCP/IP device) within each network. The host ID for each device identifies a single system uniquely within its own network.

Here is an example of a 32-bit IP address:

10000011 01101011 00010000 11001000

To make IP addressing easier, IP addresses are expressed in dotted decimal notation. The 32-bit IP address is segmented into four 8-bit octets. The octets are converted to decimal (base-10 numbering system) and separated by periods. Therefore, the previous IP address example is 131.107.16.200 when converted to dotted decimal notation.

For more information about dotted decimal notation and the conversion of numbers from binary to decimal, see Converting binary to decimal.

The following illustration shows a sample view of an IP address (131.107.16.200) as it is divided into network and host ID sections. The network ID portion (131.107) is indicated by the first two numbers of the IP address. The host ID portion (16.200) is indicated by the last two numbers of the IP address.

The IP address: network ID and host ID

Notes

  • Because IP addresses identify devices on a network, a unique IP address must be assigned to each device on the network.
  • In general, most computers have only a single network adapter installed and therefore require only a single IP address. If a computer has multiple network adapters installed, each adapter needs its own IP address.

IP address classes

The Internet community has defined five address classes. Class A, B, and C addresses are used for assignment to TCP/IP nodes.

The class of address defines which bits are used for the network and host ID parts of each address. The address class also defines how many networks and hosts per network can be supported.

The following table uses w.x.y.z to designate the four octet values in any given IP address. The table is used to show:

  • How the value of the first octet (w) of any given IP address effectively indicates the class of address.
  • How the octets in an address are divided into network ID and host ID.
  • The number of possible networks and hosts per network available for each class.
Class | Value of w | Network ID | Host ID | Number of networks | Number of hosts per network
A | 1–126 | w | x.y.z | 126 | 16,777,214
B | 128–191 | w.x | y.z | 16,384 | 65,534
C | 192–223 | w.x.y | z | 2,097,152 | 254
D | 224–239 | Reserved for multicast addressing | N/A | N/A | N/A
E | 240–254 | Reserved for experimental use | N/A | N/A | N/A


Subnet masks

Network IDs and host IDs within an IP address are distinguished by using a subnet mask. Each subnet mask is a 32-bit number that uses consecutive bit groups of all ones (1) to identify the network ID and all zeroes (0) to identify the host ID portions of an IP address.

For example, the subnet mask normally used with the IP address 131.107.16.200 is the following 32-bit binary number:

11111111 11111111 00000000 00000000

This subnet mask number is 16 one-bits followed by 16 zero-bits, indicating that the network ID and host ID sections of this IP address are both 16 bits in length. Normally, this subnet mask is displayed in dotted decimal notation as 255.255.0.0.

The following table displays subnet masks for the Internet address classes.

Address class | Bits for subnet mask | Subnet mask
Class A | 11111111 00000000 00000000 00000000 | 255.0.0.0
Class B | 11111111 11111111 00000000 00000000 | 255.255.0.0
Class C | 11111111 11111111 11111111 00000000 | 255.255.255.0

Typically, default subnet mask values (as shown in the previous table) are acceptable for most networks with no special requirements and where each IP network segment corresponds to a single physical network.

In some cases, you can use customized subnet masks to implement IP subnetting. With IP subnetting, you can subdivide the default host ID portion of an IP address to specify subnets, which are subdivisions of the original class-based network ID.

By customizing the subnet mask length, you can reduce the number of bits that are used for the actual host ID. For more information about using a custom subnet mask for subnetting your network, see the Windows 2000 Resource Kit.

Important

  • To prevent addressing and routing problems, you should make sure all TCP/IP computers on any network segment use the same subnet mask.


IP routing

In general terms, routing is the process of forwarding packets between connected networks. For TCP/IP-based networks, routing is part of the Internet Protocol (IP) and is used in combination with other network protocol services to provide forwarding capabilities between hosts that are located on separate network segments within a larger TCP/IP-based network.

IP is the mailroom of the TCP/IP protocol, where IP data sorting and delivery take place. Each incoming or outgoing packet is called an IP datagram. An IP datagram contains two IP addresses: the source address of the sending host and the destination address of the receiving host. Unlike hardware addresses, the IP addresses within a datagram remain the same as it travels across a TCP/IP network.

Routing is the primary function of IP. IP datagrams are exchanged and processed on each host by using IP at the Internet layer.

Above the IP layer, transport services on the source host pass data in the form of TCP segments or UDP messages to the IP layer. The IP layer assembles IP datagrams with source and destination address information that is used to route the data through the network. The IP layer then passes datagrams down to the network interface layer. At this layer, data-link services convert IP datagrams into frames for transmission over network-specific media on a physical network. This process happens in reverse order on the destination host.

Each IP datagram contains a source and destination IP address. IP layer services on each host examine the destination address of each datagram, compare this address to a locally maintained routing table, and then decide what further forwarding action to take. IP routers are attached to two or more IP network segments that are enabled to forward packets between them. The following sections discuss IP routers and the use of routing tables in further detail.

IP routers

TCP/IP network segments are interconnected by IP routers, which are devices that pass IP datagrams from one network segment to another. This process is known as IP routing and is shown in the following illustration.

IP routing

IP routers provide the primary means of joining together two or more physically separated IP network segments. All IP routers share two essential characteristics:

  • IP routers are multihomed hosts.

    A multihomed host is a network host that uses two or more network connection interfaces to connect to each physically separated network segment.

  • IP routers provide packet forwarding for other TCP/IP hosts.

    IP routers are distinct from other hosts that use multihoming in one important way: An IP router must be able to forward IP-based communication between networks for other IP network hosts.

You can implement IP routers by using a variety of possible hardware and software products. Box-based routers—dedicated hardware devices that run specialized software—are common. In addition, you can use routing solutions that are based on software, such as the Routing and Remote Access service, which runs on a computer running Windows 2000 Server.

For information about IP routing with the Windows 2000 Routing and Remote Access service, see Routing.

Regardless of the type of IP routers that you use, all IP routing relies on the use of a routing table to communicate between network segments.

Routing tables

TCP/IP hosts use a routing table to maintain knowledge about other IP networks and IP hosts. Networks and hosts are identified by using an IP address and a subnet mask. In addition, routing tables are important because they provide needed information to each local host regarding how to communicate with remote networks and hosts.

For each computer on an IP network, you can maintain a routing table with an entry for every other computer or network that communicates with the local computer. In general, this is not practical, and a default gateway (IP router) is used instead.

When a computer prepares to send an IP datagram, it inserts its own source IP address and the destination IP address of the recipient into the IP header. The computer then examines the destination IP address, compares it to a locally maintained IP routing table, and takes appropriate action based on what it finds. The computer does one of three things:

  • It passes the datagram up to a protocol layer above IP on the local host.
  • It forwards the datagram through one of its attached network interfaces.
  • It discards the datagram.

IP searches the routing table for the route that is the closest match to the destination IP address. The most specific to the least specific route is in the following order:

  • A route that matches the destination IP address (host route).
  • A route that matches the network ID of the destination IP address (network route).
  • The default route.

If a matching route is not found, IP discards the datagram.

For more information, see The Windows 2000 IP routing table.


The Windows 2000 IP routing table

Every computer that runs TCP/IP makes routing decisions. These decisions are controlled by the IP routing table. To display the IP routing table on a computer that is running Windows 2000, you can type route print at a command prompt.

The following table shows an example of an IP routing table. This example is for a computer running Windows 2000 with one network adapter and the following configuration:

  • IP address: 10.0.0.169
  • Subnet mask: 255.0.0.0
  • Default gateway: 10.0.0.1
Description | Network destination | Netmask | Gateway | Interface | Metric
Default route | 0.0.0.0 | 0.0.0.0 | 10.0.0.1 | 10.0.0.169 | 1
Loopback network | 127.0.0.0 | 255.0.0.0 | 127.0.0.1 | 127.0.0.1 | 1
Local network | 10.0.0.0 | 255.0.0.0 | 10.0.0.169 | 10.0.0.169 | 1
Local IP address | 10.0.0.169 | 255.255.255.255 | 127.0.0.1 | 127.0.0.1 | 1
Multicast addresses | 224.0.0.0 | 240.0.0.0 | 10.0.0.169 | 10.0.0.169 | 1
Limited broadcast address | 255.255.255.255 | 255.255.255.255 | 10.0.0.169 | 10.0.0.169 | 1

Note

  • The descriptions in the first column of the preceding table are not actually displayed in the output of the route print command.

The routing table is built automatically, based on the current TCP/IP configuration of your computer. Each route occupies a single line in the displayed table. The routing table is searched by your computer for an entry that is the most specific match to the destination IP address.

Your computer uses the default route if no other host or network route matches the destination address included in an IP datagram. The default route typically forwards an IP datagram (for which there is no matching or explicit local route) to a default gateway address for a router on the local subnet. In the previous example, the default route forwards the datagram to a router with a gateway address of 10.0.0.1.

Because the router that corresponds to the default gateway contains information about the network IDs of the other IP subnets within the larger TCP/IP internet, it forwards the datagram to other routers until the datagram is eventually delivered to an IP router that is connected to the specified destination host or subnet within the larger network.

The following sections describe each of the columns displayed in the IP routing table: network destination, netmask, gateway, interface, and metric.

Network destination

The network destination is used with the netmask to match the destination IP address. The network destination can range from 0.0.0.0 for the default route through 255.255.255.255 for the limited broadcast, which is a special broadcast address to all hosts on the same network segment.

Netmask

The netmask is the subnet mask that is applied to the destination IP address when matching to the value in the network destination. When netmask is written in binary, a "1" must match and a "0" need not match. For example, a 0.0.0.0 netmask is used for the default route, which means that none of the bits must match. For host routes, a route that matches an IP address, a 255.255.255.255 netmask is used.

Gateway

The gateway address is the IP address that the local host uses to forward IP datagrams to other IP networks. This is either the IP address of a local network adapter or the IP address of an IP router (such as a default gateway router) on the local network segment.

Interface

The interface is the IP address that is configured on the local computer for the local network adapter that is used when an IP datagram is forwarded on the network.

Metric

A metric indicates the cost of using a route, which is typically the number of hops to the IP destination. Anything on the local subnet is one hop, and each router crossed after that is an additional hop. If there are multiple routes to the same destination with different metrics, the route with the lowest metric is selected.

For information about adding routes to the IP routing table, see To add a static IP route. For information about deleting routes in the IP routing table, see To remove a static IP route.

Multihomed Windows 2000 hosts

The following shows the default routing table for a multihomed Windows 2000 host with this configuration:

  • Network adapter 1
    • IP address: 10.0.0.169
    • Subnet mask: 255.0.0.0
    • Default gateway: 10.0.0.1
  • Network adapter 2
    • IP address: 192.168.0.200
    • Subnet mask: 255.255.0.0
    • Default gateway: 192.168.0.1
Network destination | Netmask | Gateway | Interface | Metric
0.0.0.0 | 0.0.0.0 | 10.0.0.1 | 10.0.0.169 | 1
0.0.0.0 | 0.0.0.0 | 192.168.0.1 | 192.168.0.200 | 1
127.0.0.0 | 255.0.0.0 | 127.0.0.1 | 127.0.0.1 | 1
10.0.0.0 | 255.0.0.0 | 10.0.0.169 | 10.0.0.169 | 1
10.0.0.169 | 255.255.255.255 | 127.0.0.1 | 127.0.0.1 | 1
192.168.0.0 | 255.255.0.0 | 192.168.0.200 | 192.168.0.200 | 1
192.168.0.200 | 255.255.255.255 | 127.0.0.1 | 127.0.0.1 | 1
192.168.0.255 | 255.255.255.255 | 192.168.0.200 | 192.168.0.200 | 1
224.0.0.0 | 240.0.0.0 | 10.0.0.169 | 10.0.0.169 | 1
224.0.0.0 | 240.0.0.0 | 192.168.0.200 | 192.168.0.200 | 1
255.255.255.255 | 255.255.255.255 | 10.0.0.169 | 10.0.0.169 | 1
255.255.255.255 | 255.255.255.255 | 192.168.0.200 | 192.168.0.200 | 1

For information about enabling IP forwarding on a multihomed computer running Windows 2000, see To enable IP forwarding.

Notes

  • When you configure a default gateway to each network adapter, you create a 0.0.0.0 route for each network adapter. However, only one default route is actually used. In the previous example, the 10.0.0.169 IP address is the first network adapter in the TCP/IP bindings, and therefore the default route for Network adapter 1 is used. Because only one default gateway is used, you only need to configure one network adapter with a default gateway. This reduces confusion and assures the results you intended.
  • If the IP router is a Windows 2000 router and does not have an interface on a given network, it needs a route to get there. You can add static routes or use routing protocols that are provided by the Routing and Remote Access service. For information about IP routing with the Routing and Remote Access service, see Routing.


Name resolution

While IP is designed to work with the 32-bit IP addresses of the source and the destination hosts, computers are used by people who are not very good at using and remembering the IP addresses of the computers with which they want to communicate. People are much better at using and remembering names rather than IP addresses.

If a name is used as an alias for an IP address, you need to ensure that the name is unique and that it resolves to the correct IP address.

In Windows 2000, there are two types of names to resolve:

  • Host names

    Host names are used by programs that use the Windows Sockets programming interface, such as Web browsers. For more information, see Host name resolution.

  • NetBIOS names

    NetBIOS names are used by network programs or services that use the NetBIOS programming interface, such as Client for Microsoft Networks and File and Printer Sharing for Microsoft Networks. For more information, see NetBIOS name resolution.


Host name resolution

Host name resolution means successfully mapping a host name to an IP address. A host name is an alias that is assigned to an IP node to identify it as a TCP/IP host. The host name can be up to 255 characters long and can contain alphabetic and numeric characters, hyphens, and periods. You can assign multiple host names to the same host.

Windows Sockets (Winsock) programs, such as Internet Explorer and the FTP utility, can use one of two values for the destination to which you want to connect: the IP address or a host name. When the IP address is specified, name resolution is not needed. When a host name is specified, the host name must be resolved to an IP address before IP-based communication with the desired resource can begin.

Host names can take various forms. The two most common forms are a nickname and a domain name. A nickname is an alias to an IP address that individual people can assign and use. A domain name is a structured name in a hierarchical namespace called the Domain Name System (DNS). An example of a domain name is www.microsoft.com/.

Nicknames are resolved through entries in the Hosts file, which is stored in the systemroot\System32\Drivers\Etc folder. For more information, see TCP/IP database files.

Domain names are resolved by sending DNS name queries to a configured DNS server. The DNS server is a computer that stores domain name–to–IP address mapping records or has knowledge of other DNS servers. The DNS server resolves the queried domain name to an IP address and sends the result back.

You are required to configure your computers running Windows 2000 with the IP address of your DNS server in order to resolve domain names. You must configure Active Directory–based computers running Windows 2000 with the IP address of a DNS server.

For more information, see DNS defined.


NetBIOS name resolution

NetBIOS name resolution means successfully mapping a NetBIOS name to an IP address. A NetBIOS name is a 16-byte address that is used to identify a NetBIOS resource on the network. A NetBIOS name is either a unique (exclusive) or group (nonexclusive) name. When a NetBIOS process is communicating with a specific process on a specific computer, a unique name is used. When a NetBIOS process is communicating with multiple processes on multiple computers, a group name is used.

An example of a process that uses a NetBIOS name is the File and Printer Sharing for Microsoft Networks service on a computer running Windows 2000. When your computer starts up, this service registers a unique NetBIOS name based on the name of your computer. The exact name used by the service is the 15-character computer name plus a 16th character of 0x20. If the computer name is not 15 characters long, it is padded with spaces up to 15 characters.

When you attempt to make a file-sharing connection to a computer running Windows 2000 by name, the File and Printer Sharing for Microsoft Networks service on the file server you specify corresponds to a specific NetBIOS name. For example, when you attempt to connect to a computer called CORPSERVER, the NetBIOS name corresponding to the File and Printer Sharing for Microsoft Networks service on that computer is:

CORPSERVER     [20]

Note the use of spaces to pad the computer name. Before you can establish a file and print sharing connection, a TCP connection must be created. In order for a TCP connection to be established, the NetBIOS name "CORPSERVER [20]" must be resolved to an IP address.

The exact mechanism by which NetBIOS names are resolved to IP addresses depends on the NetBIOS node type that is configured for the node. RFC 1001, "Protocol Standard for a NetBIOS Service on a TCP/UDP Transport: Concepts and Methods," defines the NetBIOS node types, as listed in the following table.

Node type | Description
B-node(broadcast) | B-node uses broadcast NetBIOS name queries for name registration and resolution. B-node has two major problems: (1) Broadcasts disturb every node on the network, and (2) Routers typically do not forward broadcasts, so only NetBIOS names on the local network can be resolved.
P-node (peer-peer) | P-node uses a NetBIOS name server (NBNS), such as a WINS server, to resolve NetBIOS names. P-node does not use broadcasts; instead, it queries the name server directly.
M-node (mixed) | M-node is a combination of B-node and P-node. By default, an M-node functions as a B-node. If an M-node is unable to resolve a name by broadcast, it queries a NBNS using P-node.
H-node(hybrid) | H-node is a combination of P-node and B-node. By default, an H-node functions as a P-node. If an H-node is unable to resolve a name through the NBNS, it uses a broadcast to resolve the name.

Computers running Windows 2000 are B-node by default and become H-node when they are configured with a WINS server. Windows 2000 can also use a local database file called Lmhosts to resolve remote NetBIOS names. The Lmhosts file is stored in the systemroot\System32\Drivers\Etc folder. For more information, see TCP/IP database files.

It is highly recommended that you configure computers running Windows 2000 with the IP address of your WINS server in order for remote NetBIOS names to be resolved. You must configure Active Directory–based computers running Windows 2000 with the IP address of a WINS server if they are to communicate with other computers running Windows NT and Windows 2000, Windows 95, or Windows 98 that are not Active Directory–based.

For more information about WINS, see WINS defined.


Using TCP/IP

This section covers:

  • TCP/IP configuration items
  • TCP/IP configuration methods
  • Installing TCP/IP
  • Numbering your network
  • Default gateways
  • Advanced configuration


TCP/IP configuration items

For Windows 2000 TCP/IP to function properly, you need to configure the following:

  • IP address
  • Subnet mask
  • Default gateway
  • DNS server
  • WINS server

IP address

You must configure each interface on each TCP/IP node (host or router) with a unique IP address that is correct for the attached network segment. The IP address is a required configuration item.

For more information, see IP addressing.

Subnet mask

You must configure each interface on each TCP/IP node (host or router) with a subnet mask that, when combined with the IP address, yields the network ID. All IP interfaces on the same network segment must use the same network ID. Therefore, all IP interfaces on the same network segment must use the same subnet mask. The subnet mask is a required configuration item.

For more information, see Subnet masks.

Default gateway

To communicate with TCP/IP nodes on other network segments, you must configure at least one interface with the IP address of a default gateway (a local router that forwards remote TCP/IP traffic to its destination).

You do not need to configure a default gateway for a network that consists of a single network segment.

For more information, see IP routing.

DNS server

A DNS server can resolve domain names to IP addresses. When a TCP/IP host is configured with the IP address of a DNS server, the TCP/IP host sends DNS name queries to the DNS server for resolution. A DNS server is required for computers running Active Directory–based Windows 2000.

You do not need to configure a DNS server for a network that consists of a single network segment.

For more information, see Host name resolution.

A computer running Windows 2000 Server can be a DNS server. For more information, see Domain Name System (DNS).

WINS server

A WINS server can store and resolve NetBIOS names to IP addresses. When a TCP/IP host is configured with the IP address of a WINS server, the TCP/IP host registers its own NetBIOS names with the WINS server and sends NetBIOS name queries to the WINS server for resolution. A WINS server is highly recommended when there is more than one network segment in your network and when you have computers that are not based on Active Directory (for example, computers running Windows NT 4.0, Windows 95, and Windows 98).

You do not need to configure a WINS server for a network that consists of a single network segment.

For more information, see NetBIOS name resolution.

A computer running Windows 2000 Server can be a WINS server. For more information, see WINS.


TCP/IP configuration methods

You can configure TCP/IP in Windows 2000 by using the following methods:

  • Automatic configuration
  • Dynamic configuration
  • Manual configuration

If you are using either a dynamic or manual configuration, find out more about developing an effective TCP/IP network numbering plan in Numbering your network.

Automatic configuration

By using the new Automatic Private IP Addressing (APIPA) feature, Windows 2000 provides default automatic configuration of the IP address in the reserved range from 169.254.0.1 through 169.254.255.254 and a subnet mask of 255.255.0.0. There is no automatic configuration of a default gateway, DNS server, or WINS server. APIPA is designed for networks that consist of a single network segment that are not connected to the Internet. Therefore, you do not need to configure the default gateway, DNS server, and WINS server.

For more information, see To configure TCP/IP for automatic addressing.

Dynamic configuration

By using DHCP, TCP/IP configuration is done dynamically and automatically when the computer is started. Dynamic configuration requires the configuration of a DHCP server. By default, computers running Windows 2000 are DHCP clients. By properly configuring the DHCP server, TCP/IP hosts can obtain IP address, subnet mask, default gateway, DNS server, NetBIOS node type, and WINS server configuration information. Dynamic configuration (using DHCP) is recommended for medium-to-large TCP/IP networks.

For more information, see To configure TCP/IP for dynamic addressing.

Manual configuration

By manually configuring the properties of the TCP/IP protocol through the properties of a network connection (in Network and Dial-up Connections), you can assign an IP address, subnet mask, default gateway, DNS server, and WINS server. Manual configuration is required in a network with multiple network segments when no DHCP server is present.

For more information, see To configure TCP/IP for static addressing.


Installing TCP/IP

Before you install Microsoft TCP/IP on a computer running Windows 2000, you need to know:

  • Whether your network supports a dynamic TCP/IP configuration, which uses the Dynamic Host Configuration Protocol (DHCP).

    A dynamic configuration is the simplest to complete and can be used if another computer on your network is installed as a DHCP server. The DHCP server provides IP address, subnet mask, default gateway (IP router), DNS domain name, DNS server, and WINS server configuration information.

  • Whether your network requires a manual TCP/IP configuration.

    Some existing networks either do not use DHCP or require that TCP/IP configuration is performed manually for each computer.

For more information about configuration methods, see TCP/IP configuration methods.

If you do not use DHCP to configure TCP/IP dynamically, obtain the following information from your network administrator to configure TCP/IP manually:

  • The IP address and subnet mask for each network adapter that is installed on the computer.
  • The IP address for the default local gateway (IP router).

  • The name of your DNS domain and the IP addresses of the DNS servers on the network.

    For Active Directory deployment, the primary DNS suffix of a computer, also known as the computer's primary domain name, is by default the name of the Active Directory domain that the computer has joined. If you want your computer's primary DNS suffix to be different from the name of the Active Directory domain that the computer has joined, see To change the DNS suffix of your computer.

  • The IP addresses for the WINS servers, if WINS services are available on your network.
For more information about configuration items, see TCP/IP configuration items.

For instructions about installing and configuring TCP/IP, see To install TCP/IP and Configure TCP/IP.


Numbering your network

For private TCP/IP networks that are not directly or indirectly connected to the Internet, you can use any range of valid IP addresses from Class A, B, or C.

For private TCP/IP networks that are indirectly connected to the Internet by using a network address translator (NAT) or an application layer gateway such as a proxy server, the Internet Assigned Numbers Authority (IANA) recommends that you use the private IP addresses shown in the following table.

Private network ID | Subnet mask | Range of IP addresses
10.0.0.0 | 255.0.0.0 | 10.0.0.1 – 10.255.255.254
172.16.0.0 | 255.240.0.0 | 172.16.0.1 – 172.31.255.254
192.168.0.0 | 255.255.0.0 | 192.168.0.1 – 192.168.255.254

Numbers in these ranges are reserved by IANA for private use on TCP/IP networks and are not used on the Internet.

Usually, for security reasons, you should not connect more than a few TCP/IP systems within your network directly to the Internet. For any host systems on your network that connect to the Internet, you must obtain the use of registered IP addresses from your Internet service provider (ISP).

Notes

  • If your ISP cannot provide sufficient public addresses to accommodate your needs and you are located in the United States, you can apply directly to the American Registry for Internet Numbers (ARIN) to obtain an IANA-assigned IP network address. For more information about registering a public address, see the ARIN Web site. (http://www.arin.net/intro.html)
  • For more information about private IP address numbering for private networks, see RFC 1597, "Address Allocation for Private Internets."


Default gateways

Default gateways serve an important role in TCP/IP networking. They provide a default route for TCP/IP hosts to use when communicating with other hosts on remote networks.

The following illustration shows the role played by two default gateways (IP routers) for two networks: Network 1 and Network 2.

Role of default gateways

In order for Host A on Network 1 to communicate with Host B on Network 2, Host A first checks its routing table to see if a specific route to Host B exists. If there is no specific route to Host B, Host A forwards its TCP/IP traffic for Host B to its own default gateway, IP Router 1.

The same principle applies if Host B is sending to Host A. Without a specific route to Host A, Host B forwards any TCP/IP traffic destined for Host A to its own default gateway, IP Router 2.

Why gateways work

Default gateways are important to make IP routing work efficiently. In most cases, the router that acts as the default gateway for TCP/IP hosts—either a dedicated router or a computer that connects two or more network segments—maintains knowledge of other networks in the larger network and how to reach them.

TCP/IP hosts rely on default gateways for most of their communication needs with hosts on remote network segments. In this way, individual hosts are freed of the burden of having to maintain extensive and continuously updated knowledge about individual remote IP network segments. Only the router that acts as the default gateway needs to maintain this level of routing knowledge to reach other remote network segments in the larger internetwork.

If the default gateway fails, communication beyond the local network segment may be impaired. To prevent this, you can use the Advanced TCP/IP Settings dialog box (in Network and Dial-up Connections) for each connection to specify multiple default gateways. You can also use the route command to manually add routes to the routing table for heavily used hosts or networks.

Using multiple gateways

When configuring TCP/IP for Windows 2000, you can add more default gateways for each network adapter. When a computer is configured for multiple default gateways, all remote TCP/IP traffic that does not match an entry in the routing table is passed to the first default gateway defined for the first network adapter.

Because only one default gateway (the one defined for the first network adapter) is used, you should configure only one network adapter to have default gateways. This practice reduces confusion and assures the results you intended. For example, if you have two network adapters and configure a default gateway for each, the default gateway of the first network adapter is used. The default gateway for the second is used if the first is unavailable.


Advanced configuration

Beyond the configuration of an IP address, subnet mask, default gateway, DNS server, and WINS server, you can configure Windows 2000 TCP/IP for:

  • Advanced IP settings
  • Advanced DNS settings
  • Advanced WINS settings
  • Advanced options

Advanced IP settings

Advanced IP settings include:

  • Multiple IP addresses

    You can use multiple IP addresses per network connection for multiple IP numbering schemes, such as public addresses used for the Internet and private addresses, and for multiple logical IP networks on the same physical network segment.

  • Multiple default gateways

    You can use TCP/IP for Windows 2000 to detect downed routers by using a feature called dead gateway detection. If multiple default gateways are configured, a failing TCP connection updates the IP routing table with the next default gateway in the list.

For more information about configuring advanced IP settings, see To configure TCP/IP for static addressing.

Advanced DNS settings

Advanced DNS settings include:

  • Multiple DNS servers

    If multiple DNS servers are configured, and TCP/IP fails to receive any response from the current DNS server, TCP/IP switches to the next DNS server.

  • Unqualified name resolution

    For unqualified names, you can configure TCP/IP to either:

    • Append the primary and connection-specific DNS suffixes to the unqualified name for DNS queries.
    • Append a series of configured DNS suffixes to the unqualified name for DNS queries.
  • Connection-specific DNS suffixes

    You can configure each connection in Network and Dial-up Connections to have its own DNS suffix in addition to the primary DNS suffix that is configured for the computer on the Network Identification tab (available in System in Control Panel).

  • DNS dynamic update behavior

    If you have DNS servers that support DNS dynamic update (such as the Windows 2000 DNS service), you can enable the DNS dynamic update of the domain name and IP addresses for the computer. If you configure a connection-specific DNS suffix, you can also enable the DNS dynamic update of the domain name and IP addresses for the connection.

For more information about configuring advanced DNS settings, see To configure TCP/IP to use DNS.

Advanced WINS settings

Advanced WINS settings include:

  • Multiple WINS servers

    If multiple WINS servers are configured, and TCP/IP fails to receive any response from the current WINS server, TCP/IP switches to the next WINS server.

  • Enabling and disabling the use of the Lmhosts file

    If the Lmhosts file is enabled, TCP/IP parses the Lmhosts file found in the systemroot\System32\Drivers\Etc folder during NetBIOS name resolution. By default, the use of the Lmhosts file is enabled. For more information, see TCP/IP database files.

  • Enabling and disabling the use of NetBIOS over TCP/IP

    You can enable or disable the use of NetBIOS over TCP/IP. If the use of NetBIOS over TCP/IP is disabled, NetBIOS programs cannot run over TCP/IP. Therefore, you may not be able to connect to computers that are running an operating system other than Windows 2000. By default, the use of NetBIOS over TCP/IP is specified by the settings obtained from a DHCP server.

For more information about configuring advanced WINS settings, see To configure TCP/IP to use WINS.

Note

  • You can no longer configure the NetBIOS scope ID on the WINS tab. To configure the NetBIOS scope ID, set the following registry value to the name of the scope ID that you want to use:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\ScopeID

Advanced options

Advanced options include:

  • Enabling Internet Protocol security (IPSec) and specifying an IPSec security policy

    If IPSec is configured, secure end-to-end communication of IP-based traffic on a private network or the Internet is used. By default, IPSec is disabled. For more information, see Security features of TCP/IP for Windows 2000 and To configure TCP/IP to use an IPSec policy.

  • Enabing TCP/IP filtering and specifying TCP/IP traffic

    If TCP/IP filtering is enabled, you can specify what types of TCP/IP traffic are processed. For more information, see Security features of TCP/IP for Windows 2000 and To configure TCP/IP to use TCP/IP filtering.


Resources

This section covers:

  • TCP/IP RFCs
  • TCP/IP references
  • Converting binary to decimal
  • TCP/IP utilities
  • TCP/IP database files
  • Using Performance Logs and Alerts


TCP/IP RFCs

The standards for TCP/IP are published in a series of documents called Requests for Comments (RFCs). RFCs are an evolving series of reports, proposals for protocols, and protocol standards that describe the internal workings of TCP/IP and the Internet.

Although TCP/IP standards are always published as RFCs, not all RFCs specify standards. RFCs are authored by individuals who voluntarily write and submit a draft proposal for a new protocol or specification to the Internet Engineering Task Force (IETF) and other working groups. Submitted drafts are first reviewed by a technical expert, a task force, or an RFC editor, and then assigned a status.

If a draft passes this initial review stage, it is circulated to the larger Internet community for a period of further comment and review, and assigned an RFC number. This RFC number remains constant.

If changes are made to the proposed specification, drafts that are revised or updated are circulated by using a new RFC (a number higher than the original RFC number) to identify more recent documents.

There are five status assignments for RFCs in the standards process, as shown in the following table.

Status | Description
Standard protocol | An official standard protocol of the Internet.
Draft standard protocol | Under active consideration and review to become a standard protocol.
Proposed standard protocol | A protocol that in the future may become a standard protocol.
Experimental protocol | A protocol designed for experimental purposes. An experimental protocol is not intended for operational use.
Informational protocol | A protocol developed by another standards organizations that is included for the convenience of the Internet community.
Historic protocol | Protocols that have been superceded or obsoleted by other protocols.

RFCs for TCP/IP for Windows 2000

The following table shows the RFCs supported by the TCP/IP protocol in Windows 2000.

RFC number | Title
768 | User Datagram Protocol (UDP)
783 | Trivial File Transfer Protocol (TFTP)
791 | Internet Protocol (IP)
792 | Internet Control Message Protocol (ICMP)
793 | Transmission Control Protocol (TCP)
816 | Fault Isolation and Recovery
826 | Address Resolution Protocol (ARP)
854 | Telnet Protocol (TELNET)
862 | Echo Protocol (ECHO)
863 | Discard Protocol (DISCARD)
864 | Character Generator Protocol (CHARGEN)
865 | Quote of the Day Protocol (QUOTE)
867 | Daytime Protocol (DAYTIME)
894 | IP over Ethernet
919 | Broadcasting Internet Datagrams
922 | Broadcasting Internet Datagrams in the Presence of Subnets
950 | Internet Standard Subnetting Procedure
959 | File Transfer Protocol (FTP)
1001 | Protocol Standard for a NetBIOS Service on a TCP/UDP Transport: Concepts and Methods
1002 | Protocol Standard for a NetBIOS Service on a TCP/UDP Transport: Detailed Specifications
1009 | Requirements for Internet Gateways
1034 | Domain Names – Concepts and Facilities
1035 | Domain Names – Implementation and Specification
1042 | IP over Token Ring
1112 | Internet Group Management Protocol (IGMP)
1122 | Requirements for Internet Hosts – Communication Layers
1123 | Requirements for Internet Hosts – Application and Support
1157 | Simple Network Management Protocol (SNMP)
1179 | Line Printer Daemon Protocol
1188 | IP over FDDI
1191 | Path MTU Discovery
1201 | IP over ARCNET
1256 | ICMP Router Discovery Messages
1323 | TCP Extensions for High Performance
1518 | An Architecture for IP Address Allocation with CIDR
1519 | Classless Inter-Domain Routing (CIDR): An Address Assignment and Aggregation Strategy
1812 | Requirements for IP Version 4 Routers
1878 | Variable Length Subnet Table For IPv4
2018 | TCP Selective Acknowledgment Options
2131 | Dynamic Host Configuration Protocol (DHCP)
2136 | Dynamic Updates in the Domain Name System (DNS UPDATE)
2236 | Internet Group Management Protocol, Version 2

Obtaining RFCs

You can obtain RFCs from the Request for Comments Web site. (http://www.rfc-editor.org/) This Web site is currently maintained by members of the Information Sciences Institute (ISI), who publish a classified listing of all RFCs. RFCs are classified as one of the following: approved Internet standard, proposed Internet standard (circulated in draft form for review), Internet best practices, or For Your Information (FYI) document.

Note


TCP/IP references

For more information about the TCP/IP protocol suite, consult the following references:

  • Comer, D. Internetworking with TCP/IP, Volume I: Principles, Protocols, and Architecture. Third edition. Englewood Cliffs, NJ: Prentice Hall, 1995.
  • Comer, D. and D. Stevens. Internetworking with TCP/IP, Volume II: Design, Implementation, and Internals. Englewood Cliffs, NJ: Prentice Hall, 1991.
  • Lee, T. and J. Davies. Microsoft Windows 2000 TCP/IP Protocols and Services Technical Reference. Redmond, WA: Microsoft Press, 1999.
  • Stevens, W.R. TCP/IP Illustrated, Volume 1: The Protocols. Reading, MA: Addison-Wesley, 1994.


Converting binary to decimal

Because all IP addresses and subnet mask values are composed of a standard-length 32-bit data field, they are viewed and interpreted by computers as a single binary numeric string, such as:

10001010 00111001 00000111 00011011

Obviously, binary notation is not well suited for use by people, who prefer to express the same number in a simpler way, such as 138.57.7.27. To communicate IP addresses and enter them in configurations quickly, you can use dotted decimal notation to convert IP address numbers from binary format.

With dotted decimal notation, each 32-bit address number is viewed as four distinct groupings of 8 bits. Each of the four groupings of 8 consecutive bits is referred to as an octet.

The first octet uses the first 8 bits (bit places 1–8), the second octet uses the next 8 bits (bit places 9–16), followed by the third octet (bit places 17–24) and fourth octet (bit places 25–32). Periods are used to separate the four octets that are described as separate decimal number values in the IP address.

The following table shows the scientific notation for each bit place in an individual octet and the equivalent decimal value.

Equivalent decimal values for bit places in a single IP address octet

Octet | 1st bit | 2nd bit | 3rd bit | 4th bit | 5th bit | 6th bit | 7th bit | 8th bit
Scientific notation | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20
Decimal notation | 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1

For example, if the first bit place is filled with a bit value of 1, the equivalent decimal value is 128. Where the bit value is 0, the equivalent decimal value is 0 as well.

If all the bit places in an octet are filled with ones (1), the highest equivalent decimal value is 255. If all the bit places are filled with zeroes (0), the lowest equivalent decimal value is 0.

To see how each octet in an IP address is converted from an 8-digit binary number to an equivalent decimal number from 0 through 255, a brief example follows.

The following binary string shows the first octet in an IP address:

10001010

In this 8-digit binary number the first, fifth, and seventh bit places are filled with ones. All other bit places are filled with zeroes. By using the previous table as a reference, you can perform simple addition of each bit place's decimal equivalent value to find the decimal sum for this octet string, as follows:

1st bit (128) + 5th bit (8) + 7th bit (2) = octet total (138)

Because the sum is 138, the first octet of the example IP address is 138. After using this method on the other octets, the final result of the conversion is the dotted decimal equivalent: 138.57.7.27.


TCP/IP utilities

This section covers:

  • Windows 2000 utilities
  • Command-line utilities


Windows 2000 utilities

The following table lists the TCP/IP diagnostic utilities that are included with Windows 2000. You can use these utilities to help identify or resolve TCP/IP networking problems.

Utility | Description
Arp | Allows viewing and editing of the Address Resolution Protocol (ARP) cache. The ARP cache contains software-to-hardware address mappings used by Windows 2000 for sending data on the local network. For more information, see Arp and Troubleshooting hardware addresses by using arp.
Hostname | Displays the host name of the computer as used for authentication by the Rcp, Rsh, and Rexec utilities. For more information, see Hostname.
Ipconfig | Displays current TCP/IP configuration values. Also used to manually release and renew a TCP/IP configuration lease assigned by a DHCP server and to reset DNS name registrations. For more information, see Ipconfig and Command-line utilities.
Lpq | Displays print queue status information on computers running Line Printer Daemon (LPD) print server software. For more information, see Lpq.
Nbtstat | Checks the state of current NetBIOS over TCP/IP connections, updates the Lmhosts cache, and determines the registered names and scope ID. For more information, see Nbtstat and Troubleshooting NetBIOS names by using nbtstat.
Netstat | Displays protocol statistics and information on current TCP/IP connections. For more information, see Netstat and Displaying connection statistics by using netstat.
Nslookup | Checks records, domain host aliases, domain host services, and operating system information by querying DNS server. For more information, see Nslookup.
Ping | Verifies whether TCP/IP is configured correctly and tests connectivity to other host systems. For more information, see Ping and Testing connections by using ping.
Route | Allows viewing and editing of the local IP routing table. For more information, see Route.
Tracert | Traces the network route taken by an IP datagram to its destination. For more information, see Tracert and Tracing network connections by using tracert.
Pathping | Traces the route a packet takes to a destination and displays information on packet losses for each router in the path. Pathping can also be used to troubleshoot Quality of Service (QoS) connectivity. For more information, see Testing routers by using Pathping.

The following table lists additional Windows 2000 administrative utilities you can use for TCP/IP troubleshooting:

Administrative tool | Description
SNMP service | Provides statistical information to SNMP management systems.
Event Viewer | Tracks errors and events.
Performance Logs and Alerts | Analyzes TCP/IP core protocol performance when the SNMP service is installed.
Network Monitor | Captures and analyzes TCP/IP to and from a computer running Windows 2000 Server.
Registry Editor | Allows viewing and editing of registry settings.


Command-line utilities

This section covers:

  • Viewing configuration by using ipconfig /all
  • Refreshing configuration by using ipconfig /renew
  • Managing DNS and DHCP class IDs by using ipconfig
  • Testing connections by using ping
  • Troubleshooting hardware addresses by using arp
  • Troubleshooting NetBIOS names by using nbtstat
  • Displaying connection statistics by using netstat
  • Tracing network connections by using tracert
  • Testing routers by using pathping

Viewing configuration by using ipconfig /all

When you troubleshoot a TCP/IP networking problem, begin by checking the TCP/IP configuration on the computer that is experiencing the problem. You can use the ipconfig command to get host computer configuration information, including the IP address, subnet mask, and default gateway.

Note

  • For Windows 95 and Windows 98 clients, use the winipcfg command instead of ipconfig.

When you use the ipconfig command with the /all option, a detailed configuration report is produced for all interfaces, including any configured serial ports. With ipconfig /all, you can redirect command output to a file and paste the output into other documents. You can also use this output to confirm the TCP/IP configuration of each computer on the network or to further investigate of TCP/IP network problems.

For example, if a computer is configured with an IP address that is a duplicate of an existing IP address, the subnet mask appears as 0.0.0.0.

The following example shows the output of the ipconfig /all command on a computer that is configured to use the DHCP server for automatic TCP/IP configuration, and WINS and DNS servers for name resolution.

Windows 2000 IP Configuration

        Node Type . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . : No
        WINS Proxy Enabled. . . . . : No

Ethernet adapter Local Area Connection:

        Host Name . . . . . . . . . : corp1.microsoft.com
        DNS Servers . . . . . . . . : 10.1.0.200
        Description . . . . . . . . : 3Com 3C90x Ethernet Adapter
        Physical Address. . . . . . : 00-60-08-3E-46-07
        DHCP Enabled. . . . . . . . : Yes
        Autoconfiguration Enabled . : Yes
        IP Address. . . . . . . . . : 192.168.0.112
        Subnet Mask . . . . . . . . : 255.255.0.0
        Default Gateway . . . . . . : 192.168.0.1
        DHCP Server . . . . . . . . : 10.1.0.50
        Primary WINS Server . . . . : 10.1.0.101
        Secondary WINS Server . . . : 10.1.0.102
        Lease Obtained. . . . . . . : Wednesday, September 02, 1998 10:32:13 AM
        Lease Expires . . . . . . . : Friday, September 18, 1998 10:32:13 AM

If no problems appear in the TCP/IP configuration, the next step is testing the ability to connect to other host computers on the TCP/IP network.

Refreshing configuration by using ipconfig /renew

When you troubleshoot a TCP/IP networking problem, begin by checking the TCP/IP configuration on the computer that is experiencing the problem. If the computer is DHCP-enabled and is using a DHCP server to obtain configuration, you can initiate a refresh of the lease by using the ipconfig /renew command.

When you use ipconfig /renew, all network adapters on the computer that uses DHCP (except those that are manually configured) try to contact a DHCP server and renew their existing configuration or obtain a new configuration.

You can also use the ipconfig command with the /release option to immediately release the current DHCP configuration for a host. For more information about DHCP and the lease process, see How clients obtain configuration.

Note

  • For Windows 95 and Windows 98 DHCP-enabled clients, use the release and renew options of the winipcfg command instead of ipconfig /release and ipconfig /renew to perform manual release or renewal of the IP configuration lease for a client.

Managing DNS and DHCP class IDs by using ipconfig

You can also use the ipconfig command to:

  • Display or reset the DNS cache.

    • For more information, see Using ipconfig to view or reset a client resolver cache.

  • Refresh registered DNS names.

    • For more information, see Using ipconfig to renew DNS client registration.

  • Display the DHCP class IDs for an adapter.

    • For more information, see To show DHCP class ID information at a client computer.

  • Set the DHCP class IDs for an adapter.

    • For more information, see To set DHCP class ID information at a client computer.

Testing connections by using ping

The ping command helps to verify IP-level connectivity. When troubleshooting, you can use ping to send an ICMP echo request to a target host name or IP address. Use ping whenever you need to verify that a host computer can connect to the TCP/IP network and network resources. You can also use ping to isolate network hardware problems and incompatible configurations.

It is usually best to verify that a route exists between the local computer and a network host by first using the ping command and the IP address of the network host to which you want to connect. Try pinging the IP address of the target host to see if it responds, as follows:

ping IP_address

You should perform the following steps when using ping:

  1. Ping the loopback address to verify that TCP/IP is installed and configured correctly on the local computer.

    ping 127.0.0.1

  2. Ping the IP address of the local computer to verify that it was added to the network correctly.

    ping IP_address_of_local_host

  3. Ping the IP address of the default gateway to verify that the default gateway is functioning and that you can communicate with a local host on the local network.

    ping IP_address_of_default_gateway

  4. Ping the IP address of a remote host to verify that you can communicate through a router.

    ping IP_address_of_remote_host

The ping command uses Windows Sockets–style name resolution to resolve a computer name to an IP address, so if pinging by address succeeds, but pinging by name fails, then the problem lies in address or name resolution, not network connectivity. For more information, see Troubleshooting hardware addresses by using arp.

If you cannot use ping successfully at any point, confirm that:

  • The computer was restarted after TCP/IP was installed and configured.
  • The IP address of the local computer is valid and appears correctly on the General tab of the Internet Protocol (TCP/IP) Properties dialog box.
  • IP routing is enabled and the link between routers is operational.

You can use different options with the ping command to specify the size of packets to use, how many packets to send, whether to record the route used, what Time-to-Live (TTL) value to use, and whether to set the "don't fragment" flag. You can type ping –? to see these options.

The following example illustrates how to send two pings, each 1,450 bytes in size, to IP address 172.16.48.10:

C:\>ping -n 2 -l 1450 172.16.48.10
Pinging 172.16.48.10 with 1450 bytes of data:

Reply from 172.16.48.10: bytes=1450 time<10ms TTL=32
Reply from 172.16.48.10: bytes=1450 time<10ms TTL=32

Ping statistics for 157.59.8.1:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate roundtrip times in milli-seconds:
    Minimum = 0ms, Maximum =  10ms, Average =  2ms

By default, ping waits 1,000 ms (1 second) for each response to be returned before displaying the "Request Timed Out" message. If the remote system being pinged is across a high-delay link, such as a satellite link, responses may take longer to be returned. You can use the –w (wait) option to specify a longer time-out.

Troubleshooting hardware addresses by using arp

The Address Resolution Protocol (ARP) allows a host to find the media access control address of a host on the same physical network, given the IP address of the host. To make ARP efficient, each computer caches IP–to–media access control address mappings to eliminate repetitive ARP broadcast requests.

You can use the arp command to view and modify the ARP table entries on the local computer. The arp command is useful for viewing the ARP cache and resolving address resolution problems.

For more information, see To view the Address Resolution Protocol (ARP) cache and To add a static ARP cache entry.

Troubleshooting NetBIOS names by using nbtstat

NetBIOS over TCP/IP (NetBT) resolves NetBIOS names to IP addresses. TCP/IP provides many options for NetBIOS name resolution, including local cache lookup, WINS server query, broadcast, DNS server query, and Lmhosts and Hosts file lookup.

Nbtstat is a useful tool for troubleshooting NetBIOS name resolution problems. You can use the nbtstat command to remove or correct preloaded entries:

  • nbtstat –n displays the names that were registered locally on the system by programs such as the server and redirector.
  • nbtstat –c shows the NetBIOS name cache, which contains name-to-address mappings for other computers.
  • nbtstat –R purges the name cache and reloads it from the Lmhosts file.
  • nbtstat –RR releases NetBIOS names registered with a WINS server and then renews their registration.
  • nbtstat –a name performs a NetBIOS adapter status command against the computer specified by name. The adapter status command returns the local NetBIOS name table for that computer plus the media access control address of the adapter.
  • nbtstat –S lists the current NetBIOS sessions and their status, including statistics, as shown in the following example:
    NetBIOS connection table

Local name State     In/out Remote Host    Input   Output
------------------------------------------------------------------
CORP1 <00> Connected Out    CORPSUP1<20>   6MB     5MB
CORP1 <00> Connected Out    CORPPRINT<20>  108KB   116KB
CORP1 <00> Connected Out    CORPSRC1<20>   299KB   19KB
CORP1 <00> Connected Out    CORPEMAIL1<20> 324KB   19KB
CORP1 <03> Listening

Displaying connection statistics by using netstat

You can use the netstat command to display protocol statistics and current TCP/IP connections. The netstat –a command displays all connections, and netstat –r displays the route table plus active connections. The netstat –e command displays Ethernet statistics, and netstat –s displays per-protocol statistics. If you use netstat –n, addresses and port numbers are not converted to names. The following shows sample output for netstat:

C:\>netstat -e
Interface Statistics

                       Received      Sent
Bytes                  3995837940    47224622
Unicast packets        120099        131015
Non-unicast packets    7579544       3823
Discards               0             0
Errors                 0             0
Unknown protocols      363054211

C:\>netstat -a

Active Connections

 Proto Local Address      Foreign Address       State
 TCP  CORP1:1572       172.16.48.10:nbsession   ESTABLISHED
 TCP  CORP1:1589       172.16.48.10:nbsession   ESTABLISHED
 TCP  CORP1:1606       172.16.105.245:nbsession ESTABLISHED
 TCP  CORP1:1632       172.16.48.213:nbsession  ESTABLISHED
 TCP  CORP1:1659       172.16.48.169:nbsession  ESTABLISHED
 TCP  CORP1:1714       172.16.48.203:nbsession  ESTABLISHED
 TCP  CORP1:1719       172.16.48.36:nbsession   ESTABLISHED
 TCP  CORP1:1241       172.16.48.101:nbsession  ESTABLISHED
 UDP  CORP1:1025       *:*
 UDP  CORP1:snmp       *:*
 UDP  CORP1:nbname     *:*
 UDP  CORP1:nbdatagram *:*
 UDP  CORP1:nbname     *:*
 UDP  CORP1:nbdatagram *:*

C:\>netstat -s
IP Statistics

 Packets Received             = 5378528
 Received Header Errors       = 738854
 Received Address Errors      = 23150
 Datagrams Forwarded          = 0
 Unknown Protocols Received   = 0
 Received Packets Discarded   = 0
 Received Packets Delivered   = 4616524
 Output Requests              = 132702
 Routing Discards             = 157
 Discarded Output Packets     = 0
 Output Packet No Route       = 0
 Reassembly Required          = 0
 Reassembly Successful             = 0
 Reassembly Failures               = 0
 Datagrams Successfully Fragmented = 0
 Datagrams Failing Fragmentation   = 0
 Fragments Created                 = 0

ICMP Statistics
                          Received  Sent
 Messages                 693       4
 Errors                   0         0
 Destination Unreachable  685       0
 Time Exceeded            0         0
 Parameter Problems       0         0
 Source Quenches          0         0
 Redirects                0         0
 Echoes                   4         0
 Echo Replies             0         4
 Timestamps               0         0
 Timestamp Replies        0         0
 Address Masks            0         0
 Address Mask Replies     0         0

TCP Statistics

 Active Opens                 = 597
 Passive Opens                = 135
 Failed Connection Attempts   = 107
 Reset Connections            = 91
 Current Connections          = 8
 Segments Received            = 106770
 Segments Sent                = 118431
 Segments Retransmitted       = 461

UDP Statistics

 Datagrams Received   = 4157136
 No Ports             = 351928
 Receive Errors       = 2
 Datagrams Sent       = 13809

Tracing network connections by using tracert

Tracert (Trace Route) is a route-tracing utility that is used to determine the path that an IP datagram takes to reach a destination. The tracert command uses the IP Time-to-Live (TTL) field and ICMP error messages to determine the route from one host to another through a network.

How tracert works

The Tracert diagnostic utility determines the route taken to a destination by sending Internet Control Message Protocol (ICMP) echo packets with varying IP Time-to-Live (TTL) values to the destination. Each router along the path is required to decrement the TTL on a packet by at least 1 before forwarding it. When the TTL on a packet reaches 0, the router should send an "ICMP Time Exceeded" message back to the source computer.

Tracert determines the route by sending the first echo packet with a TTL of 1 and incrementing the TTL by 1 on each subsequent transmission until the target responds or the maximum TTL is reached. The route is determined by examining the "ICMP Time Exceeded" messages sent back by intermediate routers. Some routers silently drop packets with expired TTLs and are invisible to the Tracert utility.

The tracert command prints out an ordered list of the near-side interface of the routers in the path that returned the "ICMP Time Exceeded" message. If the –d option is used, the Tracert utility does not perform a DNS lookup on each IP address.

In the following example, the packet must travel through two routers (10.0.0.1 and 192.168.0.1) to get to host 172.16.0.99. The default gateway of the host is 10.0.0.1 and the IP address of the router on the 192.168.0.0 network is 192.168.0.1.

C:\>tracert 172.16.0.99 -d
Tracing route to 172.16.0.99 over a maximum of 30 hops
1     2 ms     3 ms     2 ms  10.0.0.1
2    75 ms    83 ms    88 ms  192.168.0.1
3    73 ms    79 ms    93 ms  172.16.0.99
Trace complete.

Troubleshooting with tracert

You can use the tracert command to determine where a packet stopped on the network. In the following example, the default gateway has determined that there is not a valid path for the host on 192.168.10.99. There is probably a router configuration problem or the 192.168.10.0 network does not exist (a bad IP address).

C:\>tracert 192.168.10.99

Tracing route to 192.168.10.99 over a maximum of 30 hops

1 10.0.0.1 reports: Destination net unreachable.

Trace complete.

The Tracert utility is useful for troubleshooting large networks where several paths can be taken to arrive at the same point.

Tracert command-line options

The tracert command supports several options, as shown in the following table.

tracert [–d] [–h maximum_hops] [–j host-list] [–w timeout] target_name

Option | Description
–d | Specifies that IP addresses are not resolved to host names.
–h maximum_hops | Specifies the number of hops to allow in tracing a route to the host named in target_name.
–j host-list | Specifies the list of router interfaces in the path taken by the Tracert utility packets.
–w timeout | Waits the number of milliseconds specified by timeout for each reply.
target_name | Name or IP address of the target host.

For more information, see To trace a path by using the tracert command.

Testing routers by using pathping

The pathping command is a route tracing tool that combines features of the ping and tracert commands with additional information that neither of those tools provides. The pathping command sends packets to each router on the way to a final destination over a period of time, and then computes results based on the packets returned from each hop. Since the command shows the degree of packet loss at any given router or link, it is easy to determine which routers or links might be causing network problems. A number of options are available, as shown in the following table.

Option | Name | Function
–n | Hostnames | Does not resolve addresses to host names.
–h | Maximum hops | Maximum number of hops to search for target.
–g | Host-list | Loose source route along host list.
–p | Period | Number of milliseconds to wait between pings.
–q | Num_queries | Number of queries per hop.
–w | Time-out | Waits this many milliseconds for each reply.
-T | Layer 2 tag | Attaches a layer-2 priority tag (for example, for IEEE 802.1p) to the packets and sends it to each of the network devices in the path. This helps in identifying the network devices that do not have layer-2 priority configured properly. The -T switch is used to test for Quality of Service (QoS) connectivity.
-R | RSVP test | Checks to determine whether each router in the path supports the Resource Reservation Protocol (RSVP), which allows the host computer to reserve a certain amount of bandwidth for a data stream. The -R switch is used to test for Quality of Service (QoS) connectivity.

The default number of hops is 30, and the default wait time before a time-out is 3 seconds. The default period is 250 milliseconds, and the default number of queries to each router along the path is 100.

The following is a typical pathping report. The compiled statistics that follow the hop list indicate packet loss at each individual router.

D:\>pathping -n msw

Tracing route to msw [7.54.1.196]
over a maximum of 30 hops:
  0  172.16.87.35
  1  172.16.87.218
  2  192.68.52.1
  3  192.68.80.1
  4  7.54.247.14
  5  7.54.1.196

Computing statistics for 125 seconds...
            Source to Here   This Node/Link
Hop  RTT    Lost/Sent = Pct  Lost/Sent = Pct  Address
  0                                           172.16.87.35
                                0/ 100 =  0%   |
  1   41ms     0/ 100 =  0%     0/ 100 =  0%  172.16.87.218
                               13/ 100 = 13%   |
  2   22ms    16/ 100 = 16%     3/ 100 =  3%  192.68.52.1
                                0/ 100 =  0%   |
  3   24ms    13/ 100 = 13%     0/ 100 =  0%  192.68.80.1
                                0/ 100 =  0%   |
  4   21ms    14/ 100 = 14%     1/ 100 =  1%  10.54.247.14
                                0/ 100 =  0%   |
  5   24ms    13/ 100 = 13%     0/ 100 =  0%  10.54.1.196

Trace complete.

When pathping is run, you first see the results for the route as it is tested for problems. This is the same path that is shown by the tracert command. The pathping command then displays a busy message for the next 125 seconds (this time varies by the hop count). During this time, pathping gathers information from all the routers previously listed and from the links between them. At the end of this period, it displays the test results.

The two rightmost columns—This Node/Link Lost/Sent=Pct and Address—contain the most useful information. The link between 172.16.87.218 (hop 1), and 192.68.52.1 (hop 2) is dropping 13 percent of the packets. All other links are working normally. The routers at hops 2 and 4 also drop packets addressed to them (as shown in the This Node/Link column), but this loss does not affect their forwarding path.

The loss rates displayed for the links (marked as a | in the rightmost column) indicate losses of packets being forwarded along the path. This loss indicates link congestion. The loss rates displayed for routers (indicated by their IP addresses in the rightmost column) indicate that those routers' CPUs might be overloaded. These congested routers might also be a factor in end-to-end problems, especially if packets are forwarded by software routers.


TCP/IP database files

The following table lists the UNIX-style database files that are stored in the systemroot\System32\Drivers\Etc folder when you install TCP/IP for Windows 2000.

File name | Use
Hosts | Provides host name–to–IP address resolution for Windows Sockets programs.
Lmhosts | Provides NetBIOS name–to–IP address resolution for Windows-based networking.
Networks | Provides network name–to–network ID resolution for Windows Sockets programs.
Protocols | Provides protocol name–to–protocol ID resolution for Windows Sockets programs.
Services | Provides service name–to–port ID resolution for Windows Sockets programs.

To troubleshoot any of these files on a local computer, do the following:

  1. Make sure the format of entries in each file matches the format defined in the sample file originally installed with TCP/IP for Windows 2000.
  2. Check for spelling errors.
  3. Check for invalid IP addresses and identifiers.

Note

  • By default, the Lmhosts file does not exist. There is an Lmhosts.sam sample file that you can use as a basis for creating an Lmhosts file.


Using Performance Logs and Alerts

You can use the Windows 2000 Performance Logs and Alerts to view many different TCP/IP-related counters. Because the Performance Logs and Alerts access statistics that are gathered by the SNMP service, the SNMP service must be installed on computers running Windows 2000 where TCP/IP statistics are to be monitored. Counters for Performance Logs and Alerts are available for network adapters, IP, ICMP, UDP, and TCP.

With Performance Logs and Alerts, you can monitor counters from various systems from a single management window. You can also set alert levels for the counters being monitored.

For more information, see Using Performance.


Troubleshooting

What problem are you having?

Host name resolution is failing.

Cause: Host name resolution techniques are failing to resolve a host name to its IP address.

Solution: Windows 2000 includes several basic TCP/IP tools that you can use to troubleshoot address and name resolution problems, including the ping command. If you receive the correct response when you use the ping command with an IP address but an incorrect response when you use ping with the host name or NetBIOS name, there is a name resolution problem.

When you use TCP/IP tools such as the ping command, the Hosts file or a DNS server is used for name resolution. You can find the Hosts file in the systemroot\System32\Drivers\Etc folder. This file is not dynamic; you must manually add entries. The format of the file is as follows:

IP address Friendly name

172.16.48.10   jsmith   # Remarks are denoted with a #.

When you use a Hosts file for name resolution, the following steps occur:

  1. A user at Computer A enters a command by using the host name of Computer B.
  2. The Hosts file on Computer A (in the systemroot\System32\Drivers\Etc folder) is parsed. When the host name of Computer B is found, it is resolved to an IP address.

The following problems can occur because of errors related to the Hosts file:

  • The Hosts file or the DNS server does not contain the particular host name.
  • The host name in the Hosts file or in the command is misspelled.
  • An invalid IP address is entered for the host name in the Hosts file.
  • The Hosts file contains multiple entries for the same host on separate lines; if so, the first entry from the top of the file is used.
  • A mapping for a computer name–to–IP address was mistakenly added to the Hosts file, rather than the Lmhosts file.

For DNS server host name resolution, verify that the correct DNS servers are configured and in the proper order. You can use the ipconfig /all command to check the current TCP/IP configuration and the ping command to check connectivity with your DNS servers. You can use the nslookup command to send DNS name queries to your primary DNS server.

If you use a DNS server for host name resolution, the name resolution steps are similar. Computer A sends a DNS name query to its configured DNS server. The DNS server resolves the host name of Computer B to an IP address and sends the results back to Computer A.

See also: Host name resolution; Viewing configuration by using ipconfig /all; Ping; Nslookup; TCP/IP database files

Unable to add a default gateway.

Cause: The IP address of the default gateway is not on the same IP network ID as your IP address.

Solution: Find out whether the default gateway is located on the same logical network as the network adapter of the computer by comparing the IP address of the default gateway with the network IDs of any of the network adapters of the computer.

For example, a computer with a single network adapter that is configured with an IP address of 192.168.0.33 and a subnet mask of 255.255.0.0 requires that the default gateway be of the form 192.168.y.z because the network ID portion of the IP interface is 192.168.0.0.

See also: IP addressing; Subnet masks; Default gateways

System error 53 occurred.

Cause: System error 53 is returned if name resolution fails for a particular computer name when the net use command is used.

Solution: If the computer is on the local subnet, confirm that the name is spelled correctly and that the target computer is running TCP/IP as well. If the computer is not on the local subnet, be sure that its name and IP address mapping are available in the Lmhosts file or the WINS database. If all TCP/IP elements appear to be installed properly, use the ping command with the remote computer to verify that its TCP/IP software is working.

See also: To test a TCP/IP configuration by using the ping command; To test TCP/IP connections by using the ping and net view commands; Net use; Ping

Cannot connect to a specific server.

Cause: Either NetBIOS name resolution is failing to resolve the name or the wrong IP address is being resolved.

Solution: Use the nbtstat –n command on the server to determine what names the server registered on the network. The computer name of the computer you are trying to connect to should be on the displayed list. If the name is not listed, try one of the other unique computer names displayed by nbtstat.

If the name being used by a remote computer is the same as the name displayed by the nbtstat –n command, then make sure that the remote computer has an entry for the server name on the WINS server or in its Lmhosts file.

See also: NetBIOS name resolution; To test TCP/IP connections by using the ping and net view commands; Net use; TCP/IP database files; Nbtstat

Long connect times when using Lmhosts for name resolution.

Cause: The Lmhosts file is parsed sequentially to locate entries without the #PRE option.

Solution: Place frequently used entries near the top of the file and place the #PRE entries near the bottom. If an entry is added to the end of a large Lmhosts file, mark the entry in Lmhosts as a preloaded entry by using the #PRE option. Then use the nbtstat –R command to update the local name cache immediately.

See also: TCP/IP database files; Nbtstat; To view the NetBIOS name table by using the nbtstat command; To release and refresh NetBIOS names by using the nbtstat command

TCP/IP connection to a host appears to be hung.

Cause: Either data is blocked in TCP and UDP queues or there are network or application delay problems.

Solution: Use the netstat –a command to show the status of all activity on TCP and UDP ports on the local computer.

The state of a good TCP connection is usually established with 0 bytes in the send and receive queues. If data is blocked in either queue, or if the state is irregular, there is probably a problem with the connection. If not, you are probably experiencing a network or application delay.

See also: Netstat; To view current TCP/IP protocol and connection statistics

Cannot ping across a local router when using a dial-up connection.

Cause: This problem occurs if the Use default gateway on remote network check box is selected on the General tab in the Advanced TCP/IP Settings dialog box (in the Internet Protocol (TCP/IP) dialog box on the General or Networking tab for the properties of the dial-up connection).

This feature adds a default route to the IP routing table that is used instead of the current default route for the duration of the connection. The new default route causes network traffic for IP addresses that are not resolved by other entries in the routing table to be sent across the dial-up connection. This new default route is needed when you dial an Internet service provider (ISP) and use Internet utilities, such as a Web browser or FTP, to access Internet resources.

Solution: If you want to ping or otherwise connect to computers in a remote network segment across a local router while you are connected as a dial-up client to an ISP, then use the route add command to add the route of the network segment you are attempting to reach by specifying the destination network and subnet mask of the remote network segment and the IP address of the local router.

See also: Route

A "The registry subkey already exists" message is displayed.

Cause: The registry keys for a component being installed already exist.

Solution: Ensure that all the components of a given TCP/IP service are properly removed, and then remove the appropriate registry subkeys by using the Windows 2000 Registry Editor.

Caution

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

TCP/IP registry keys

If you removed TCP/IP and its related service components, you must also remove the following registry subkeys:

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TcpipCU
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LmHosts
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdapterName\Parameters\Tcpip

SNMP service registry keys

If you removed the SNMP service components, you must also remove the following registry subkeys:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RFC1156Agent
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Snmp
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Snmp

TCP/IP Printing service registry keys

If you removed the TCP/IP Printing service components, you must also remove the following registry subkeys:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Lpdsvc
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TcpPrint
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LpdsvcSimple TCP/IP Services

Simple TCP/IP Services registry keys

If you removed the Simple TCP/IP Services components, you must also remove the following registry subkeys:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SimpTcp
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SimpTcp

DHCP service registry keys

If you removed the DHCP service components, you must also remove the following registry subkeys:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DhcpMibAgent
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DhcpServer
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DhcpServer

WINS service registry keys

If you removed the WINS service components, you must also remove the following registry subkeys:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wins
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WinsMibAgent
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wins

DNS service registry keys

If you have removed the DNS service components, you must also remove the following registry subkeys:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Dns
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dns

For more advanced TCP/IP troubleshooting information, see the Windows 2000 Resource Kit.