Networking Tools. Windows. Gilbert Held. Troubleshooting, and Security. The Complete Guide to Management, CRC Press INFORMATIONSBIBLIOTHEK

Transcription

1 Windows Networking Tools The Complete Guide to Management, Troubleshooting, and Security Gilbert Held TECHNISCHE INFORMATIONSBIBLIOTHEK UNIVERSITATSBIBUOTHEK HANNOVCQ CRC Press Taylor & Francis Croup Boca Raton London New York CRC Press is an imprint of the Taylor & Francis Croup, an Informs business AN AUERBACH BOOK

2 Contents Chapter 1 Introduction The TCP/IP Protocol Suite Applications Current Applications Emerging Applications Book Preview Examining the TCP/IP Protocol Suite IP and MAC Addressing Transport Layer Protocols Working with the Command Prompt Windows Built-in Networking Tools Network Monitoring Network Security Efficiency Methods 16 Chapter 2 Examining the TCP/IP Protocol Suite ISO Reference Model OSI Reference Model Layers Layer 1: The Physical Layer Layer 2: The Data Link Layer Layer 2 Subdivision Layer 3: The Network Layer Layer 4: The Transport Layer Layer 5: The Session Layer Layer 6: The Presentation Layer Layer 7: The Application Layer 23 V

3 VI CONTENTS Data Flow The TCP/IP Protocol Suite The TCP/IP Network Layer IP IPv4 Addressing IPv6 Addressing ARP ICMP The Transport Layer TCP UDP The Application Layer Data Flow within a TCP/IP Network Summary 31 Chapter 3 Addressing at Layers 2 and 3 and the Internet Protocol Data Link Addressing Ethernet Frame Operations Basic Ethernet Full Duplex and the PAUSE Frame vlan Tagging SNAP Frames Frame Determination Fast Ethernet B5B Coding Delimiters Interframe Gap Gigabit Ethernet Standards Evolution Varieties Frame Format Modifications Gigabit Carrier Extension Half-Duplex Use Frame Bursting Jumbo Frames 57 Ethernet Fiber Standards GBASE-SR GBASE-LR GBASE-LRM GBASE-ER GBASE-ZR GBASE-LX Copper GBASE-CX logsfp+cu 62

4 CONTENTS VII Backplane 10 GBps Ethernet GBASE-T The IPv4 Header Vers Field Hlen and Total Length Fields Type of Service Field Identification Field Flags Field Fragment Offset Field Time to Live Field Protocol Field Checksum Field Source and Destination Address Fields Options and Padding Fields IPv4 Addressing Overview Addressing Basic Addressing Scheme Address Classes Address Formats Address Composition and Notation Special IPv4 Addresses Subnetting and the Subnet Mask Classless Networking Tne IPv6 Header Ver Field Priority Field Flow Label Field Payload Length Field Next Header Field Hop Limit Field Source and Destination Address Fields Address Types Address Notation Address Allocation Provider-Based Unicast Addresses Multicast Addresses Transporting IPv4 Addresses ICMPandARP ICMP ICMPv ICMPv ARP LAN Delivery RARP 107

5 VIII CONTENTS Chapter 4 Transport Layer Protocols TCP TCP Header Source and Destination Port Fields Sequence and Acknowledgment Number Fields Hlen Field Code Bit Field Window Field Checksum Field Urgent Pointer Field Options Field Padding Field Connection Establishment Connection Function Calls Port Hiding Passive OPEN Active OPEN Ihe Three-Way Handshake Overview Operation The TCP Window Avoiding Congestion TCP Retransmissions Session Termination UDP UDP Header Source and Destination Port Fields Length Field Checksum Field Operation Applications 130 Chapter 5 Working with the Command Prompt The Command Prompt Location Options Positioning upon Opening Controlling the Command Prompt Window Working with Function Keys and Commands Function Key Use Repertoire ofcommands The Help Command The CLS Command Controlling Output and Additional Commands Redirection Methods Other Useful Commands 151

6 CONTENTS IX Wildcards 156 Chapter 6 Windows Built-In Networking Tools Ping Discovery via Ping Ping Options Using the Round-Trip Delay Tracert Using Tracert The Pathping Command The ipconfig Command The Release and Renew Options The Flushdns Option The Displaydns Option ARP Reverse ARP (RARP) and ARP and IPv The Getmac Command The Netstat Command Command Format The -a Switch The -b Switch The -e and -s Switches The-f Switch The -n Switch The -o Switch The-p Switch and Interval Use The -r Switch The -s Switch The-t Switch The Route Command Command Format f Switch p Switch Switch Switch Commands Supported The Destination Option Mask and Netmask The Gateway Option The Metric Option The If Interface Option Working with Route The IPv4 Routing Table The IPv6 Routing Table The Nslookup Command The Getmac Command The Net Command 203

7 X CONTENTS The Net Accounts Command Net Accounts Options The Net Computer Option The Net Config Option The Net Continue, Start, and Stop Options The Net File Option The Net Group Option The Net Helpmsg The Net Send Command The Net Localgroup Option The Net Share Command Option The Net Session Command The Net Statistics Command The Net Time Command The Net Use Command The Net User Command The Netsh Command The Netsh Wlan Command The Add Subcommand The Connect Subcommand The Delete Subcommand The Export Profile Subcommand Other Netsh Wlan Functions 238 Chapter 7 Network Monitoring with Wireshark and WinDump Wireshark Program Evolution Obtaining the Program Program Overview The Capture Screen Packet Colors Examining a Packet File Menu Options Working with Filters Filter Expressions Applying a Filter Statistics Summary Data Protocol Hierarchy Conversations Endpoints Packet Lengths IO Graphs Conversation List Endpoint List and Other Entries 260

8 CONTENTS XI Telephony RTP Stream Analysis VoIP Calls The Tools Menu WinDump Overview Initial Operation Selecting an Interface Program Format Using Multiple Switches Program Switches WinDump Expressions Qualifiers Expression Primitives Relationship Operators Utilization Examples 290 Network Intrusion and Security Snort Requirements Installation Commencing Snort Sniffer Mode Packet Logger Mode Network Intrusion Detection System Mode Command Switches The -A Switch The -b Switch The -B Switch The -C Switch The -d Switch The -E Switch The -f Switch The -F Switch The -G Switch The -H Switch The -i Switch The T Switch The -k and -K Switches The -1 and -L Switches The -n Switch The -O Switch The -p and -P Switches The -q Switch The -r and -R Switches 318

9 XII CONTENTS The-s and-s Switches The-T Switch The-U Switch The-v and-v Switches The-W Switch The-X and-x Switches The-y Switch The -Z Switch Network Intrusion Detection System Mode Using SpywareBlaster Obtaining the Program Adding Protection Restricted Site Protection System Snapshot The Tools Menu Flash Killer Custom Blocking Checking for Updates Using Online Armor Installation Operation AXCrypt File Encryption Installation Operation 340 Chapter 9 Enhancing Network Performance Third-Party Networking Tools Bandwidth Tools IP Tools Miscellaneous Networking Tools Network Information Other Sites to Consider Using Search Tools Windows Built-in Networking Tools Disk Cleanup Why Disk Defragmentation Matters Resource Monitor System Information 358 Index 361