Various
Network Tools
TCP/IP Commands as Tools
The Arp Command
The Traceroute Command
The Netstat Command
The Finger Command
The Ping Command
The Telnet Command
TCP/IP Commands as Tools
This is list of the most
commonly used TCP/IP command line tools that are used to
explore and find out information from a network. These tools will
be referred to later on
in this document, so its usage and function will not be explained
later. Please note that
not all of these switches remain the same across different TCP/IP
stacks. The Microsoft
TCP/IP stack is almost always different than most switches used on Unix
systems.
The Arp Command
The arp command will display internet to ethernet (IP to MAC)
address translations
which is normally handled by the arp protocol. When the hostname
is the only parameter,
this command will display the currect ARP entry for that hostname.
Usage: arp hostname
Switches: -a Displays current ARP entries by
interrogating the current
protocol
data. If inet_addr is specified, the IP
and Physical
addresses for only the
specified computer are displayed. If
more than
one network interface uses ARP, entries for each
ARP table are displayed.
-g Same as -a.
inet_addr Specifies an
internet address.
-N
if_addr Displays the ARP entries for
the network interface specified
by
if_addr.
-d Deletes the host specified by
inet_addr.
-s Adds the host and
associates the Internet address inet_addr
with the
Physical address eth_addr. The Physical
address is
given as
6 hexadecimal bytes separated by hyphens. The
entry is permanent.
eth_addr Specifies a physical
address.
if_addr If present, this specifies the Internet
address of the
interface whose address translation table should be modified.
If not
present, the first applicable interface will be used.
The Traceroute Command
The traceroute command is
used to trace the route that a packet takes to reach its
destination. This command works by using the time to live (TTL)
filed in the IP packet.
Usage: tracert
IP or Hostname
Switches: -d Do not resolve
addresses to hostnames.
-h
maximum_hops Maximum number of hops to
search for target.
-j
host-list Loose source
route along host-list.
-w
timeout Wait timeout
milliseconds for each reply.
The Netstat Command
This command is used to query the network subsystem regarding
certain types of
information. Different types of information will be received
depending on the switches
used in conjunction with this command.
Usage: netstat [switch]
Switches: -A
Shows the addresses of any associated protocol control blocks.
-a Will show the status of
all sockets. Sockets associated with
network server processes are normally not shown.
-i Shows the state of the
network interfaces.
-m Prints the network memory
usage.
-n Causes netstat to show
actual addresses as opposed to
hostnames or network names.
-r Prints the routing table.
-s Tells netstat to show the
per protocol statistics.
-t Replaces the queue length information
with timer information.
The Finger Command
By default, finger will list the login name, full name, terminal
name, and write status
(shown as a "*" before the terminal name if write
permission is denied), idle time, login
time, office location, and phone number (if known) for each
current user connected to the
network.
Usage: finger
username@domain
Switches: -b
Brief output format
-f Supresses the printing of the header line.
-i Provides a quick list of users with idle
time.
-l Forces long output format.
-p Supresses printing of the .plan file (if
present)
-q Provides a quick list of users.
-s Forces short output form.
-w Forces narrow output form.
The Ping Command
The ping (Packet Internet Groper) is used to send ICMP (Internet
Control Message
Protocol) packets from one host to another. Ping transmits packets
using the ICMP
ECHO_REQUEST command and expects an ICMP ECHO_REPLY.
Usage: ping IP address or Hostname
Switches: -t Ping the specifed host until
interrupted.
-a Resolve addresses to hostnames.
-n
count Number of echo requests to
send.
-l
size Send buffer size.
-f Set Don't Fragment flag in packet.
-i TTL Time To Live.
-v TOS Type Of Service.
-r
count Record route for count hops.
-s
count Timestamp for count hops.
-j
host-list Loose source route along
host-list.
-k
host-list Strict source route along
host-list.
-w
timeout Timeout in milliseconds to
wait for each reply.
The Nbtstat Command
Can be used to query the network concerning NetBIOS information.
It can also be useful
for purging the NetBIOS cache and reloading the LMHOSTS file. This
one command can
be extremely useful when performing security audits. When one
knows how to interpret
the information, it can reveal more than one might think.
Usage: nbtstat [-a RemoteName] [-A IP_address] [-c]
[-n] [-R] [-r] [-S] [-s] [interval]
Switches: -a Lists the remote computer's name table
given its host name.
-A Lists the remote
computer's name table given its IP address.
-c Lists the remote name
cache including the IP addresses.
Lists the
remote name cache including the IP addresses Lists local
NetBIOS
names. Lists names resolved by broadcast and via WINS
Purges and reloads the
remote cache name table Lists sessions
table with
the
destination IP addresses
Lists
sessions table converting destination IP addresses to host
names via
the hosts
file.
-n Lists local NetBIOS names.
-r Lists names resolved by
broadcast and via WINS.
-R Purges and reloads the
remote cache name table.
-S Lists sessions table with
the destination IP addresses.
-s Lists sessions table
converting destination IP addresses to host
names via
the hosts
file.
interval This will
redisplay the selected statistics, pausing for the number
of seconds
you choose as "interval" between each listing. Press
CTRL+C to
stop.
The IpConfig Command
The ipconfig command will give you information about your current
TCP/IP
configuration. Information such as IP address, default gateway,
subnet mask, etc can all
be retrieved using this command.
Usage: ipconfig [/? | /all | /release [adapter] |
/renew [adapter]]
Switches: /?
Display this help message.
/all Display full configuration information.
/release
Release the IP address for the specified adapter.
/renew Renew the IP address for the specified
adapter.
The Telnet Command
Technically, telnet is a
protocol. This means it is a language that computer use to
communicate with one another in a particular way. From your point of view, Telnet is a
program that lets you login to a site on the Internet through your
connection to Teleport.
It is a terminal emulation program, meaning that when you connect
to the remote site,
your computer functions as a terminal for that computer.
Once the connection is made, you can use your computer to access
information, run
programs, edit files, and otherwise use whatever resources are
available on the other
computer. What is available depends on the computer you connect
to. Most of the times,
if you type '?' or 'help', you would normally receive some type of
information, menu
options, etc.
Note:
telnet connections give you command-line access only. In other words, instead
of
being able
to use buttons and
menus as you do with a graphical interface, you have to type
commands.
However, telnet
allows you to use certain utilities and resources you cannot access
with your
other Internet
applications.
Usage: telnet [-a][-e escape char][-f log
file][-l user][-t term][host [port]]
Switches: -a
Attempt automatic logon. Same as -l option except uses
the
currently logged on user's name.
-e Escape character to
enter telnet client prompt.
-f File name for client
side logging
-l Specifies the user
name to log in with on the remote system.
Requires that the remote system support the TELNET
ENVIRON
option.
-t Specifies terminal type.
Supported term types are vt100, vt52, ansi and vtnt only.
host Specifies the hostname
or IP address of the remote computer
to
connect to.
port Specifies a port number
or service name.
