IT를 사랑하는 사람 RSS FEED

Introduction to the Run Line

Clicking the entry "Run" opens the box shown below, where commands may be typed and entered.

Opening applications in Run

Although applications can be opened in a variety of ways, the Run line often provides the quickest route. Desktop shortcut icons are also a quick route but you have to know how to create a shortcut for all the applications and you may end up with dozens of icons.

The best candidates for the Run line are applications that are in the "path" environment. (Go to this page for more discussion of the path.) The path environment is a set of folders whose names do not have to be included when entering a command. The path environment variable normally includes \Windows\ and \Windows\system32\. Many common accessories and Windows applets are in these folders and can be opened by entering just the executable file name. Several that I use constantly are the Registry editor (regedit) and the System Configuration Utility (msconfig). Note that neither of these frequently used system tools has an entry in Start- All Programs. The Run line is the standard method of accessing them.

A table listing some applications that can be opened in the Run line is given below.

Programs not in the path require their full address, including the root folder and all subfolders. Actually typing long path names is not required since a "Browse" function comes with the Run line. This provides a way to search for files of interest and to enter them directly without typing. If desired, frequently used programs can be added to the path environment using the methods that are discussed in a section below.

Opening Management Consoles

Some of the functions that I find convenient to open by means of the Run line include various Management Consoles. For example, the disk defragmenter is opened by entering "dfrg.msc" . I find this easier than the multi-step process involved otherwise. A list of the appropriate file names for opening some of the various services is given in the table below. A more complete list is on this page.

The Source : http://commandwindows.com

Syntax and switches

The command syntax is netstat [-a] [-b] [-e] [-n] [-o] [-p proto] [-r] [-s] [-v] [interval] A brief description of the switches is given in Table I below. Note that switches for Netstat use the dash symbol "-" rather than the slash "/".

Applications of Netstat

Netstat is one of a number of command-line tools available to check the functioning of a network. (See this page for discussion of other tools.) It provides a way to check if various aspects of TCP/IP are working and what connections are present. In Windows XP SP2, a new switch "-B" was added that allows the actual executable file that has opened a connection to be displayed. This newer capability provides a chance to catch malware that may be phoning home or using your computer in unwanted ways on the Internet. There are various ways that a system administrator might use the assortment of switches but I will give two examples that might be useful to home PC users.

Checking TCP/IP connections

Figure 1. Example output for command "netstat -an"

The information that is displayed includes the protocol, the local address, the remote (foreign) address, and the connection state. Note that the various IP addresses include port information as well. An explanation of the different connection states is given in Table II>

Checking for malware by looking at which programs initiate connections

To find out which programs are making connections with the outside world, we can use the command netstat -b Actually, it is better to check over a period of time and we can add a number that sets the command to run at fixed intervals. Also, it is best to create a written record of the connections that are made over some period of time. The command can then be written netstat -b 5 >> C:\connections.txt Note that as written, this command will run with five-second intervals until stopped by entering "Ctrl+c", which is a general command to exit. (Some reports say that this can be fairly CPU intensive so it may cause a slower, single-core machine to run sluggishly. It was not noticeable on my dual-core machine.) A simple example of the type of output is shown in Figure 2. Note that the Process ID (PID) is given. This command can be combined with other tools such as Task Manager to analyze what executable files and processes are active and are trying to make Internet connections.

Figure 2. Sample output for command "netsat -b"

Batch program to check connections and terminate automatically

The previous example of using "netstat -b" to check connections at intervals has the disadvantage that it requires manual termination. It is also possible to use a batch file that runs a specified number of times with a given time interval and then terminates automatically. In Windows XP we can make use of a command from the Windows 2003 Server Tools called "Sleep". A possible batch file is: @echo off
for /L %%X in (1,1,100) do (netstat -b >> C:\connections.txt)&(sleep 5) This particular example does 100 iterations of the netstat command at 5 second intervals.

The Source : http://commandwindows.com 

There are dozens of networking tools available for Windows XP (For example, see this command-line reference.) Most of these are specialized and are mainly of interest to professionals who are maintaining a large network. Many, however, are relevant to the Internet and some of these can be helpful to the average PC user. The tools of interest to the discussion here are a few of of the TCP/IP utilities. (Go here for a complete list.) TCP/IP refers to the set of protocols that are used for Internet connections and on most networks. Discussing TCP/IP is beyond the scope of this page but more details are available on a separate page and in the references in the sidebar. Fortunately, it is not necessary to understand the gory details of TCP/IP in order to make practical use of the tools considered here.

All of the tools are run by opening a Command window and entering the appropriate command. Go to Start-Run and enter "cmd" to open a Command window.

Windows IP Configuration Tool (ipconfig)

The Windows IP Configuration tool (ipconfig) is the command-line equivalent of the accessory "Winipcfg" that was present in Windows 9X/Me. It is used to display the TCP/IP network configuration values. To open it, enter "ipconfig" in the command prompt. If you are connected directly to the Internet, you will obtain your IP address. (For a discussion of what an IP is, go here.) The figure below shows the result for a broadband connection where the IP is assigned automatically. Here the IP is your computer's temporary address on the Internet.

If you are on a local area network using a router, the information is different. You do not obtain the IP corresponding to the network's address on the Internet. (To obtain the IP that the Internet sees, go to a source such as DSL Reports Whois.) The IP given is the local address on the network. This information can be helpful in diagnosing network problems. Also listed is the "gateway" or router address on the local network. The figure below illustrates the result.

Switches for IPConfig

There are also a variety of switches for ipconfig that add functions. These are invoked by entering "ipconfig /{switch}". To obtain a list of switches, enter "ipconfig /?" or "ipconfig -?". These are shown in the figure below. The switches of most interest to everyday use are "release" and "renew". Note that IP addresses are typically assigned or "leased" for a period of time, often a day or more. It sometimes happens that IP addresses are no longer valid or are in conflict. Problems can often be solved by first releasing the IP address and then renewing it. Sometimes cable or DSL modems that seem to be disabled can be restored this way. If you travel and use broadband connections elsewhere, you will often find this procedure of releasing and renewing the IP address to be necessary.

For a detailed output of network parameters, you can use the command "ipconfig /all". Unless you are experienced with networks, however, this may be more than you want to know.

The switches "flushdns" and "displaydns" are are also sometimes useful in everyday use and they are discussed on another page at a sister site.

Ping

Ping is an old Unix tool that has been around for a long time but many PC users are unfamiliar with the Windows version. Ping sends out a packet to a designated internet host or network computer and measures its response time. The target computer will return (hopefully) a signal. It is a way of determining the quality of your connection to another site. You will also receive an IP address that corresponds to the user-friendly type of URL (see this page for further discussion of IPs and URLs). To use ping, open a command window (or DOS in Windows 9X/Me) and type: ping <hostname>. For example, to ping Dell enter: ping dell.com Please note the use of a hostname, not a complete URL. The prefix "http://" is never used. Many sites also do not require "www" . By convention, 32 byte packets will be transmitted four times. You will receive a screen output that looks like:

The screen tells me that the IP for dell.com is 143.166.83.230 (For the moment, at least. This can change.) It also tells me that the average round trip time for a packet was 69 milliseconds, which means I have a good connection to dell.com. Long reply times of several hundred milliseconds are indicative of a slow connection. Note that some major sites such as microsoft.com do not like being pinged and block pings. In that case you will get a "Request timed out" message.

In addition to being used on the Internet, Ping is often used to test connections on local networks. More details can be found in this Microsoft article.

Tracert

Tracert (traceroute) is another old tool borrowed from Unix. The actual path between two computers on the Internet is not a straight line but consists of numerous segments or "hops" from one intermediate computer to another. Tracert shows each step of the path taken. It can be interesting to see just how convoluted it is. The times for each hop and the IP addresses for each intermediate computer are displayed. Tracert shows up to 30 hops. It is convenient for finding if there is one particular segment that is causing a slow or bad connection. A typical command might be "tracert dell.com".

Pathping

This command combines functions of Ping and Tracert. Pathping will first list the number of hops required to reach the address you are testing and then send multiple pings to each router between you and the destination. After that, it computes results based on the packets returned from each router. Because pathping displays the degree of packet loss at any given router or link, you can determine which routers or subnets might be having network problems. Note that the whole process may consume 5-10 minutes because many pings are being sent. There are switches to modify the process and these can be seen by entering "pathping /?" in the command prompt.

Netstat

Netstat displays the active TCP connections and ports on which the computer is listening, Ethernet statistics, the IP routing table, statistics for the IP, ICMP, TCP, and UDP protocols. It comes with a number of switches for displaying a variety of properties of the network and TCP connections. (One tricky point: the switches must be prefixed with a minus, not a slash.) More detail is at this page. One possible use for Netstat is to determine if spyware or Trojans have established connections that you do not know about. The command "netstat -a" will display all your connections. The command "netstat -b" will show the executable files involved in creating a connection. A figure showing all the switches and syntax is given below.

Nslookup

This command helps diagnose the Domain Name System (DNS) infrastructure and comes with a number of sub-commands. These are mainly for systems administrators. The primary interest for average PC users is its use to find the computer name corresponding to a numeric IP. For example, if you want to know who is "216.109.112.135" , enter "nslookup 216.109.112.135" and you will find that it is (or was anyway) a Yahoo computer. My firewall keeps a log of the IPs involved in the attempts to probe my computer and I sometimes look a few up to see who they are. (There are also Whois search sites available on the Web as mentioned in the Ipconfig section.)

Netsh

Back to top

Introduction to Netsh

As more and more home users set up networks, they are finding themselves to be de facto system administrators. Home networks are very nice but they require a certain amount of care and feeding. Fortunately, Windows XP comes with a large assortment of command-line tools that can help maintain your network. Although many are specialized and of interest only to administrators of large corporate setups, some tools can be quite helpful to the home user as well.

Many may find that the basic tools like ping, ipconfig, and netstat, which are discussed on another page, are all that they care to deal with but the more adventurous can take advantage of a complete suite of powerful tools called Netsh. This suite is invoked from the standard command-line but has it has own interface or shell with a large number of sub-commands. I will try to focus on the features of Netsh that I think can be helpful to the home user. The whole suite has many applications and those who want more details can go to this Microsoft reference.

The Network Services shell is opened by entering netsh into a regular command prompt. The shell has a hierarchical structure with some sub-shells that Microsoft calls "contexts". From the user's point of view, however, all that this means is that commands are entered as a sequence of terms. The following sections discuss the "contexts" of most use to the home user.

The "netsh diag" context

The diagnostic context "diag" contains useful tools for checking out a network and testing various components and functions. Table I shows the contexts and sub-commands of most interest to this discussion. A complete list and many details are given at this Microsoft reference.

This group of commands provides ways to test some of the most common functions of interest to home users. For example, you can test if your email server is working or check your email settings by the command netsh diag connect mail (Note that this may not work for email clients like AOL.). Another example is to list important settings withnetsh diag show all

The graphical user interface

One way to simplify diagnostic tasks is to use the Help Center interface that can be invoked by entering netsh diag gui With this interface, you can carry out a number of diagnostic tests with one operation. Figure 1 shows the available functions.

Figure 1. Settings for GUI function of Netsh diag

The "netsh interface ip" context

This context is another with functions that might interest a home user. It provides a way to add, delete, modify, and display various IP addresses and TCP/IP settings. Table II lists several functions. More detail and additional functions are discussed in this Microsoft reference. An example of its use is to display TCP/IP settings with the command netsh interface ip show configThis can also be written netsh int ip show config

Reset Internet Protocol (TCP/IP)

Another example of using the Netsh Internet Ip context is resetting TCP/IP. For several reasons, including infestation from spyware, these settings might get corrupted. Netsh contains a command that will reset the TCP/IP stack to the original settings that existed when the operating system was installed. These settings may not be the most up-to-date for your system but they will allow you to reconfigure after a spyware invasion or other problem. The command to reset TCP/IP is netsh int ip reset {logfile} Note that you must include the name of a file where a log of the actions will be placed. Thus, if the log file is C:\tcplog.txt, the command is netsh int ip reset C:\tcplog.txt A detailed description of reinstalling TCP/IP is given at this Microsoft reference. Also, see the Winsock section below.

The "netsh winsock" context

Service pack 2 for Windows XP includes some additions to the Netsh suite. These are discussed here and include a new tool for repairing the Windows network socket or "winsock". Uninstalling spyware or poorly written applications can corrupt the winsock settings and result in loss of network connectivity. There are two commands for managing the settings. To display a list of various installed services (LSP, BSP, NSP) use netsh winsock show catalog This list may not be too meaningful for the average PC user but it can be helpful for more experienced users. To reset the winsock to the default configuration use netsh winsock reset catalog Note that any installed software that uses Internet connections may be partially disabled by this action and have to be reinstalled. This would include most software that updates itself and anti-virus programs that use proxy servers. Therefore, this command should only be used for cases where the degree of corruption makes it necessary. See this reference for some alternative methods.

Netsh Firewall Helper in Windows XP SP2

Microsoft changed the way the firewall in Windows XP works when it issued service pack 2. It also added capability to Netsh for extensive configuring of the firewall with a new context "netsh firewall" that Microsoft calls the Firewall Helper. Its use in troubleshooting firewall problems in SP2 is extensively discussed in this knowledge base article. With the Firewall Helper Microsoft says you can now

• Configure the default state of Windows Firewall. (Options include Off, On, and On with no exceptions.)
• Configure the ports that must be open.
• Configure the ports to enable global access or to restrict access to the local subnet.
• Set ports to be open on all interfaces or only on a specific interface.
• Configure the logging options.
• Configure the Internet Control Message Protocol (ICMP) handling options.
• Add or remove programs from the exceptions list

The number of possible commands is quite large but two main sub-contexts are netsh firewall set and netsh firewall show An extensive list of commands is in the knowledge base article previously mentioned.

Back to top