TCP/IP Troubleshooting: A Structured Approach - Part 4: Using Netdiag.exe

by [Published on 13 Dec. 2006 / Last Updated on 13 Dec. 2006]

How to use the Netdiag.exe support tool to diagnose TCP/IP connectivity issues.

If you missed the other parts in this article series please read:

In the last article of this series we examined how to repair network connections using the Repair feature of Windows network connections. The Repair feature works by performing a series of tests to try and restore network connectivity caused by network misconfiguration on either the client (issues with DHCP settings or resolver cache) or server (name registration with WINS or DNS server). The Repair feature has several limitations however, namely:

  • The results of the Repair process can't be saved for later review or reporting purposes.
  • On multihomed machines, the Repair process must be performed separately on each network connection.
  • The number of tests performed by the Repair process is limited.


Get your copy of Windows Server Hacks!

These limitations can be overcome by using Netdiag.exe, a network connectivity troubleshooting tool that is part of the Windows Support Tools. Netdiag runs a more extensive series of tests than the Repair process does, and it performs many more tests than the Repair process does. You can also redirect output for Netdiag.exe to a text file so you can have a record of the tests performed and their results.

Installing Netdiag

You can install Netdiag by installing the Windows Support Tools, which can be installed by double-clicking on \Support\Tools\SUPTOOLS.MSI. By default the Support Tools install to %SystermDrive%\Program Files\Support Tools but I find it easier to install them to %SystemDrive%\Tools since the tools need to be run from the command-line and this makes typing the path to these tools simpler to run them. Alternatively, if you only want to install Netdiag and not the other Support Tools, you can double-click on the \Support\Tools\Support.cab cabinet file and then double-click on Netdiag.exe to install this tool alone.

Understanding Netdiag

Netdiag performs a series of tests on each network adapter on the local system. Once these tests are performed, Netdiag performs a series of global connectivity tests to identify and resolve connectivity problems that may be caused by issues beyond the local system.

Netdiag first performs the following tests on the local system's network adapters:

  • Ndis
  • Ipconfig
  • Autonet
  • DefGw
  • NbtNm
  • WINS

Once these tests are performed, Netdiag then performs the following series of global connectivity tests:

  • Member
  • NetBTTransports
  • Autonet
  • IpLoopBk
  • DefGw
  • NbtNm
  • Winsock
  • DNS
  • Browser
  • DsGetDc
  • DcKust
  • Trust
  • Kerberos
  • Ldap
  • Bindings
  • WAN
  • Modem
  • IPSec

Details concerning each of these tests are provided by the following table:

Test name

Description

Autonet

Checks if APIPA is being used by network adapters.

Bindings

Lists network bindings including interface name, lower and upper module names, indicates whether the binding is currently enabled, and reports the owner of the binding.

Browser

Lists all network protocols bound to the Browser service and to the Redirector.

DcList

Obtains a list of domain controllers for the domain.

DefGw

Verifies connectivity with each configured default gateway.

DNS

Verifies availability of configured DNS servers and verifies the client's DNS registrations.

DsGetDc

Obtains the name of any domain controller from directory service and then obtains the name of the PDC Emulator. Verifies if the domain GUID stored in the Local Security Authority (LSA) is the same as the domain GUID stored in the DC.

IpConfig

Enumerates TCP/IP settings for each network adapter.

IpLoopBk

Pings the loopback address 127.0.0.1 for each adapter.

IPSec

Checks whether IPsec is enabled and if so then lists all active IPsec policies for the computer.

IPX

Lists statistics for IPX (if installed).

Kerberos

Verifies whether the Kerberos authentication package is up-to-date.

Ldap

Contacts all available domain controllers and determines which LDAP authentication protocol is currently being used.

Member

Checks to confirm details of the primary domain, including computer role, domain name, and domain GUID. Checks to see if NetLogon service is started, adds the primary domain to the domain list, and queries the primary domain security identifier (SID).

Modem

Provides configuration information for each modem on the system.

NbtNm

Performs actions similar to the nbtstat -n command i.e. verifies that the Workstation Service name <00> is the same as the computer name and verifies that the Messenger =Service name <03> and Server Service name <20> are present on all interfaces and that none of these names are in conflict.

Ndis

Lists details concerning the configuration of each network adapter including adapter name, configuration, media, GUID and statistics.

NetBTTransports

Lists all transport protocols bound to NetBIOS over TCP/IP (NetBT).

Netstat

Lists current TCP/IP connections and protocol statistics.

Netware

Queries the nearest Netware server (if used) for current login information.

Route

Lists all static routes in the routing table and indicates whether they are persistent.

Trust

Tests domain trust relationships and verifies the primary domain SID is correct.

WAN

Summarizes the settings and status for each COM port currently in use.

WINS

Verifies the availability of the configured WINS server and verifies WINS client registrations.

Winsock

Displays protocols and ports available to WinSock service.

In addition to performing these tests, Netdiag.exe also reports the following information concerning the system:

  • NetBIOS name of system
  • DNS name of system
  • General system info
  • Installed hotfixes

Running Netdiag

The simplest way to run Netdiag is without any parameters, which tests each local network adapter on the system and then performs a series of global connectivity tests. Sample output from running this command on a Windows Server 2003 member server is as follows (hotfix list has been truncated):

C:\tools\netdiag
...................................

    Computer Name: SRV
    DNS Host Name: SRV.contoso.com
    System info : Microsoft Windows Server 2003 R2 (Build 3790)
    Processor : x86 Family 15 Model 4 Stepping 1, GenuineIntel
    List of installed hotfixes : 
        KB890046
        KB893756
        KB896358
        …
        KB925486
        Q147222

Netcard queries test . . . . . . . : Passed

Per interface results:

    Adapter : Local Area Connection

        Netcard queries test . . . : Passed

        Host Name. . . . . . . . . : SRV
        IP Address . . . . . . . . : 172.16.11.31
        Subnet Mask. . . . . . . . : 255.255.255.0
        Default Gateway. . . . . . : 172.16.11.1
        Dns Servers. . . . . . . . : 172.16.11.32

        AutoConfiguration results. . . . . . : Passed

        Default gateway test . . . : Passed

        NetBT name test. . . . . . : Passed
        [WARNING] At least one of the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names is missing.

        WINS service test. . . . . : Skipped
            There are no WINS servers configured for this interface.

Global results:

Domain membership test . . . . . . : Passed

NetBT transports test. . . . . . . : Passed
    List of NetBt transports currently configured:
        NetBT_Tcpip_{64B5D4FF-0014-4CC2-BB8D-9FB0C67CB75E}
    1 NetBt transport currently configured.

Autonet address test . . . . . . . : Passed

IP loopback ping test. . . . . . . : Passed

Default gateway test . . . . . . . : Passed

NetBT name test. . . . . . . . . . : Passed
    [WARNING] You don't have a single interface with the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names defined.

Winsock test . . . . . . . . . . . : Passed

DNS test . . . . . . . . . . . . . : Passed

Redir and Browser test . . . . . . : Passed
    List of NetBt transports currently bound to the Redir
        NetBT_Tcpip_{64B5D4FF-0014-4CC2-BB8D-9FB0C67CB75E}
    The redir is bound to 1 NetBt transport.

    List of NetBt transports currently bound to the browser
        NetBT_Tcpip_{64B5D4FF-0014-4CC2-BB8D-9FB0C67CB75E}
    The browser is bound to 1 NetBt transport.

DC discovery test. . . . . . . . . : Passed

DC list test . . . . . . . . . . . : Passed

Trust relationship test. . . . . . : Passed
    Secure channel for domain 'CONTOSO' is to '\\DC-1A.contoso.com'.

Kerberos test. . . . . . . . . . . : Passed

LDAP test. . . . . . . . . . . . . : Passed

Bindings test. . . . . . . . . . . : Passed

WAN configuration test . . . . . . : Skipped
    No active remote access connections.

Modem diagnostics test . . . . . . : Passed

IP Security test . . . . . . . . . : Skipped

    Note: run "netsh ipsec dynamic show /?" for more detailed information

The command completed successfully

Note that running the NbtNm test gave the following results:

        NetBT name test. . . . . . : Passed
        [WARNING] At least one of the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names is missing.

This warning is not really a problem since by default the Messenger service is not running on Windows Server 2003 so no <20> name will be registered for it.

There are other ways you can run Netdiag, specifically:

  • Netdiag /q runs tests in quiet mode and reports only errors.
  • Netdiag /v runs tests in verbose mode and provides additional detail.
  • Netdiag /test:test_name(s) runs the standard tests and then they perform the specified test(s) only.
  • Netdiag /skip:test_name(s) runs the standard tests followed by global tests except for the one(s) specified. (Certain tests can't be skipped however, including Member, Ndis and NetBTTransports.)
  • Netdiag /fix performs all standard and global tests and attempts to fix any problems that it finds.

For example, running the Netdiag /q test on the above system produces these results:

C:\tools\netdiag /q
...................................

    Computer Name: SRV
    DNS Host Name: SRV.contoso.com
    System info : Microsoft Windows Server 2003 R2 (Build 3790)
    Processor : x86 Family 15 Model 4 Stepping 1, GenuineIntel
    List of installed hotfixes : 
        KB890046
        KB893756
        KB896358
        …
        KB925486
        Q147222

Per interface results:

    Adapter : Local Area Connection

        Host Name. . . . . . . . . : SRV
        IP Address . . . . . . . . : 172.16.11.31
        Subnet Mask. . . . . . . . : 255.255.255.0
        Default Gateway. . . . . . : 172.16.11.1
        Dns Servers. . . . . . . . : 172.16.11.32

        WINS service test. . . . . : Skipped

Global results:
    [WARNING] You don't have a single interface with the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names defined.

IP Security test . . . . . . . . . : Skipped

The command completed successfully

More Netdiag Examples

The best way of learning how to interpret Netdiag output is to try running it under various test scenarios. The following are a few examples of different scenarios and the kind of output you may get from this tool. These scenarios are performed by running Netdiag on a member server in a Windows Server 2003 domain, and the output has been truncated to highlight only the error messages reported by the tool.

1. Output from running netdiag /q when the domain controller is offline:

Global results:
    [WARNING] You don't have a single interface with the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names defined.

Redir and Browser test . . . . . . : Failed
    [FATAL] Cannot send mailslot message to '\\CONTOSO*\MAILSLOT\NET\NETLOGON' via redir. [ERROR_BAD_NETPATH]

DC discovery test. . . . . . . . . : Failed
        [FATAL] Cannot find DC in domain 'CONTOSO'. [ERROR_NO_SUCH_DOMAIN]

DC list test . . . . . . . . . . . : Failed
        'CONTOSO': Cannot find DC to get DC list from [test skipped].

Trust relationship test. . . . . . : Failed
    [FATAL] Secure channel to domain 'CONTOSO' is broken. [RPC_S_SERVER_UNAVAILABLE]

Kerberos test. . . . . . . . . . . : Skipped
        'CONTOSO': Cannot find DC to get DC list from [test skipped].

LDAP test. . . . . . . . . . . . . : Failed
    Cannot find DC to run LDAP tests on. The error occurred was: The specified domain either does not exist or could not be contacted.

        [WARNING] Cannot find DC in domain 'CONTOSO'. [ERROR_NO_SUCH_DOMAIN]

2. Output from running netdiag /q when the wrong default gateway is configured on the system:

Default gateway test . . . . . . . : Failed

    [FATAL] NO GATEWAYS ARE REACHABLE.
    You have no connectivity to other network segments.
    If you configured the IP protocol manually then
    you need to add at least one valid gateway.
    [WARNING] You don't have a single interface with the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names defined.

DC list test . . . . . . . . . . . : Failed
        Failed to enumerate DCs by using the browser. [ERROR_REQ_NOT_ACCEP]

3. Output from running netdiag /q when the Computer Browser service is not running on the system:

Global results:
    [WARNING] You don't have a single interface with the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names defined.

DC list test . . . . . . . . . . . : Failed
        Failed to enumerate DCs by using the browser. [NERR_ServiceNotInstalled]

4. Output from running netdiag /q when the computer account for the system is disabled in Active Directory when the system starts up:

Global results:
    [WARNING] You don't have a single interface with the <00> 'WorkStation Servi
ce', <03> 'Messenger Service', <20> 'WINS' names defined.

Trust relationship test. . . . . . : Failed
    Cannot test secure channel for domain 'CONTOSO' to DC 'DC-1A'. [ERROR_NO_LOG
ON_SERVERS]

Kerberos test. . . . . . . . . . . : Failed
    [FATAL] Cannot get ticket cache from Kerberos.
    The error occurred was: (null)

Conclusion

Netdiag.exe is a powerful tool for troubleshooting network connectivity issues on Windows networks. Readers of this article are encouraged to try and think up additional scenarios similar to the examples above to help them gain more experience in understanding the capabilities of this tool and how to use it.

If you missed the other parts in this article series please read:

The Author — Mitch Tulloch

Mitch Tulloch avatar

Mitch Tulloch is a widely recognized expert on Windows administration, networking, and security. He has been repeatedly awarded Most Valuable Professional (MVP) status by Microsoft for his outstanding contributions in supporting users who deploy and use Microsoft platforms, products and solutions.

Latest Contributions

Advertisement

Featured Links