Network Commands
Network Commands
Display and modify the IP-to-Physical address translation tables used by address
resolution protocol.
Syntax
View the contents of the local ARP cache table
ARP -a [ip_addr] [-N if_addr]
Delete an entry
ARP -d ip_addr [if_addr]
Description
-a Display current ARP entries.
May include more than one network interface. If ip_addr is
specified, the IP and Physical addresses for only the
specified computer are displayed.
-g Same as -a.
-N if_addr Display the ARP entries for the network interface specified
by if_addr
-d ip_addr Delete the host specified by ip_addr.
-d * will delete all hosts.
If two hosts on the same sub-net cannot ping each other successfully, try running ARP -a
to list the addresses on each computer to see if they have the correct MAC addresses.
A host's MAC address can be checked using IPCONFIG. If another host with a duplicate
IP address exists on the network, the ARP cache may have had the MAC address for the
other computer placed in it. ARP -d is used to delete an entry that may be incorrect.
Examples
arp -a -N 10.1.4.99
Add a static ARP cache entry on IP addr 10.1.4.77 to the physical address 00-AA-21-4A-
2F-9A:
NSLOOKUP (TCP/IP)
Lookup IP addresses on a NameServer.
Syntax
Lookup the ip address of MyHost:
NSLOOKUP
Example:
NBTSTAT.exe
Display protocol statistics and current TCP/IP connections using NBT (NetBIOS over
TCP/IP).
Syntax
By Name
NBTSTAT -a Remote_host_Name [options] [interval]
By IP address
NBTSTAT -A IP_address [options] [interval]
Key
-a (adapter status) List the remote machine's name table given its
name
-A (Adapter status) List the remote machine's name table given its
IP address
-c (cache) List NBT's cache of remote [machine] names
and their IP addresses
-n (names) List local NetBIOS names.
-r (resolved) List names resolved by broadcast and via WINS
-R (Reload) Purge and reloads the remote cache name table
-S (Sessions) List sessions table with the destination IP
addresses
-s (sessions) List sessions table converting destination IP
addresses to computer NETBIOS names.
-RR (ReleaseRefresh) Send Name Release packets to WINS and then,
starts Refresh
NETSH
Configure Interfaces, Routing protocols, Filters, Routes, Routing & remote access.
Syntax
NETSH [-r router name] [-a AliasFile] [-c Context] [Command | -f
ScriptFile]
Key
context may be any of:
DHCP, ip, ipx, netbeui, ras, routing,
autodhcp, dnsproxy, igmp, mib, nat, ospf, relay, rip, wins.
/exec script_file_name
Load the script file and execute commands from it.
/offline
Set the current mode to offline.
changes made in this mode are saved, but require a
"commit"
or "online" command to be set in the router.
/online
Set the current mode to online.
Changes in this mode are immediately reflected in the
router.
/alias [alias_name]
Display the string value of the alias.
/unalias alias_name
Delete an alias.
Examples
Show IP configuration
NETSH interface ip show config
Connect to port
NETSH diag connect iphost www.ss64.com 80
Export IP settings to file
NETSH -c interface dump > netsh.txt
NETSTAT.exe
Display current TCP/IP network connections and protocol statistics.
Syntax
NETSTAT [options] [-p protocol] [interval]
Key
-a Display All connections and listening ports.
-e Display Ethernet statistics. (may be combined with -s)
-n Display addresses and port numbers in Numerical form.
-r Display the Routing table.
-o Display the Owning process ID associated with each connection.
-p protocol
Show only connections for the protocol specified;
may be any of: TCP, UDP, TCPv6 or UDPv6.
If used with the -s option then the following protocols
may also be specified: IP, IPv6, ICMP,or ICMPv6.
* Where available this will display the sequence of components involved in creating the
connection or listening port. (Typically well-known executables which host multiple
independent components.) This option will display the executable name in [ ] at the
bottom, with the component it called on top, repeated until TCP/IP is reached. The -b
option can be time-consuming and will fail unless you have sufficient permissions.
PATHPING
Trace route and provide network latency and packet loss for each router and link in the
path. Combines the functionality of PING and TRACERT.
Syntax
PATHPING [-n] [-h max_hops] [-g host_list] [-p period]
[-q num_queries] [-w timeout] [-i IPAddress] [-4 ] [-6 ]
[TargetName]
Key
-g host_list - Loose source route along host-list.
-h max_hops - Maximum number of hops to search for target.
-i address - Use the specified source address.
-n - Do not resolve addresses to hostnames.
-p period - Wait period milliseconds between pings.
-q num_queries - Number of queries per hop.
-w timeout - Wait timeout milliseconds for each reply.
-P - Test for RSVP PATH connectivity.
-R - Test if each hop is RSVP aware.
-T - Test connectivity to each hop with Layer-2 priority tags.
-4 - Force using IPv4.
-6 - Force using IPv6.
Pathping is invaluable for determining which routers or subnets may be having network
problems - it displays the degree of packet loss at any given router or link.
Pathping sends multiple Echo Request messages to each router between a source and
destination over a period of time and computes aggregate results based on the packets
returned from each router.
Pathping performs the equivalent of the tracert command by identifying which routers are
on the path.
To avoid network congestion and to minimize the effect of burst losses, pings should be
sent at a sufficiently slow pace (not too frequently.)
When -p is specified, pings are sent individually to each intermediate hop. When -w is
specified, multiple pings can be sent in parallel. It's therefore possible to choose a
Timeout parameter that is less than the wait Period * Number of hops.
Firewalls
Like tracert PathPing uses Internet Control Message Protocol (ICMP) over TCP/IP. Many
firewalls will block ICMP traffic by default. If an attacker is able to forge ICMP redirect
packets, he or she can alter the routing tables on the host and possibly subvert the security
of the host by causing traffic to flow via a path you didn't intend.
PING
Test a network connection - if successful, ping returns the ip address.
Syntax
PING [options] destination_host
Options
-w timeout Timeout in milliseconds to wait for each reply.
-i TTL Time To Live.
-v TOS Type Of Service.
-a Resolve addresses to hostnames.
-n count Number of echo requests to send.
-t Ping the destination host until interrupted.
-l size Send buffer size.
-f Set Don't Fragment flag in packet.
-r count Record route for count hops.
-s count Timestamp for count hops.
-j host_list Loose source route along host_list.
-k host_list Strict source route along host_list.
destination_host The name of the remote host
A response of "Request timed out" means there was no response to the ping attempt in
the default time period of one second.
If the latency of the response is more than one second. Use the -w option on the ping
command to increase the time-out. For example, to allow responses within five seconds,
use ping -w 5000.
Note that "Reply" in the output of PING does not always indicate a positive response.
You may receive a message from a router such as: Reply from 192.168.1.254:
Destination Net Unreachable.
1) Ping the loopback address to verify that TCP/IP is installed and configured correctly
on the local computer.
PING 127.0.0.1
2) Ping the IP address of the local computer to verify that it was added to the network
correctly.
PING IP_address_of_local_host
3) Ping the IP address of the default gateway to verify that the default gateway is
functioning and that you can communicate with a local host on the local network.
PING IP_address_of_default_gateway
4) Ping the IP address of a remote host to verify that you can communicate through a
router.
PING IP_address_of_remote_host
Examples
PING -n 1 -w 7500 Server_06
TRACERT
Trace Route - Find the IP address of any remote host. TRACERT is useful for
troubleshooting large networks where several paths can be taken to arrive at the same
point, or where many intermediate systems (routers or bridges) are involved.
Syntax
TRACERT [options] target_name
Key
target_name The HTTP or UNC name of the host
Options:
-d Do not resolve addresses to hostnames.
(avoids performing a DNS lookup)
The functionality of TRACERT is the same under all versions of windows but the output
is cosmetically improved under XP.
Tracert uses the IP TTL field and ICMP error messages to determine the route from one
host to another through a network.
Care must be taken with tracert as it shows the optimal route, not necessarily the actual
route. To be accurate, it is possible to ping from a UNIX machine back to the PC using
the -R option to record the route taken - but only if the particular network devices support
it.
This diagnostic tool determines the path taken to a destination by sending ICMP Echo
Request messages with varying Time to Live (TTL) values to the destination.
When the TTL on a packet reaches 0, the router is expected to return an ICMP Time
Exceeded message to the source computer.
Tracert determines the path by sending the first Echo Request message with a TTL of 1
and incrementing the TTL by 1 on each subsequent transmission until either the target
host responds or the maximum number of hops is reached.
This process relys on intermediate routers to return ICMP Time Exceeded messages.
However, some routers do not return Time Exceeded messages for packets with expired
TTL values and are invisible to the tracert command. In this case, a row of asterisks (*) is
displayed for that hop.
Firewalls
Many firewalls will block ICMP traffic by default. If an attacker is able to forge ICMP
redirect packets, he or she can alter the routing tables on the host and possibly subvert the
security of the host by causing traffic to flow via a path you didn't intend.
Examples
TRACERT www.doubleclick.net
TRACERT 123.45.67.89
TRACERT local_server
Windows XP syntax
[SERVER | WORKSTATION]
NET Continues the use of service.
CONTINUE
[service]
NET FILE Display opened shared files on the server.
[id [/CLOSE]]
NET GROUP Add, delete, view, and otherwise manage network workgroups.
[service]
NET PRINT Manage network print jobs.
\\computername\sharename
[\\computername] job# [/HOLD | /RELEASE | /DELETE]
NET SEND Sends messages to other users, computers, or messaging names on
the network. The Messenger service must be running to receive
messages.
You can send a message only to an name that is active on the
network. If the message is sent to a username, that user must be
logged on and running the Messenger service to receive the
message.
[\\computername] [/DELETE]
NET SHARE Create and manage a local network share.
sharename
sharename=drive:path [/USERS:number | /UNLIMITED]
[/REMARK:"text"]
[/CACHE:Manual | Documents| Programs | None ]
sharename [/USERS:number | /UNLIMITED]
[/REMARK:"text"]
[/CACHE:Manual | Documents | Programs | None]
{sharename | devicename | drive:path} /DELETE
NET START Start the specified network service.
[service]
NET Display network statistics of the workstation or server.
STATISTICS
[WORKSTATION | SERVER]
NET STOP Stop the specified network service.
service
NET TIME Display the time and date of another network computer.
[\\computername | /DOMAIN[:domainname] |
/RTSDOMAIN[:domainname]] [/SET]
[\\computername] /QUERYSNTP
[\\computername] /SETSNTP[:ntp server list]
NET USE Connects or disconnects your computer from a shared resource or
displays information about your connections.
[devicename | *] [\\computername\sharename[\volume]
[password | *]]
[/USER:[domainname\]username]
[/USER:[dotted domain name\]username]
[/USER:[username@dotted domain name]
[/SMARTCARD]
[/SAVECRED]
[[/DELETE] | [/PERSISTENT:{YES | NO}]]
The first syntax line above is for changing the password for your
password-list file. The second syntax line above is for changing
your password on a Windows NT or LAN Manager server or
domain.
NET PRINT Displays information about print queues and controls print jobs.
sharename=drive:path [/USERS:number |
/UNLIMITED]
[/REMARK:"text"]
[/CACHE:Manual | Automatic |
No ]
sharename [/USERS:number |
/UNLIMITED]
[/REMARK:"text"]
[/CACHE:Manual | Automatic |
No ]
{sharename | devicename | /DELETE
drive:path}
NET START Starts services. NOTE: Services cannot be started from a command
prompt within Windows.
NET VER
NET VIEW Displays a list of computers in a specified workgroup or the shared
resources available on a specified computer.
Examples
Send a text message to the computer with a host name of mrhope the message There is
hope!. Note: This command only works for Windows versions that support this
command.
Note: Many computers today have also disabled the messenger service, if this service is
disabled you will be unable to send/receive net send messages. Additional information
about how this service is disabled can be found on document CH0000519. If you need
this service enabled, follow the instructions on this page and choose to enable the service
instead of disabling it.
Display additional information about the network such as the computers name,
workgroup, logon domain, DNS, and other useful information.
View the available computers and their shared resources you may use either of the below
commands. The first example displays available computers. The last command would
display the shared resources on the hope computer.
net localgroup
Display all groups currently setup on the computer you're running the command on.
net share
Display all network shares on your computer.
IPCONFIG