Command Line Network Tools

Command Line Tools

The Command Prompt program allows you to work in an environment that looks more like a traditional operating system as opposed to the icon based Windows environment. In Command Prompt, you will use your keyboard. You won't use your mouse at all. Command Prompt works at a lower level than Windows. This means that you will have more control over the machine. The disadvantage is that it is less user-friendly.

One way to open a new command promopt is to press the Windows key and R and then type cmd. (Note, the windows key is between CTRL and ALT on left of the keyboard.)

You can also simply type the command cmd into the search bar in the bottom left of the desktop (see below).

Working with Files and Directories

You can also use Command Prompt commands to organize files into a directory hierarchy. These commands are equivalent to corresponding commands that you access via the Windows point-and-click interface. It is useful to be familiar with both interfaces for managing files.

dir: To view the contents of a directory, type dir. This command will list all the files and directories within the current directory. It is analogous to clicking on a Windows folder to see what's inside.
```
C:\> dir
```
There are 4789 items in this directory. Some of them are executable files, like wizard.exe. Others are directories, like zn-CN. Of course your view will differ depending on which directory you are in.
To change directory to the root C:\ directory, use the cd\ command.
```
C:\> cd\
```
Now, the command prompt will be:
```
C:\> 
```
To change directory to another directory, use the cd command with the name of the directory. E.g. Type cd windows

Now, the command prompt will be:
```
C:\Windows> 
```
To see what is in this directory type: dir

To return to the previous directory, use the cd command, but this time followed by two periods.
```
C:\Windows> cd..
C:\> 
```

mkdir: To create a new directory, use the command mkdir. The following command creates a directory named hello, which you can use to to store all of your files associated with the Hello World assignment.

C:\> mkdir hello

To see that it actually worked, use the dir command.

C:\> dir 
 Volume in drive C has no label.
 Volume Serial Number is C8C7-BDCD

 Directory of C:\

02/10/2005  08:59 PM    DIR            .
02/10/2005  08:59 PM    DIR            ..
02/11/2005  02:53 PM    DIR            hello
02/03/2005  11:53 PM               126 file1.exe
01/17/2005  01:16 AM               256 file2.txt
               2 File(s)            382 bytes
               3 Dir(s)

rmdir: To delete a directory, use the command rmdir. The following command removes a directory named hello.
```
C:\> rmdir hello
```
To see that it actually worked, use the dir command. It should be gone now.
```
C:\> dir 
 Volume in drive C has no label.
 Volume Serial Number is C8C7-BDCD

 Directory of C:\

02/10/2005  08:59 PM    DIR            .
02/10/2005  08:59 PM    DIR            ..
02/03/2005  11:53 PM               126 file1.exe
01/17/2005  01:16 AM               256 file2.txt
               2 File(s)            382 bytes
               3 Dir(s)
```
Network Commands

IPConfig
IPConfig allows a Network Manager to view system TCP/IP settings and reconfigure if necessary. This is a standard tool which comes with all editions of Windows. It can be used to troubleshoot network problems.
1. At the command prompt, type ipconfig.
2. Note your computer's IP address, default gateway and subnet mask.
3. Use the -? flag on the IPConfig command to find out what other options you have with these commands. You should notice a number of options, including /all, /renew, and others.
4. Now try ipconfig /all. What do you see now that you did not see earlier?
Tracert
The Tracert diagnostic utility determines the route taken to a destination by sending Internet Control Message Protocol (ICMP) echo packets with varying IP Time-to-Live (TTL) values to the destination. Each router along the path is required to decrement the TTL on a packet by at least 1 before forwarding it. When the TTL on a packet reaches 0, the router should send an "ICMP Time Exceeded" message back to the source computer.Tracert determines the route by sending the first echo packet with a TTL of 1 and incrementing the TTL by 1 on each subsequent transmission until the target responds or the maximum TTL is reached. The route is determined by examining the "ICMP Time Exceeded" messages sent back by intermediate routers. Some routers silently drop packets with expired TTLs and are invisible to the Tracert utility. The tracert command prints out an ordered list of the near-side interface of the routers in the path that returned the "ICMP Time Exceeded" message. If the -d option is used, the Tracert utility does not perform a DNS lookup on each IP address.
1. Ideally now, I would ask you to type in tracert www.ulster.ac.uk however this is blocked within the university, so please visit tools.pingdom.com
2. type in www.ulster.ac.uk in the ping box and also select tracert over on the right in the selection choice.
3. This will graphically carry out the same tracert test for you. You should see a screen similar to the following:
4. Note what hops your computer takes to get to www.ulster.ac.uk .
5. Then try the same process with other sites
6. Did you notice that the first few hops are the same? Write down what hops are taken to reach each destination, and what hops are the same. Why you think some of the intermediate steps are the same for different destinations?
ns Lookup
nslookup is a network administration command-line tool available for many computer operating systems for querying the Domain Name System (DNS) to obtain domain name or IP address mapping or for any other specific DNS record
1. In the command prompt, type nslookup www.ulster.ac.uk
2. You should see the following:
3. Note that this command gives you the actual name of the server, as per the hosting company's naming conventions; its IP address; and any aliases under which that server operates.
ARP
Next, you will use the arp command to view and then delete the ARP cache, and you use the ping command to generate ARP cache entries.Address Resolution Protocol (ARP) is a telecommunications protocol used for resolution of network layer addresses into link layer addresses, a critical function in multiple-access networks. ARP was defined by RFC 826 and is also the name of the program for manipulating these addresses in most operating systems. Make sure you selected "Run as Administrator" when initially running the Command Prompt application.
1. In the command prompt, type arp -a. Remember, that previously the computer discovered the MAC address of your computer by using address resolution protocol (ARP). You have now resolved the globally unique MAC address of your device.
2. A list of IP address/MACaddress pairs is displayed. The Type field (third column) indicates whether the entry is static or dynamic. Windows 7 generates static entries automatically, but dynamic entries are generated by network communication. If you don’t have any entries, the message “No ARP Entries Found” is displayed.
Ping
Ping is a basic Internet program that lets you verify that a particular Internet address exists and can accept requests. The verb ping means the act of using the ping utility or command. Ping is used diagnostically to ensure that a host computer you are trying to reach is actually operating. If, for example, a user cannot ping a host, then the user will be unable to use the File Transfer Protocol (FTP) to send files to that host. Ping can also be used with a host that is operating to see how long it takes to get a response back. Using ping, you can learn the number form of the IP address from the symbolic domain name Loosely, ping means "to get the attention of" or "to check for the presence of" another party online. Ping operates by sending a packet to a designated address and waiting for a response.
1. In the command prompt or DOS prompt, use the -? flag on the ping command and find out what other options you have with these commands. You should notice several additional options, such as -w, -t, -n, -i.
2. Ask a fellow student to give you their IP address. It should be similar to 193.61.191.72
3. Now try a simple ping to their machine using e.g. ping 193.61.191.72. Please remember to use their IP address (not this example).
4. Try the option ping -n 2 IP ADDRESS, then try ping -n 7 IP ADDRESS. What differences do you notice?
5. Note that simple Denial of Service (DoS) attacks could be done with the command ping -l 65000 -w0 -t .
Pathping - To try outside the lab
Please note that Pathping may not work in MF124/125 lab so this is for those of you who are doing the lab at home or anywhere outside the lab. The pathping command is a route tracing tool that combines features of the ping and tracert commands with additional information that neither of those tools provides. The pathping command sends packets to each router on the way to a final destination over a period of time, and then computes results based on the packets returned from each hop. Since the command shows the degree of packet loss at any given router or link, it is easy to determine which routers or links might be causing network problems. The default number of hops is 30, and the default wait time before a time-out is 3 seconds. The default period is 250 milliseconds, and the default number of queries to each router along the path is 100.
1. In the command prompt, type pathping www.ulster.ac.uk
2. You should see the following:
When pathping is run, you first see the results for the route as it is tested for problems. This is the same path that is shown by the tracert command. The pathping command then displays a busy message for a few minutes (this time varies by the hop count). During this time, pathping gathers information from all the routers previously listed and from the links between them. At the end of this period, it displays the test results. Note the two rightmost columns--This Node/Link Lost/Sent=Pct and Address--contain the most useful information. Look for links that might drop a percentage of the packets. The loss rates displayed for the links (marked as a | in the rightmost column) indicate losses of packets being forwarded along the path. This loss indicates link congestion. The loss rates displayed for routers (indicated by their IP addresses in the rightmost column) indicate that those routers' CPUs might be overloaded. These congested routers might also be a factor in end-to-end problems, especially if packets are forwarded by software routers.

IPConfig

Tracert

ns Lookup

ARP

Ping

Pathping - To try outside the lab