Chapter 17 Troubleshooting Tools

Which of the following arp utility switches perform the same function? (Choose all that apply.) A. -g B. -A C. -d D. -a

A, D. The arp utility's -a and -g switches perform the same function. They both show the current ARP cache.

What command can you type from a command prompt to see the hops a packet takes to get to a destination host?

traceroute or tracert

Which Windows TCP/IP utility could you use to find out whether a server is responding on TCP port 21? A. tcp B. port C. ping D. nbtstat E. telnet

E. The telnet utility can be used to test if a particular IP host is responding on a particular TCP port.

You want to log in to a server and transfer files. What application will you use?

FTP

You need to log in as a dumb terminal to a server or Unix host and run programs. What application will you use?

Telnet

You want the IP configuration on a Unix host. What command will you type at the command prompt?

ifconfig

You need your IP address, subnet mask, default gateway, and DNS information. What command will you type from a Windows command prompt?

ipconfig /all

You want to use netstat, but you want to see only the IP address, not the names of the hosts. Which modifier will you use?

netstat -n

You need to check your name-resolution information on your host. What command will you type from the command prompt?

nslookup

You need to add a route to your Windows server's routing table. What command will you use?

route

Which Windows command will show you the routing table of your host or server?

route print

Which command captures traffic on all interfaces? A. tcpdump -i any B. tcpdump -i eth0 C. tcpdump host 192.168.5.5 D. tcpdump host all

A. To capture traffic on all interfaces, use the any keyword with the -i (interface) switch.

Which Windows utility can you used to connect to a machine 50 miles away to troubleshoot? A. Remote Desktop B. netstat C. arp D. Wireshark

A. Microsoft has made what it calls Remote Desktop software available for free with Windows products since Windows NT. When this software is installed (installed by default in later versions) on both source and destination computers, a remote desktop connection can be made.

Which switch for the Windows nbtstat utility will display all NetBIOS name-resolution statistics? A. -r B. /r C. -R D. /R

A. The command nbtstat -r displays all the name resolutions performed by the local client as well as their associated IP addresses. The -R switch will reload the cache.

Which ipconfig switch will display the most complete listing of IP configuration information for a station? A. /all B. /renew C. /release D. /?

A. The ipconfig /all switch will display the most complete listing of TCP/IP configuration information, also displaying the MAC address, DHCP lease times, and the DNS addresses.

Which ping commands will verify that your local TCP/IP interface is working? (Choose all that apply.) A. ping 204.153.163.2 B. ping 127.0.0.1 C. ping localif D. ping localhost E. ping iphost

B, D. The address 127.0.0.1 is the special IP address designated for the local TCP/IP interface. The hostname localhost is hostname given to the local interface. Therefore, pinging either the IP address or the hostname for the local interface will tell you whether the local interface is working.

Wireshark is an example of a ____? A. Throughput tester B. Protocol analyzer C. Remote connection tool D. IDS

B. Commercial sniffers like Wireshark and Omnipeek can capture any packets because they set the NIC to operate in promiscuous mode, which means the NIC processes all packets that it sees.

Which of the following is NOT a chain type used by iptables? A. Forward B. Backward C. Input D. Output

B. There are three different chain types: Input - controls behavior of incoming connections Forward - used for incoming connections that aren't being delivered locally (like a router would receive) Output - used for outgoing connections

Which nbtstat utility switch will purge and relaod the remote NetBIOS name table cache? A. -r B. -R C. /r D. /R

B. To purge and reload the remote NetBIOS name cache, you must use nbtstat -R. Remember that the R must be uppercase and that it will not work correctly without the hyphen before it.

Which arp command can you use to display the currently cached ARP entries? A. arp B. arp -all C. arp -a D. ipconfig -arp E. arp -ipconfig

C. The arp -a command will display the current contents of the ARP cache on the local workstation.

You need to find a NIC's specific MAC address and IP address. Which command-line tool can you use to find this information without physically going to the computer? A. ping B. nbtstat C. arp D. netstat E. ftp

C. The arp utility will show you the resolved MAC to IP address of all hosts on your network segment. Remember, this will work for only local hosts, not remote hosts.

Which utility can you use to find the MAC and TCP/IP addresses of your Windows workstation? A. ping B. ipconfig C. ipconfig /all D. tracert E. telnet

C. The ipconfig /all utility will display the current configuration of TCP/IP on a given workstation - including the current IP address, DNS configuration, WINS configuration, and default gateway.

Which TCP/IP utility is most often used to test whether an IP host is up and functional? A. ftp B. telnet C. ping D. netstat

C. The program Packet Internet Groper (ping) is used to find out if a host has the IP stack initialized.

Which utility will display a list of all the routers that a packet passes through on the way to an IP destination? A. netstat B. nbtstat C. tracert D. ping E. arp

C. The tracert utility returns the names and addresses of all routers through which a packet passes on its way to a destination host.

You are the network administrator. A user calls you, complaining that the performance of the intranet web server is sluggish. When you try to ping the server, it takes several seconds for the server to respond. You suspect that the problem is related to a router that is seriously overloaded. Which workstation utility could you use to find out which router is causing this problem? A. netstat B. nbtstat C. tracert D. ping E. arp

C. The tracert utility will tell you which router is having the performance problem and how long it takes to move between each host. tracert can be used to locate problem areas in a network.

Which command-line tool would best be used to verify DNS functionality? A. netstat B. nbtstat C. dig D. icmp E. arp

C. dig is an old UNIX command that will show you DNS server information.

What tool would you use to verify a complaint about a slow network?

Throughput tester