Monitoring and Troubleshooting Internet Connectivity

Common Methods for Troubleshooting Internet Connectivity

With the technology available today, Internet connectivity can be established in various ways:

Remote access server
Network Address Translation (NAT)
Internet Connections Sharing (ICS)
A direct connection by using a device such as a modem or network card

Because of the various methods in which Internet connectivity can be established, and the manner in which certain organizations are dependent on the Internet for daily business transaction, it is important to have some knowledge on the methods which you can utilize to troubleshoot Internet connectivity problems. Where the Internet forms the basis of a business's operations, it is essential that high availability and reliability of Internet connectivity exists. There are various Internet connectivity issues which could arise, different methods and approaches which can be used to resolve these issues, and different tools which you can use to monitor and troubleshoot Internet connectivity issues.

The two standard approaches which you can use to troubleshoot Internet connectivity are:

You can start to troubleshoot Internet connectivity issues from the server connection, and progress towards the client. This approach might be better than starting to troubleshoot at the client machine, but only if you are able to identify the issue quite quickly. If not, you could find yourself navigating through various network paths to the client machine.
You can start to troubleshoot Internet connectivity issues at the client end and then move towards the server. While this troubleshooting approach seems the better approach, starting at the client machine could have its hiccups, and is slower than starting at the server end.

When faced with having to troubleshoot Internet connectivity issues, it is best to:

Start at the server, and move towards the client.
Navigate back through the network, and to the Internet.

A few common strategies for troubleshooting Internet connectivity issues are listed below. These solutions are a good place to start troubleshooting Internet connectivity issues.

Check that the hardware such as network adapter, modem, or whatever other device you are using to establish Internet connectivity is both connected, and functioning.
You can use the Ipconfig command to verify the TCP/IP configuration settings of the local host.
When dial-up connections are utilized, check the number and credentials which are used.
When a gateway is used in the process of establishing Internet connections, ensure that the actual gateway is functioning.
When a proxy server is used in the process of establishing Internet connections, ensure that outgoing traffic is allowed.
When name resolution issues exist, verify that the DNS servers are available, and that DNS is configured correctly.

One of the initial steps in troubleshooting Internet connectivity issues is to determine the type of connectivity issue. An Internet connectivity issue can be either one of the following:

An issue associated with the hardware being utilized
An issue associated with network connectivity
An issue associated with name resolution

Tools and Utilities for Troubleshooting Internet Connectivity

Network Diagnostics

You can use the Network Diagnostics tool to perform the following tasks:

Collect information on hardware and software.
Collect information on network connections on a local computer
Verify network connectivity
Verify whether network services are running
Use the information generated by Network Diagnostics to identify connectivity problems.
By using Network Diagnostics, you can isolate network issues relating to
- Network connectivity problems
- Configuration settings for network adapters, modems, and network clients
- Internet service configuration settings for proxies, newsgroups and e-mail.
- DNS, DHCP, and WINS configuration settings
- Default gateways and IP addresses

Information collected through Network Diagnostics is reported in categories, with each category holding trees of data. To view information contained in a tree, simply expand the particular tree.

The default categories which Network Diagnostics reports information on are:

Internet Service category: Contains information on:
- Internet Explorer Web Proxy configuration
- Microsoft Outlook Express Mail
- Microsoft Outlook Express News
Computer Information category: Contains information on:
- Registry configuration settings for the operating system, and computer system
Modems And Network Adapters category: Contains information on:
- Registry configuration settings for the network adapters, modems, and network clients.

To open and use Network Diagnostics,

Click Start, and then click Help And Support
Click Tools from the Support Tasks area.
Select Help and Support Center Tools.
Select Network Diagnostics.
To start a Network Diagnostics scan on the local computer environment, click Scan Your System.
To add and remove categories of data collected; click Set Scanning Options in the Network Diagnostics window.

The Netdiag Command

The Netdiag command-line utility is included on the Windows Server 2003 installation CD, and can be installed from the CD. You can use the utility to troubleshoot connectivity problems. If you have installed the Windows Server 2003 Support Tools, the Netdiag command-line utility is installed. Netdiag executes a number of tests on the local computer to determine the network client's status. You can use Netdiag's output to troubleshoot network problems.

A few default tests which can be run from Netdiag are listed below:

Netcard Queries Test: This test determines the network adapter configuration settings such as IP address and default gateway.
Domain Membership Test: The test verifies information on the domain, such as domain name and domain GUID, computer role, and whether the Netlogon service has started.
DNS Test: The test verifies whether the DNS cache service is presently running, and checks whether the computer is registered on the DNS servers. For a domain controller, the test checks if the entries in Netlogon.dns are registered on the DNS server.
IP Security Test: Checks whether IP security is enabled, and then lists all active Internet Protocol Security (IPSec) policies.
Binding Test: The test produces information specific to bindings:
- Owner of the binding
- Interface name
- Lists whether the binding is enabled.
- Lower module name and upper module name
NetBT Name Test: This test checks whether the workstation service name and computer name are equal, and checks whether the messenger service name and server service name exist on each interface.
WINS Service Test: Transmits NetBT Name queries to the WINS servers.
WAN Configuration Test: Lists the current remote access connection's status and settings.

The Netsh Command

The Netsh command-line utility can be used to troubleshoot Internet connectivity issues, and to change the network configuration of both the local computer and a remote computer. In Windows Server 2003, diagnostic commands are included for Netsh, and could be of assistance when you have to troubleshoot Internet connectivity.

The Netsh diag command contexts are listed below:

Connect ieproxy: Used to establish or drop, and verify a connection with the proxy specified in Internet Explorer's Properties window.
Connect iphost: Used to establish or drop, and verify a connection with a host via a specific port.
Connect mail: Used to establish or drop, and verify a connection with the host defined as the mail server in Outlook Express.
PING: Used to verify whether connectivity exists with a specific remote host.
PING adapter: Used to verify whether connectivity exists via a specific adapter. If you want to test connectivity via all network adapters, use no parameters.
PING DNS: Used to verify whether connectivity exists with the DNS servers defined in the specific adapter's TCP/IP Properties window.
PING gateway: Used to verify whether connectivity exists with the default gateways defined in the specific adapter's TCP/IP Properties window.
PING ieproxy: Used to verify connectivity with the proxy specified in Internet Explorer's Properties window.
PING iphost: Used to verify connectivity with either a local host or a remote host.
PING mail: Used to verify connectivity with the host defined as the mail server in Outlook Express.
Show gateway: For listing all Internet gateways for a particular adapter.
Show ieproxy: For listing all Internet proxy servers for the particular adapters.
Show mail: For listing the Outlook Express mail server set up on the local computer.
Show modem: For listing information specific to the modem.

The Ipconfig utility

As mentioned earlier, a good starting point when troubleshooting Internet connectivity issues is to verify the TCP/IP configuration settings on the server and client. The switches of the Ipconfig utility which can be used from the command prompt to verify IP configuration settings are listed below:

/all, lists all configuration information.
/flushdns, to purge the DNS cache.
/registerdns, to refresh each DHCP lease, and to register the DNS names.
/release, to release the IP address which is assigned to the particular adapter.
/renew, to renew the IP address which is assigned to the particular adapter.

Troubleshooting Hardware Issues

To establish Internet connectivity, some form of hardware device is utilized. You can use Device Manager to troubleshoot hardware issues relating to network adapters, modems, and other devices. Device Manager is the graphical utility that displays all the devices installed on the system. Device Manager can be used for the following:

To enable or disable devices
Change hardware settings and advanced settings for a particular device
You can use Device Manager to view information specific to devices and device drivers, and when troubleshooting devices.

To open Device Manager,

Right-click My Computer and select Properties from the shortcut menu.
Click the Hardware tab
Click the Device Manager button.
The initial view when you open Device Manager lists all the devices currently installed on the computer.

To use Device Manager to troubleshoot hardware issues,

Open Device Manager
Open the Properties window of the device which you want to troubleshoot.
Check the status of the device.
For basic troubleshooting tips, click the Troubleshoot button.
For modem issues, check the information on the Diagnostics tab.

Troubleshooting and Monitoring Network Address Translation (NAT) Activity

NAT is typically used to enable a small organization's users to access the Internet. NAT works well to enable Internet access for those smaller networks which are not routed. When client machines use NAT to access the Internet, the internal IP address of the client machines are mapped to an external IP address. In addition, the private IP address has to map the proper port for the required protocol to the external port for the identical protocol.

For NAT to function:

Routing and Remote Access Services (RRAS) must be running on a multihomed computer.
Either a network interface configured with the public IP address, or a network interface configured to use demand dial routing has to exist so that NAT can get the public address from your Internet Service Provider (ISP).

Clients that obtain their IP configurations automatically from the NAT server receive the following:

IP address from the specified pool
Subnet mask
Default gateway
DNS server

When NAT is used to establish Internet connectivity, one of the first tasks which you should perform when Internet connectivity issues arise, is to check the NAT configuration:

Your private LAN interfaces and your public interface to the Internet have to be added to the NAT routing protocol.
Each interface has to be set up to utilize the proper settings.
On the NAT/Basic Firewall tab of the private interface's properties, the Private Interface Connected To Private Network option under the Interface Type area of the tab has to be selected.
When troubleshooting NAT activity, verify that the correct Static Packet Filters options have been selected. These settings are also configured using the NAT/Basic Firewall tab of the private interface's properties. To open the Inbound Filters dialog box, click the Inbound Filters button. You can configure filters based on the following criteria:
- Filter action: The action options that can be configured are:
  - Receive all packets except those that meet the criteria defined in the Filters list.
  - Drop all except those that meet the criteria defined in the Filters list.
- Filters defined in the Filters List: Filters defined in the Filters List include the settings listed below:
  - Source network IP address and subnet mask; indicates the source of the packet
  - Destination network IP address and subnet mask; indicates the packet's destination.
  - Protocol to filter; indicates the protocol (TCP, UDP), source port, and destination port utilized by the filter.
On the NAT/Basic Firewall tab of the public interface's properties, the Enable NAT On This Interface checkbox has to be selected so that the NAT protocol can map internal address requests to the public interface. To access the NAT/Basic Firewall tab of the public interface,
1. Open the Routing and Remote Access Console
2. Expand the NAT/Basic Firewall node.
3. Right-click external interface adapter LAN connection and select Properties from the shortcut menu.
If you want to block public Internet access to the private network, select the Enable a basic firewall on this interface checkbox.
You can check the mappings of NAT clients in the Network Address Translation Mappings Table. In the NAT/Basic Firewall pane of RRAS console, simply right-click the interface.
You can view IP, TCP and UDP information by right-clicking the interface in the General pane of the RRAS console.
You can use the Netstat utility to view client mappings, and to determine which process or application is the owner of a particular connection.

Troubleshooting Name Resolution

The types of name resolution typically utilized to resolve names to IP addresses are:

Host name resolution translates a host name to an IP address. When WinSock programs are configured to utilize host name resolution to establish a connection to remote hosts, either of the following can be utilized:
- IP address
- Host name
The forms of host names are:
- Fully qualified domain names (FQDNs)
- Aliases
To troubleshoot host name resolution, you can use the following command-line utilities:
- Nslookup: This command-line utility can be utilized to perform the following tasks:
  - Execute domain name queries against a DNS server.
  - Verify or validate entries contained in the zone records within the DNS database.
  - View zone files.
- Netdiag: This command-line utility can be utilized to perform the following tasks:
  - Check DNS and WINS name resolution.
  - Check network services (IPSec).
- Dnscmd: This command-line utility can be utilized to perform the following tasks:
  - Configure DNS servers.
  - View and verify records contained in the DNS database.
  - Add and delete records in the DNS database.
  - Administer zones.
- Dcdiag: This command-line utility can be utilized together with the Netdiag and Dnscmd utilities to verify that your domain controllers are operating as expected.
NetBIOS name resolution resolves the NetBIOS name to the NetBIOS resource. A NetBIOS name consists of 16 characters. A unique 15 character name is based on the host computer's name, and the last character indicates the host computer's role. The different NetBIOS node types which can be specified for the client host affects the manner in which NetBIOS names are resolved to IP addresses. The different NetBIOS node types are listed below:
- B-node type - broadcast: Broadcasts NetBIOS name queries for resolving NetBIOS names.
- P-node type - peer-peer: Resolves NetBIOS names via a direct request to a NetBIOS name server.
- M-node type - mixed: Uses a combination of B-node and P-node. B-node broadcasts are attempted first. When unsuccessful, NetBIOS names are resolved via a direct request to a NetBIOS name server.
- H-node type - hybrid: Uses a combination of P-node and B-node. In this instance, a direct request is first sent directly to a NetBIOS name server, and B -node broadcasts are utilized after this.

You can use the ipconfig utility, discussed previously in this Article, to view information on the IP address configurations of adapters such as subnet mask, and default gateway.

Troubleshooting IP Addressing Problems

The tools which should be utilized to troubleshoot IP addressing problems and to pinpoint addressing issues associated with client configuration settings and connections to hosts on the Internet are:

Ping
Ipconfig
Tracert

A few common problems which result from manually configuring IP addresses are listed below:

Duplicated IP addresses
Incorrect or even missing DNS and WINS name resolution configuration settings.
Incorrect or invalid subnet masks and default gateways.

A few strategies which can be used to troubleshoot IP addressing issues are listed below:

Use the Ipconfig utility by entering ipconfig /all at a command prompt.
To verify that the TCP/IP protocol stack has been configured correctly, ping the loopback address.
To verify that the default gateway can be contacted, ping the address of the default gateway.
To ensure that data can be passed over the default gateway, ping the IP address of the remote host.
To verify that no address conflicts exist, and to verify that the host is on the network; ping the external IP address of the local computer.

DHCP simplifies the administration of IP addressing assignment for large networks by eliminating most of the issues which arise from manually configuring IP addresses. You can also eliminate address conflicts which are usually caused by manual IP address configurations. With DHCP, a machine sends a request for a lease to the DHCP server using a DHCPREQUEST message. Machines that obtain IP addresses from the DHCP server basically obtain a lease. The lease duration for a particular IP address is determined by the DHCP scope configured on the DHCP server. The default is eight days.

The factors that you should consider when deciding on the lease duration are:

The lease duration should be short when the number of hosts is fairly close to the total number of IP addresses included in the scope of the DHCP server.
The lease duration can be long when the number of IP addresses far exceeds the number of hosts.
You can configure long lease durations when you have a few mobile users and the client machines hardly ever move between networks.
You should set up shorter lease durations when you have quite a number of mobile users.

When planning your DHCP implementation, include the points listed below: