Marcus Hall

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Command line program to test DHCP service ======

From: https://serverfault.com/questions/171744/command-line-program-to-test-dhcp-service

<code>
assuming you have installed nmap (sudo apt install nmap):

sudo nmap --script broadcast-dhcp-discover

Windows nmap -sU -p 67 --script dhcp-discover 10.230.0.2/32

</code>

<WRAP center round box >
Get-DhcpServerInDC

From <https://docs.microsoft.com/en-us/powershell/module/dhcpserver/get-dhcpserverindc?view=windowsserver2022-ps> 

</WRAP>

    nmap -oA c:\temp\nmap-broadcast-dhcp-discover-2020-07-21 --script=broadcast-dhcp-discover 10.9.0.0/16
 
http://marcushall.net/dokuwiki/doku.php


[[software:nmap|software:nmap]]

File broadcast-dhcp-discover

From <http://marcushall.net/dokuwiki/doku.php?id=software:nmap#output_the_scan_to_file_with_all_of_those_formats> 



====== Name Resolution Lookup ======

Microsoft TCP/IP Host Name Resolution Order

Name resolution lookup windows 7

<code>

</code>


====== DHCPFind search active and rogue DHCP servers ======

From: http://www.symantec.com/connect/downloads/detect-rogue-dhcp-servers-network

Fromn: http://www.roadkil.net/downloads.php

<code>
Find DHCP displays the DHCP servers active on your network, just run this portable tool and in few seconds 
will be shown many helpful information such as IP address offered by dhcp server, netmask, gateway, servers
network address and dhcp lease.
</code>

=== RogueChecker - Find DHCP servvers ===

From: https://robiulislam.wordpress.com/2012/11/12/rogue-dhcp-server/

Downloads:
http://blogs.technet.com/b/teamdhcp/archive/2009/07/03/rogue-dhcp-server-detection.aspx
http://blogs.technet.com/cfs-file.ashx/__key/communityserver-components-postattachments/00-03-26-09-62/RogueChecker.zip

====== Network Discovery ======

From: http://blogs.technet.com/b/networking/archive/2010/12/06/disabling-network-discovery-network-resources.aspx

<code>
Network discovery is not a single thing. In general terms it is the process of gathering information about 
the Network resources near you. It consists of a group of protocols that all report to the Function Discovery 
platform. Probably the most well-known protocol is NetBIOS Browsing, but it also includes WSD, UPNP, SSDP, 
and even the registry. Typically you see this information in Network Resources/Network Neighborhood, but any 
application can potentially be programmed to use it.
</code>

====== Clearing the network configuration ======

From: http://www.techrepublic.com/forums/questions/connection-specific-dns-suffix-wont-change-appropriately/

<code>
runs Ipconfig release, flushdns, renew, registerdns
When they return to the office, they cannot access network resources. They receive a DHCP address, 
but cannot connect to their shared drive, cannot synchronize and cannot surf the web. 
If an "ipconfig /release" and "ipconfig /renew" is performed, all is well again. Looking deeper 
into the problem, the "Connection-specific DNS Suffix" is not correct.
</code>


<WRAP center round box >
Does your PC have any IPv6 addresses (link-local or otherwise)?
<code>
ipconfig /all | findstr IPv6
</code>

What IPv6 endpoints are on your Windows machine?
<code>
netstat –abn –p tcpv6 
netstat –abn –p udpv6 
netstat –abn –p icmpv6 
</code>

From <http://techgenix.com/IPv6-multicast-background-traffic-Part1/> 

Use ip .
I want to know about your world
Are you still using one of the following tools?
<code>
/bin/netstat (replaced by ss, for which I’ll dedicate another blog post entirely)
/sbin/ifconfig
/sbin/ipmaddr (replaced by ip maddress)
/sbin/iptunnel
/sbin/mii-tool (ethtool should appropriately replace it)
/sbin/nameif
/sbin/plipconfig
/sbin/rarp
/sbin/route
/sbin/slattach
</code>

From <https://ubuntu.com/blog/if-youre-still-using-ifconfig-youre-living-in-the-past> 

</WRAP>

====== Troubleshooting Windows File Sharing ======

From: http://community.wd.com/t5/WD-TV-Live-Networking/Troubleshooting-Windows-File-Sharing/td-p/92642

    net view
    nbtstat -a kids-vm-pc
    net view /domain
    nbtstat -A 10.0.0.2
    net view \\bignas1


====== Network anomalies ======

  * Windows 8 computer (not domain member) will only list WSD discoveries for computers 
    * Added Wins server manually (would not add from DHCP automatically)
    * then listed netbios computers quickly
  * Same computer left building to home network and became computer browser of home network 
    * retained master browser status when DHCP configured for work network
    * and even with manual wins configuration would only discover itself with netbios
    * after runs Ipconfig release, flushdns, renew, registerdns still retains master browser

====== netstat ======

<WRAP center round box >

    netstat -an
    netstat -bano = show the application that is listening
    nbtstat -A 192.168.1.10

</WRAP>

<WRAP center round box >

6. View current TCP connections

    Get-NetTCPConnection

From <https://www.techrepublic.com/article/10-powershell-commands-for-network-troubleshooting/> 


</WRAP>

====== Network Investigation Commands ======

From: http://technet.microsoft.com/en-us/magazine/ee924647.aspx

    When the troubleshooters don’t solve the problem
    
From: http://whirlpool.net.au/wiki/windows_nw_diag_cmds

    network diagnostic    
    
    
====== 57 Tips Every Admin Should Know ======

    
From: http://www.gfi.com/blog/57-tips-admin/


    all network connections
    
    ipconfig /release
    
    whoami /groups
    
    systeminfo | more
    
    Active Directory listing commands
    
====== Microsoft Computer Browser Service ======

    Note: Samba on linux as default will claim Master Browser

How to Determine the Master Browser in a Windows Workgroup

From: http://scottiestech.info/2009/02/14/how-to-determine-the-master-browser-in-a-windows-workgroup/

     Type "net view" and hit enter
     net view /domain to determine the list of workgroup names
     net view /domain:[WORKGROUP] to determine the list of puter names for each [WORKGROUP]


From: http://www.networksteve.com/forum/topic.php/Domain_computers_not_showing/?TopicId=23182&Posts=4

As James pointed out, XP/Server 2003 and WIN7/Server 2008 use different methods for this. XP/2003 do not understand the new network discovery method used in Windows 7. To see the whole network you have to rely on the computer browser service. This
service is a legacy system from Windows NT and relies on Netbios names and LAN broadcasts. Win 7 and 2008 are backward compatible with the browser service.
If something upsets the browser service (like shutting down or starting a master browser) it can take a while to settle down and a full browse list for the domain to be built.

From: http://support.microsoft.com/kb/188305

This article applies to a different version of Windows than the one you are using. Content in this article may not be relevant to you. Visit the Windows 7 Solution Center

=== Samba Boxes Taking Over As Master Browser For Win2k Domain ===

From: http://forum.soft32.com/linux/Samba-Boxes-Taking-Master-Browser-Win2k-Domain-ftopict356677.html

  Edit the /etc/samba/smb.conf file and locate the line that reads.... 
  ;local master = no 
  and remove the semi-colon or add the line above without the semi-colon. 


=== How to Determine the Master Browser in a Windows Workgroup   ===

From: http://scottiestech.info/2009/02/14/how-to-determine-the-master-browser-in-a-windows-workgroup/

**net view /domain** \\
**net view /domain:[WORKGROUP]** \\
**ping -n 1 -4 COMPUTER-NAME** \\
**nbtstat -A IP-ADDRESS** \\
**check for the _MSBROWSE_** \\

    first **net view /domain** to determine the list of workgroup names
    second **net view /domain:[WORKGROUP]** to determine the list of computer names for each [WORKGROUP]
    extracts the individual computer names and sticks them in an array
    iterates through the array and calls **ping -n 1 -4 COMPUTER-NAME** on each computer name (we only want to display IPv4 addresses, hence the “-4″ switch)
    iterates through the array of IP addresses and calls **nbtstat -A IP-ADDRESS** (the “-A” means “I’m giving you an IP address instead of a computer name”. This is a more reliable way of doing things.)
    After each call to nbtstat, it not only **checks for the _MSBROWSE_** string, but it also records the MAC address of the network adapter in the remote computer.

Script LANscan_v1.3.zip

<code>
nbtstat -A 192.168.1.1      
nbtstat -A 192.168.1.2      
nbtstat -A 192.168.1.3      
nbtstat -A 192.168.1.4      
nbtstat -A 192.168.1.5        
nbtstat -A 192.168.1.7      
nbtstat -A 192.168.1.8      
nbtstat -A 192.168.1.10     
nbtstat -A 192.168.1.12     
nbtstat -A 192.168.1.16     
nbtstat -A 192.168.1.17     
nbtstat -A 192.168.1.18     
</code>

=== browstat ===

  browstat tickle \Device\NetBT_Tcpip_{F74DD27A-2662-4E1E-A3D1-3D0B5BC1F60C} workgroup

  browstat elect \Device\NetBT_Tcpip_{F74DD27A-2662-4E1E-A3D1-3D0B5BC1F60C} workgroup \\graphics

You can download Browstat from either: \\

http://www.microsoft.com/downloads/details.aspx?FamilyId=49AE8576-9BB9-4126-9761-BA8011FABF38&displaylang=en http://support.microsoft.com/?id=188305

For more information about the browser subsystem (very intricate),see: \\
http://support.microsoft.com/?id=188305 \\
http://support.microsoft.com/?id=188001 \\
http://support.microsoft.com/?id=231312 \\
http://support.microsoft.com/kb/q102878/ \\

http://www.microsoft.com/technet/prodtechnol/winntas/deploy/prodspecs/ntbrowse.mspx \\
http://www.microsoft.com/technet/archive/win95/w95brows.mspx \\

SYMPTOMS: 1) After enabling ICS/ICF, you can't see any computes on My Network places. If you try, you may get "workgroup is not accessible". 

2) If you use the net view command, you may receive "System error 6118 has occurred. The list of servers for this workgroup is not currently available." message.

Resolutions: 
1) This behavior can occur if you enable the ICF that will closes the ports for file sharing by default. 
To open these ports, right-click the network connection that is firewall protected> Properties>Advanced>Settings>Service 
Tab>Add, Enter 127.0.0.1) for the required Internet Protocol (IP) number. 
Enter UDP ports from 135 through 139, and TCP ports from 135 through 139 one by one (the external and internal port numbers should be identical).

Read this whole thread for several clues:

http://www.broadbandreports.com/forum/remark,13450150

http://support.microsoft.com/kb/191611

http://technet.microsoft.com/en-us/library/cc959923.aspx

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\IsDomainMaster : ''Change the value of this subkey to TRUE''
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\MaintainServerList :  ''Change the value of this subkey to Auto, True, False''


From: http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/cfa075e9-78d7-405b-8974-b014a90a9689

  So our plan now is to do the following in our lab and test further:
  Set PDC Emulator MaintainServerList=Yes, IsDomainMaster=Yes
  All other DC's, set MaintainServerList=Auto,IsDomainMaster=Auto
  All member servers and workstations, set MaintainServerList=No,IsDomainMaster=No

  The plan of action you are following is ok. You can also set the parameteres as below
  Set PDC Emulator MaintainServerList=Yes, IsDomainMaster=True 
  All other DC's, set MaintainServerList=Auto,IsDomainMaster=False 
  All member servers and workstations, set MaintainServerList=Auto,IsDomainMaster=False
  Hope this helps
  Regards,
  Sandesh Dubey.


If servers are frequently shut down and restarted, consider placing a BDC if the number of segments is not large, or at minimum a Windows-based member server on each segment with the IsDomainMaster registry setting set to True. This will give the server an edge during elections in becoming the master browser for the segment.

=== Learn Linux, 302 (Mixed environments): NetBIOS and WINS Configuring Samba to serve names and manage browsing ===

Book: http://books.google.com/books?id=I67mb3bdsyoC&pg=PA306&lpg=PA306&dq=linux+taking+over+master+browser&source=bl&ots=P_tq9ap8CT&sig=cl3mAdvePMFb3ux4jZ6vRSxe6YI&hl=en&sa=X&ei=T9mrULeeKojU9QT79YAY&ved=0CEIQ6AEwAw#v=onepage&q=linux%20taking%20over%20master%20browser&f=false \\

From: http://www.ibm.com/developerworks/linux/library/l-lpic3-314-2/

  * In this article, learn about these concepts:
    * Windows Internet Name Service (WINS)
    * Network input/output system (NetBIOS)
    * Local master browser features
    * Domain master browser features
    * Name resolution
    * Configuring and using Samba as a WINS/NetBIOS Name Server (NBNS)
    * NetBIOS browsing, elections, and service announcements


Samba Book: http://www.samba.org/samba/docs/using_samba/ch07.html


Microsoft Description of Master Browser: http://www.microsoft.com/resources/documentation/windowsnt/4/server/reskit/en-us/net/chptr3.mspx?mfr=true

=== Mac Server ===

From: http://www.mactech.com/articles/mactech/Vol.23/23.10/DemystifyingWindowsnetworkbrowsing/index.html

"Mac OS X Server can also provide network browsing service as a workgroup master browser or a Windows domain master browser for Windows clients. A workgroup master browser enables Windows computers to discover servers on one subnet. A domain master browser enables Windows computers to discover servers across subnets."