Microsoft's Implementation of The OSI Reference Model

Microsoft's Implementation of The OSI Reference Model

Windows 2000 Networking Versus the OSI Reference Model
The Open Systems Interconnection (OSI) model is one system that can help you understand the networking architecture used in Windows 2000 Professional. The OSI model was developed by the International Standards Organization (ISO) and is a layered model that defines how computers participating in a network communicate and how the network data is exchanged between layers from the application to the network media.

The OSI model divides the network protocol stack into seven layers to which software systems must adhere to communicate over the network. In the case of Windows 2000, the system does not implement each layer separately; however, the result complies with the overall OSI model. Figure 1 compares the Windows 2000 network architecture with the OSI network model.

Figure 1

Click Here For A More Detailed Presentation of The OSI Reference Model:
http://www.thecertificationhub.com/networkplus/the_osi_ref_model.htm

NDIS-Compatible Network Adapter Card Drivers

The bottom layers of the Windows 2000 network architecture include the network adapter card driver and the network interface card (NIC). These must be 32 bit and compliant with Network Device Interface Specification (NDIS) 3.0, 4.0, or 5.0. The mechanism that NDIS uses to bridge these two layers is the miniport driver specification. The miniport drivers directly access the network adapters while providing common code where possible. This allows hardware vendors to create drivers that can call the underlying NDIS drivers, rather than code the functionality into their drivers.

NDIS 5.0
NDIS 5.0 extends the previous versions of NDIS that define the interaction of network protocols and network card adapters. NDIS allows multiple protocols and multiple network adapters to exist within a computer.

If you have more than one network adapter in your computer, each adapter card's protocol stack can be configured individually. The only limit on the number of network adapter cards you can install is the capacity of your computer hardware.

Windows 2000 Professional and NDIS 5.0 provide the following new features in addition to those of the NDIS 4.0 specification:

>> NDIS Plug and Play. Installs, loads, and binds miniports when a new adapter card is introduced.

>> Task offload. Available if the network adapter card has the capability of supporting checksums and forwarding. This results in performance gains for processes such as IPSec encryption.

Most of the new features in NDIS 5.0 are accessible only by using the miniport driver model and are therefore not supported for MAC drivers or older miniport drivers.

Backward Compatibility: Windows 2000 Professional can also use drivers written to be compliant with the NDIS 3.0 and 4.0 specifications that were used by Windows NT 3.x and Windows 4.0.

Network Protocols
The network protocols referred to in Figure 6.1 control the communications between computers on the network. Different network protocols provide varying communications services and capabilities.

TCP/IP
Transmission Control Protocol/Internet Protocol (TCP/IP) is the default protocol for Windows 2000 Professional and is an industry standard suite of protocols available for WANs and the Internet. Microsoft's implementation of TCP/IP provides a number of standard features, including the following:

>> Logical and physical multihoming

>> Internet Group Management Protocol (IGMP) version 2 (IP Multicasting)

>> Multiple default gateways

>> Automatic Path Maximum Transmission Unit (PMTU) discovery

>> Quality of Service (QoS)

In addition, Windows 2000 includes the following performance enhancements:

>> TCP scalable window sizes. The Windows 2000 TCP/IP stack will tune itself and use a larger default window size than earlier versions if sending and receiving computers can support a larger TCP window size.

>> TCP fast retransmit. When a receiver that supports fast retransmit receives data with a sequence number beyond the current expected one, it is likely that some data was dropped. To help make the sender aware of this event, the receiver immediately sends an ACK, with the ACK number set to the sequence number that it was expecting. The sender will determine that the sequence number in the ACK packet is earlier than the current sequence number being sent and immediately resend the segment that the receiver is expecting to fill in the gap in the data.

NWLink IPX/SPX-Compatible Transport
NWLink is an NDIS-compliant, native 32-bit implementation of Novell's IPX/SPX protocol. NWLink supports two networking Application Programming Interfaces (APIs): NetBIOS and Windows Sockets. These APIs allow communication among computers running Windows 2000 and among computers running Windows 2000 and NetWare servers.

The NWLink transport driver is an implementation of the lower-level NetWare protocols, which include IPX, SPX, Routing Information Protocol over IPX (RIPX), and NetBIOS over IPX (NBIPX). IPX controls addressing and routing of packets of data within and between networks. SPX provides reliable delivery through sequencing and acknowledgments. NWLink provides NetBIOS compatibility with NetBIOS layer over IPX.

Table 1 shows the interoperability that exists between Windows 2000 and NetWare.

Table 1

Platform	Running	Can Connect To
Windows 2000	NWLink	Client/server application running on a NetWare server
Windows 2000	NWLink and Client Services for Netware	NetWare servers for file and print services
NetWare Client	IPX with NetBIOS, named pipes, or Windows Sockets	Computers running Windows 2000 (with NWLink) running IPX-aware applications (such as SQL Server)
NetWare Client	IPX	Computers running Windows 2000 Server with NWLink and File and Print Services for NetWare (FPNW)

NetBIOS Extended User Interface (NetBEUI)
NetBEUI is a simple nonroutable protocol designed for peer-to-peer networks that takes little memory overhead. All hosts are considered to be on the same logical network, and all resources are considered to be local. Other machines on the network are located via their NetBIOS computer name. This name is resolved to a MAC address mapping via the use of broadcast messages. Without the added complexity of other protocols, more of the packet is used to transport data, making NetBEUI faster than TCP/IP and IPX/SPX in a small network (fewer than 50 computers).

Transport Driver Interface
The Transport Driver Interface (TDI) is a common interface that drivers (such as the Windows 2000 Server and redirector) use to communicate with the various network transport protocols, allowing services to remain independent of transport protocols. Unlike NDIS, there is no driver for TDI. It is just a specification for passing messages between two layers in the network architecture.

Network Application Programming Interfaces
An API is a set of routines that an application program uses to request and carry out lower-level services performed by the operating system. Windows 2000 network APIs include

>> NetBIOS API. A standard application programming interface used for developing client/server applications.

>> Messaging API (MAPI). An API that allows developers to write messaging applications and back-end services that can be connected in a distributed computing environment.

Interprocess Communication
Interprocess Communication (IPC) allows bidirectional communication between clients and multiuser servers working on different computer systems. IPCs can be used as an intertask communication system on a local computer, as well as between a local computer and a remote one.

Applications that split processing between one or more networked computers are referred to as distributed applications. A client/server application uses distributed processing, in which processing is divided between a workstation (the client) and a more powerful server. The client portion is sometimes referred to as the front end and the server portion is referred to as the back end.

Multitier applications (often called three-tier) are an extension of the basic client/server model with an additional application-specific component between the client and the back-end server. It is common for this type of application to be split between a user interface on the client, the application code or business rules in the middle tier, and data services interacting with a large shared database server on the back end.

There are a number of ways in which the Windows 2000 operating system implements IPC mechanisms:

>> Remote Procedure Call (RPC). A mechanism that allows communication between a client and server by using other IPC mechanisms such as named pipes, NetBIOS, or Winsock to establish communications between the client and the server with the program logic and related procedure code existing on different computers.

>> Common Internet File System (CIFS). The standard way that computer users share files across corporate intranets and the Internet. It is an enhancement to the cross-platform Server Message Block (SMB) protocol that defines a series of commands used to pass information between networked computers.

Basic Network Services
Network services support application programs and provide the components and APIs necessary to access files on networked computers.

Server Service
The Server service is located above the TDI and is implemented as a file-system driver. The CIFS Server service interacts directly with other file-system drivers to satisfy I/O requests, such as reading or writing to a file. When the Server service receives a request from a remote computer asking to read a file that resides on the local hard drive, the following steps occur:

>> The Server service passes the request to the appropriate local file-system driver.

>> The data is passed back to the local file-system driver.

>>The Server service passes the data to the lower-level network drivers for transmission back to the remote computer.

The Server service is composed of two parts. Services.exe is the Service Control Manager where all services start. Srv.sys is a file-system driver that handles the interaction with the lower levels of the protocol stack and directly interacts with various file system devices to satisfy command requests, such as file read and write.

Workstation Service
All user requests from the Multiple Uniform Naming Convention Provider (Multi-UNC Provider) go through the Workstation service. This service consists of two components: the user interface, which resides in Services.exe in Windows 2000, and the redirector (MRXSMB.SYS), which is a file-system driver that interacts with the lower-level network drivers by means of the TDI interface.

The Workstation service receives the user request and passes it to the kernel redirector.

Windows 2000 Redirectors
The redirector is a component that resides above TDI and is the mechanism through which one computer gains access to another computer. The Windows 2000 operating system redirector allows connection to Windows 9x, Windows for Workgroups, LAN Manager, LAN Server, and other CIFS servers. The redirector communicates to the protocols using the TDI specifications.The redirector is implemented as a Windows 2000 file-system driver. This provides several benefits:

>> It runs in kernel mode and can directly call other drivers and other kernel-mode components, such as cache manager.

>> It can easily coexist with other redirectors.

Interoperating with Other Networks
Besides allowing connections to Windows 9x, peer-to-peer networks, LAN Manager, LAN Server, and MS-Net servers, the Windows 2000 redirector can coexist with redirectors for other networks, such as Novell NetWare and UNIX networks.

Providers and the Provider-Interface Layer
For each additional type of network, such as NetWare or UNIX, you must install a provider. The provider is the component that allows a computer running Windows 2000 Professional to communicate with the lower levels of the network.

Client Services for NetWare is included with Windows 2000 Professional and allows the computer to connect as a client to the NetWare network.

Network Resource Access
Applications have a unified interface for accessing network resources, independent of any redirectors installed on the system. Access to resources is provided through the Multi-UNC Provider and the Multi-Provider Router (MPR).

Multiple Universal Naming Convention Provider
When applications make I/O calls containing Uniform Naming Convention (UNC) names, these requests are passed to the UNC Multi-UNC Provider. The Multi-UNC Provider is implemented as a driver, unlike the TDI, which is only a specification defining the way one network layer talks to another.

The Multi-UNC Provider allows multiple redirectors to coexist in the computer. However, if there are multiple redirectors present, there must be a means of deciding which one to use. One of the Multi-UNC Provider's functions, then, is to act as an arbitrator to decide the most appropriate redirector to use.

Universal Naming Convention Names
UNC is a naming convention for describing network servers and the share points on those servers. A typical UNC name appears as follows:
\\server\share\subdirectory\filename

Only the server and share component of a UNC are required to be present with each command. For example, the following command can be used to obtain a directory of the root of a specified share:
dir \\server_name\share_name

I/O requests from applications that contain UNC names are received by the I/O manager, which passes the requests to the Multi-UNC Provider. If the Multi-UNC Provider has not seen the UNC name during the previous 15 minutes (approximately), the Multi-UNC Provider sends the name to each of the UNC providers registered with it. When the Multi-UNC Provider receives a request containing a UNC name, it checks with each redirector to find which one can process the request.

Multi-Provider Router
Not all programs use UNC names in their I/O requests. Some applications use Wnet APIs, which are the Win32 network APIs. The MPR supports these applications.
MPR is similar to Multi-UNC Provider. MPR receives Wnet commands, determines the appropriate redirector, and passes the command to that redirector.

Adding and Configuring the Network Components of Windows 2000
You can configure all your network components when you first install Windows 2000 Professional. Changes to the network configuration include the following:

>> Network connection properties

Identification Options
Network identification properties are changed using the System applet in the Control Panel (see Figure 2).

Figure 2
Network Identification tab in the System applet

Properties that can be changed in the System applet include the computer name and the workgroup or domain information. When changing the domain name, a computer account must preexist in the domain, or the user performing the configuration change must provide credentials that have the user right to add computer accounts to the domain.

Network Connection Properties
Network connection properties are configured in the properties of individual network connections in Network and Dial-Up Connections from the Start menu, or from the Control Panel (see Figure 6.3). This is performed on a connection-by-connection basis. Additional protocols, services, or clients can be installed for an interface by clicking the Install button in the network connection's Properties dialog box. Additionally, advanced options can also be configured.

Figure 3
Viewing a network connection's properties.

Note - Adding Computer Accounts
By default, all domain users can add up to a maximum of 10 machine accounts to a domain.

Protocol Options
Additional protocols can be installed by selecting Protocol in the Select Network Component Type dialog box and clicking the Add button (see Figure 4). The following protocols can be added to a Windows 2000 Professional installation:

>> NWLink IPX/SPX/NetBIOS Compatible Transport Protocol. This is Microsoft's implementation of NetWare's IPX/SPX protocol.

>> DLC Protocol. This protocol allows communication with IBM mainframes and HP printers attached directly to the network.

>> Network Monitor Driver. This driver allows the Network Monitoring system (NetMon) to acquire packets from the network.

Figure 4
Selecting network components.

Service Options
Selecting the Service entry and clicking the Add button shows the additional services available to install on your computer These additional services include

>> SAP Agent. This is a NetWare service that advertises servers and addresses on a network.

Client Options
Selecting the Client entry and clicking the Add button shows the clients available to install on your computer. The following network clients can be added to a Windows 2000 Professional workstation:

>> Client Service for NetWare. Allows your computer to access resources on NetWare networks.

Advanced Options
The advanced options provide you a place to improve the performance of your computer on networks that contain more than one protocol. Two options are available from the Network and Dial-Up Communications applet in the Control Panel. Select the Advanced tab from the menu bar and Advanced Settings within the drop-down list.

Provider Order
This tab allows you to choose the order in which network providers (such as Microsoft networks and NetWare networks) are accessed. If your network connection accesses both Microsoft and NetWare networks using both IPX/SPX and TCP/IP, but your primary interface is the Microsoft Network, move the Microsoft Windows Network to the top for best performance.

Adapters and Bindings
The Bindings tab allows you to choose the order in which protocols (such as IPX/SPX and TCP/IP) are accessed. Setting the order of the protocols on a server therefore does not enhance performance, whereas changing the order of the protocols on your Windows 2000 Professional client will impact performance.
Note: For maximum performance, remove any unnecessary protocols and always make sure that your most frequently used protocol is configured to be the first one accessed.

Configuring the TCP/IP Protocol
Configure and troubleshoot the TCP/IP protocol. TCP/IP is the default protocol for Windows 2000 Professional and is supported by most common operating systems. When you manually configure a computer with a TCP/IP network adapter, you must enter the appropriate settings for connectivity with your network.

IP Addressing
IP addresses are 32-bit integers that are usually depicted as four 8-bit numbers that uniquely identify each host on a network. The smallest integer number that can be represented with 8 bits then is 0 0 0 0 0 0 0 0 (20–1), or 0. The largest integer that can be represented by 8 bits is 1 1 1 1 1 1 1 1 (28–1), or 255. Because of this, you will always see IP addresses as four numbers ranging from 0 to 255 separated by dots. This can be referred to in dotted-decimal format and is expressed as w.x.y.z—for example, 192.168.10.4.

This addressing scheme is again broken down into two halves: a network ID (also known as the network address) and the host ID (also known as the host address). The network ID must be unique in the Internet or intranet, and the host ID must be unique to the network ID. The network portion of the w.x.y.z notation is separated from the host through the use of the subnet mask.

TCP/IP addresses can be broken into five different classes of addresses. These classes define which bits are used for the network ID and which bits are used for the host ID in an IP address. Microsoft clients support IP addresses from the Class A, Class B, and Class C address ranges. Table 6.2 indicates how the three classes supported by Microsoft TCP/IP divide network IDs and host IDs.

Table 2
Class Address Ranges

Class	Network ID	Network Portion	Host Portion	Number of Networks	Number of Hosts
A	1–126	w.	x.y.z	126	16,777,214
B	128–191	w.x	y.z	16,384	65,534
C	192–223	w.x.y	z	2,097,152	254

Subnet Mask
After an IP address from a particular class has been decided upon, it is possible to divide it into smaller segments to better use the addresses available. A subnet mask (also known as an address mask) is defined as a 32-bit value that is used to distinguish the network ID from the host ID in an IP address. The bits of the subnet mask are defined as follows:

>> All bits that correspond to the host ID are set to 0.

Table 3 lists the default subnet masks using dotted-decimal notation. Note - Hosts Need a Subnet Mask: Each host on a TCP/IP network requires a subnet mask even if it is on a single-segment network. Although the subnet mask is expressed in dotted- decimal notation, a subnet mask is not an IP address.

Table 3.
Default Subnet Masks

Address Class	Bits for Subnet Mask	Subnet Mask
Class A	11111111 00000000 00000000 00000000	255.0.0.0
Class B	11111111 11111111 00000000 00000000	255.255.0.0
Class C	11111111 11111111 11111111 00000000	255.255.255.0

Default Gateway (Router)
This optional setting is the IP address of the router for this subnet segment. Routers are used to direct packets destined for segments outside the local one to the correct segment or to another router that can complete the connection. If this address is left blank, this computer will be able to communicate only with other computers on the same network segment.

Windows Internet Name Service (WINS)
Computers may use IP addresses to identify one another, but users generally prefer to use computer NetBIOS names. A Windows Internet Name Service (WINS) server is used to resolve NetBIOS names to IP addresses. WINS provides a dynamic database that maintains mappings of computer names to IP addresses. Note - The Dynamic Nature of WINS. WINS eliminates the need for an LMHOSTS file, which is a static alternative to WINS. Maintaining an LMHOSTS file requires much more administrative overhead than using WINS.

Domain Network Systems (DNS) Server Address
The DNS server address is used to resolve fully qualified domain names (FQDNs) to IP addresses. Under Windows 2000, DNS supports dynamic update as defined in RFC 2136. This allows DNS clients to dynamically update their IP address information to the DNS server.

The IPCONFIG command can be used to display information recently obtained from the DNS service using the following options:

>> /flushdns flushes and resets the DNS resolver cache.

Assigning IP Addresses to Clients
IP addresses can be assigned to TCP/IP clients using either Dynamic Host Configuration Protocol (DHCP) or by manually configuring TCP/IP options individually for each client on the network.

Using DHCP
One way to avoid the possible problems of administrative overhead and incorrect settings for the TCP/IP protocol (which are usually caused by manual configurations) is to set up your clients to receive their TCP/IP configuration information automatically through a DHCP server.

Figure 5
Specifying that TCP/IP configuration comes from a DHCP server.

To configure a computer as a DHCP client, all you must do is specify an IP address automatically in the Internet Protocol, TCP/IP, Properties box (see Figure 5).
IPCONFIG can be used to determine IP configuration information that has been assigned by a DHCP server using the following options:

>> /release releases any DHCP-assigned IP addresses and their configuration.

Manually Configuring TCP/IP
You can manually configure your TCP/IP settings by entering the required values into the TCP/IP Properties sheet (see Figure 6.6). For complete details, see Exercise 6.1 in the file Chapter06ApplyYourKnowledge.pdf on the CD.

Figure 6
Manual configuration of a TCP/IP host.

Connecting to Computers by Using Dial-Up Networking
Dial-up networking enables you to extend your network to unlimited locations. After a client connects to a Remote Access Server (RAS), it is registered into the local network and can take advantage of the same network services and data as if they were locally connected to the local network. The only difference is that network performance will be slower than when locally connected to the network.

Line Protocols
The network transport protocols (TCP/IP, NWLink, and NetBEUI) were designed for the characteristics of LANs. To make the network transport protocols function properly over phone-based connections, it is necessary to encapsulate them in one of the two supported line protocols in Windows 2000 Professional: SLIP and PPP.

Serial Line Internet Protocol (SLIP)
SLIP is an industry-standard line protocol that supports TCP/IP connections made over serial lines. SLIP implementations have several limitations:

>> SLIP requires that both computers understand the other's IP address for routing purposes. SLIP provides no mechanism for hosts to communicate addressing information over a SLIP connection, and there is not support for DHCP.

>> SLIP does not support any encryption and therefore passwords are sent as clear text.

>> It is usually necessary to include some scripting or manual intervention to log on to a SLIP server.

Point-to-Point Protocol (PPP)
The limitations of SLIP prompted the development of Point-to-Point Protocol. Some of the advantages of PPP include the following:

>> PPP supports TCP/IP, IPX, NetBEUI, and other protocols.

>> PPP supports both static IP addresses and DHCP.

>> PPP supports encrypted authentication.

Scripting and other manual interventions are not required for the logon process.

>> PPP supports multilink connections, which allows you to combine multiple physical links into one logical connection.

>> Multiple links can also be allocated only as they are required, thereby eliminating excess bandwidth.

Virtual Private Networks (VPNs)
VPN allows the computers in one network to connect to the computers in another network by the use of a tunnel through the Internet or other public network. A VPN connection allows you to connect to a server on your corporate network from home or when traveling using the routing facilities of the Internet. The connection appears to be a private point-to-point network connection between your computer and the corporate server.

Additionally, VPNs can be used to connect remote office LANs to the corporate LAN or to other remote LANs to share resources and information using direct connect of dial-up access.

The basic functions managed by VPNs are the following:

>>Address management. Assign the client's address on the private net and ensure that private addresses are kept private.

>>Key management. Encryption keys must be refreshed for both the client and the server.

Windows 2000 Professional provides two encapsulation methods for creating VPN connections.

Point-to-Point Tunneling Protocol (PPTP)
This protocol enables the secure transfer of data from your computer to a remote computer on TCP/IP networks. PPTP tunnels, or encapsulates, IP, IPX, or NetBEUI protocols inside of PPP datagrams. PPTP can work over dedicated Internet connections or over dial-up connections; however, it does require IP connectivity between your computer and the server to which it is authenticating before the tunnel can be established.

In PPTP, a PPP frame is wrapped with a Generic Routing Encapsulation (GRE) header and an IP header. In the IP header is the source and destination IP address that corresponds to the VPN client and VPN server.

Figure 7. Shows the PPTP encapsulation of a PPP payload. The PPP frame is encrypted with Microsoft Point-to-Point Encryption (MPPE) by using encryption keys generated from the MS-CHAP or EAP-TLS authentication process.

Figure 7
PPTP encapsulation of an encrypted datagram.

Layer 2 Tunneling Protocol (L2TP) over IPSec
L2TP is an Internet tunneling protocol with roughly the same functionality as PPTP. The Windows 2000 implementation of L2TP is designed to run natively over IP networks.

Encapsulation for L2TP consists of two layers:

>> The resulting L2TP message is then wrapped with an IPSec Encapsulating Security Payload (ESP) header and trailer, an IPSec Authentication trailer that provides message integrity and authentication, and a final IP header. In the IP header are the source and destination IP addresses that correspond to the VPN client and VPN server.

Figure 8 shows the L2TP encapsulation of a PPP payload. The L2TP message is encrypted with IPSec encryption mechanisms by using encryption keys generated from the IPSec authentication process. The portion of the packet from the UDP header to the IPSec ESP Trailer inclusive is encrypted by IPSec.

Figure 8
L2TP encapsulation of an encrypted PPP payload.

Internet Connection Sharing
With the Internet Connection Sharing (ICS) feature of Network and Dial-Up Connections, you can use Windows 2000 to connect your home network or small office network to the Internet.

A computer with ICS needs two connections: one to the internal LAN and one to the Internet. ICS is enabled on the interface connected to the Internet. This shared connection allows your internal network to receive its addresses using DHCP, provides a DNS service to resolve names, and provides a gateway service to access computer systems outside your home network.

The DHCP allocator provides IP addresses and gateway configurations to all computers on the local network that require an Internet connection.

All internal clients send their DNS requests to the ICS server. The DNS requests are then sent to the Internet for resolution using a DNS proxy service.

The network address translation (NAT) service within ICS assigns the computer hosting the ICS service the IP address 192.168.0.1/24, and the DHCP allocator issues addresses to clients for that subnet.

When the NAT receives an outgoing packet, the packet has the source IP address changed to the IP address of the external network interface. The source port also is changed to a unique value to allow the returned packet to be returned to the correct host. All mapping is stored in a NAT table. Note - You must be a member of the Administrators group to configure Internet Connection Sharing.

When the NAT receives an incoming packet, the NAT modifies the destination IP address and port number based on the previous connection information stored in the NAT table, and it checks the packet's internal tables to see whether there is already a mapping. If there is a mapping, it will be used; if not, a new one is created.

Internet Connection Sharing Settings
When you enable Internet Connection Sharing, certain protocols, services, interfaces, and routes are configured automatically. Table 6.4 describes the settings used when Internet Connection Sharing is enabled.

Table 4. Internet Connection Sharing Settings

	Configured Item		Action
	IP address 192.168.0.1		Configured with a subnet mask of 255.255.255.0 on the LAN adapter that is connected to the small office or home office network
	Autodial feature		Enabled
	Static default IP route		Created when the dial-up connection is established
	Internet Connection Sharing service		Started
	DHCP allocator		Enabled with the default range of 192.168. 0.2 to 192.168.0.254 and a subnet mask of 255.255.255.0
	DNS proxy		Enabled

Internet Connection Sharing for Applications
If you have applications that interact with services on the Internet (usually games), you need to configure the application in the Internet Connection Sharing service. In addition, if you want to provide services to users on the Internet (for example, you are hosting a Web site), you must configure the Web server service.

Installing a Dial-Up Networking Connection
The Network Connection Wizard for installing a dial-up networking connection is started when you double-click the Make New Connection icon in the Network and Dial-Up Connections Control Panel applet. The wizard automatically creates outgoing connections to other networks or incoming connections from remote computers.

The wizard allows the creation of five types of connections (see Figure 9), and these are discussed in the following sections.

Figure 9
Dial-up connection types available.

Dial-Up to Private Network
Dial-Up to Private Network is used to connect to a RAS server on a private network (such as a RAS server connected to a corporate network), using either modem connections or X.25 connections.

Dial-Up to the Internet
Dial-Up to the Internet is used to connect to an Internet service provider (ISP). Configuration options include the following:

>> PPP/SLIP/C-SLIP connectivity

>> IP addressing configured or supplied by the ISP

>> User ID and password

Figure 10
Encrypted authentication options.

Security is a major consideration when connecting to a public network. As shown in Figure 10, you can choose from several different security settings, including the following:

>> Challenge Handshake Authentication Protocol (CHAP). This uses a secure encryption authentication technique based on Message Digest 5 (MD5) encryption. CHAP uses challenge-response with one-way MD5 hashing on the response. In this way, you can prove to the server that you know your password without actually sending the password over the network.

>> Shiva Password Authentication Protocol (SPAP). This allows Shiva clients to dial in to computers running Windows 2000 Server.

Connect to a Private Network Through the Internet
Connect to a Private Network Through the Internet provides for a secure VPN connection over the public Internet. This type of network connection allows you to select a dial-up connection to establish first; or, if you already have a persistent connection to the Internet through a LAN connection (for example, a cable modem), the VPN can be established using the local connection. The remote VPN server computer's name or IP address is added to complete the configuration.

The type of connection (PPTP or L2TP) is defined by the RAS server to which the client connects. In any case, the connection and security are negotiated automatically.

Accept Incoming Connections
Accept Incoming Connections allows you to configure your Windows 2000 computer to accept connections from phone lines, from the Internet, or via direct cable. Configuration options include the following:

>> Whether to allow VPN connections

Network components available to incoming users
Connect Directly to Another Computer allows you to configure your Windows 2000 computer with a direct connection to another computer. The configuration options include the following:

>> The port to use (infrared, direct connection, or a COM port)

Connecting to Shared Resources on a Microsoft Network
Windows 2000 provides different methods to work with network resources and to determine what network resources are available.

Browsing
Users on a Windows 2000 network often need to know what domains and computers are accessible from their local computer. The Windows 2000 Browser service maintains a list (called the browse list) of all available domains and servers. This list can be viewed using Windows 200 Explorer and is provided by a browser in the local computer's domain.

The Windows 2000 browser system consists of a Master Browser, Backup Browsers, and Browser Clients. The computer that is the Master Browser maintains the browse list and sends copies to the Backup Browsers every 15 minutes. When a Browser Client needs information, it obtains the current browse list by remotely sending a request to either the Master Browser or a Backup Browser.

Browsing Other Domains
Users need to be able to retrieve lists of servers within their domain and also a list of other workgroups and domains. Upon becoming a Master Browser, each Master Browser in each domain broadcasts an announcement every minute for the first 5 minutes and once every 15 minutes thereafter. If a domain has not announced itself for a period equaling 45 minutes, it is removed from the master browse list.

Browsing a Wide Area Network
With domains that are split across routers, each network segment functions as an independent browsing entity with its own Master Browser and Backup Browsers. Therefore, browser elections occur within each network segment.

Domain Master Browsers are responsible for spanning the network segments to collect computer name information for maintaining a domain-wide browse list of available computers in the domain.

Universal Naming Convention
The UNC was introduced earlier in this chapter as a network provider service. This is a standardized way of specifying a share name on a specific computer. The share name can refer to folders or printers. The UNC path takes the form of \\server\share .

You can also use UNC paths to refer to network printers. For example, \\ACCTSERSVER\ACCTPRINT refers to the printer named ACCTPRINT on the server named ACCTSERVER .

My Network Places
The My Network Places icon can be used to browse recently used network resources or a view of the entire network. The entire network includes each network provider available on your network (perhaps NetWare networks as well as Microsoft Networks) and the Directory.

The network providers show the servers available under the network provider, and the Directory shows the objects within Active Direc-tory that the user has permission to view.

The NET VIEW Command
You can also access the list of computers in your workgroup by using the NET VIEW command. A sample listing looks like this:

      C:\Net View
      Server Name                       Remark———————————————
      \\TEST1
      \\TEST2
      \\NTW1
The command completed successfully.

Note - New Feature Alert.
You are now able to set artificial root paths for shared folders by including the full path to where you want the root to be established. For example, if you want

      h:\

to be the home directory for the user bkomar, you can use this command:

      net use h: \\server\users\bkomar

The NET USE Command
You can assign network resources to drive letters from the command prompt or from the Tools menu from Windows Explorer. To connect drive letter X: to a share called GoodStuff on a server named SERVER1, for example, you type the following command at the command prompt:

      C:\Net Use X: \\SERVER1\GoodStuff
You can also use the Net Use command to connect clients to network printers. If you want to connect port LPT1: to a network printer named HP5 on a server named SERVER1, use the following command:

      Net Use LPT1: \\SERVER1\HP5

To disconnect the network resources for these two, use the following two commands:

Net Use X: /d

Net Use LPT1: /d

Troubleshooting TCP/IP Connections
The best approach for troubleshooting network connections is to work from the bottom up, eliminating configuration issues first before checking basic connectivity and then advancing to higher functions and services.

Configuration Errors
The first thing to check when troubleshooting TCP/IP networking connections is the local TCP/IP configuration.

Use the Ipconfig /all command to get a detailed listing of the host computer configuration information, including the IP address, subnet mask, and the default gateway.

Typical problems found in the configuration include

>> Media state is set to Cable Disconnected. A physical network problem is preventing connectivity.

Troubleshooting TCP/IP Configuration Errors
If your client has correctly been assigned an IP address, yet connectivity is not working, the following tools can be used to troubleshoot connectivity problems.

Packet Internet Groper (PING)
PING is a tool that helps verify connectivity at the IP level. The PING command sends an ICMP echo request to the target hostname or IP address.

The best process to follow when using PING to detect network problems is to use IP addresses only (so as not to confuse name-resolution errors with network errors) and to ping progressively more remote computers.

The following order should be used when diagnosing connectivity problems:

>> Ping the IP address configured for the local computer. This ensures that the correct address is bound to the NIC.

>> Ping the IP address of a host on a remote network. This verifies that routing is functioning correctly to and from the network segment.

Trace Route (Tracert)
The Tracert diagnostic utility determines the route taken to a destination by sending Internet Control Message Protocol (ICMP) echo packets with varying IP Time-to-Live (TTL) values to the destination. Each router that is crossed between the source computer and the destination IP address is displayed on the screen.

If Tracert cannot record the path the packet takes in returning, the remote computer might be off the network, behind a firewall, or behind a router that filters ICMP packets.

Address Resolution Protocol (ARP)
All TCP/IP communications ultimately result in one network interface communicating with another network interface. The network interfaces are uniquely identified by the Media Access Control (MAC) address.

When communications with a client are performed, ARP caches the MAC address of the network interface associated with the destination IP address, using the following rules:

If the destination IP address is on a remote subnet, ARP will add the MAC address of the default gateway to the ARP cache.

The command Arp –a can be used to display the current cache of IP addresses and the MAC addresses associated with them:

Arp -a
Interface: 157.57.18.16 on Interface 0x1000003
Internet Address Physical Address Type
157.57.18.1 00-d0-ba-09-9c-d6 dynamic
157.57.18.26 00-a0-c9-96-03-7f dynamic

Route
The Route command can be used to display the routing table for the local computer. The entries in the routing table enable TCP/IP to determine which gateway to send outgoing traffic through. The routing table has many entries for individual routes, each one consisting of a destination, network mask, gateway interface, and hop count (metric) .

The structure of the Route command line is as follows:

>> [gateway] [METRIC costmetric]]

where -F clears the routing tables of all gateway entries. -P adds persistent entries to the routing table. COMMAND indicates the following command-line arguments for Route:

PRINT prints a route.

ADD adds a route.

DELETE deletes a route.

CHANGE modifies an existing route.

destination specifies the IP network address that the route is defined for.

MASK subnetmask specifies a subnet mask to be associated with this route entry.

gateway specifies the gateway to be used for the routing entry.

METRIC costmetric assigns an integer cost metric (ranging from 1 to 9999) to be used in calculating the fastest, most reliable, and/or least expensive routes.

Resolving Logical Names to IP Addresses
The process for two computers to communicate using TCP/IP involves four steps:

>> Use the IP address and the routing table to determine the interface to use and the forwarding IP address.

>> Use the MAC address to send the IP datagram.

If the computer to be reached is a hostname or a NetBIOS name, the name must be resolved to an IP address before any data can be sent. Hostnames and NetBIOS names are resolved in different ways.

Resolving a NetBIOS Name to an IP Address
Resolving a NetBIOS name means successfully mapping a 16-byte NetBIOS name to an IP address. The File and Printer Sharing for Microsoft Networks service in Windows 2000 Professional uses NetBIOS name resolution. When your computer starts, the Server service registers a unique NetBIOS name based on the name of your computer (padded out to 15 characters if it is shorter than that) with 0x20 as the 16th character.

When you attempt to make a file-sharing connection to a computer running Windows 2000 by name, the File and Printer Sharing for Microsoft Networks service on the file server you specify corresponds to a specific NetBIOS name. For example, when you attempt to connect to a computer called COMMONSERVER, the NetBIOS name corresponding to the File and Printer Sharing for Microsoft Networks service on that computer is as follows:

COMMONSERVER [20]
Note that the name of the server is padded out to 15 characters.

To actually use the file server, its IP address must be established.

The exact mechanism by which NetBIOS names are resolved to IP addresses depends on the NetBIOS node type that is configured for the node. Supported NetBIOS node types include

>> P-node. A peer-node client uses a NetBIOS Name Server (NBNS), such as WINS, for name registration and resolution.

>> H-node. A hybrid-node client uses an NBNS for both registration and resolution. However, if an NBNS cannot be located, it switches to b-node. It continues to poll for the name server and switches back to p-node when one becomes available.

NetBIOS names are resolved to an IP address by the NetBIOS session service through the following sequence if the client is set to be an h-node client:

>> Queries a WINS server if it is configured

>> Consults the LMHOSTS file directly for an address assigned to the computer name

If these methods fail, a Windows 2000 client then uses the following methods to attempt to resolve the NetBIOS name:

>> Query the DNS server if it is configured.

Troubleshooting NetBIOS Name Resolution Problems
The following commands and configurations can be used to diagnose NetBIOS name resolution problems:

>> NET USE can be used to map network drivers to UNC names. If the command succeeds, the NetBIOS name was successfully translated to an IP address.

>> Verify WINS configuration to ensure that the TCP/IP configuration points to the correct WINS server, as shown in Step by Step 6.2.

Resolving a Hostname to an IP Address
Hostnames are resolved to an IP address using the DNS system. The DNS system is a worldwide distributed database that replaces the HOSTS file with a hierarchical domain name system that maps names to IP addresses.

>> The local HOSTS file is queried for the testcomp.Microsoft.com entry.

>> The DNS name server checks its cache and zone files for the answer, but doesn't find it. It contacts a server at the root of the Internet (a root DNS server) with an iterative query for testcomp.microsoft.com.

>> The DNS name server contacts a server in the .com domain with an iterative query for testcomp.microsoft.com.

>> The DNS name server contacts the server in the microsoft.com domain with an iterative query for testcomp.microsoft.com.

The DNS name server responds to the client query with the IP address for testcomp.microsoft.com.

Troubleshooting Hostname Resolution Problems
The following commands can be used to diagnose hostname resolution problems:

>> NETDIAG (found in the Windows 2000 Resource kit) ensures that communications are working correctly with the client's configured DNS server. It also verifies that network connectivity is functioning correctly.

Home Office Application
Your Home Setup Is As Follows:

>> There is a Windows 2000 Server sharing a connection with the Internet.

>> Access to hosts on the Internet is failing.

SCENARIO
Like everyone else, you work too much and have set up an office in your

home. There is a TCP/IP network internal to your house that connects all the PCs and laptops you have to make one network. You are running Windows 2000 Server on one of the systems, which acts as a gateway, and it is sharing a connection to the Internet through a local cable company. Your laptop is running Windows 2000 Professional with TCP/IP configured by DHCP. You normally connect to your company VPN server via the cable modem and from there, to the Internet in general. Today, you find that you cannot access your favorite search engine Web page.

ANALYSIS
There are a number of network interfaces that are being used in this case study. The first is the TCP/IP configuration of the Windows 2000 Professional computer that is trying to access the search engine home page. The TCP/IP configuration for this computer will be DHCP-enabled and point to the internal domain hosted by the Windows 2000 Server system. The Ipconfig /all display should show a DHCP enabled connection with the IP address in the range 192.168.0.x (the default address assigned by the server) with a gateway address that points to the Windows 2000 Server computer. In addition, the domain name should be the domain that was set up when the Windows 2000 Server was installed. If any of these values are missing or incorrect, the following commands refresh the configuration:

Ipconfig /release
Ipconfig /renew

The second network interface is on the Windows 2000 Server. This system has two network adapters: one on the inside network and one on the outside. When this system was installed, that distinction was made and Connection Sharing was enabled on the outside connection. The Ipconfig /all display should show two connections: an inside connection that has a static IP address (usually 192.168.0.1) and an outside address that is usually configured as DHCP-supplied. The local cable company would normally supply the outside address when the cable modem became active on its network. As with the Windows 2000 Professional system, the following commands refresh the configuration provided by the cable company (if using automatic TCP/IP configuration):

Ipconfig /release
Ipconfig /renew

The third network interface is the VPN connection between the Windows 2000 Professional computer and the VPN server in your corporation. That connection is established on the Windows 2000 Professional machine through the gateway server (the gateway server does not need a connection itself). This appears as a new network entry on your Windows 2000 Professional computer with an IP address from your corporate network. In addition, DNS and WINS entries are assigned from your corporate network and they should be displayed by the Ipconfig /all command.

The first thing to try after reviewing all the configurations is pinging your gateway. From the Windows 2000 Professional computer, that would be the Windows 2000 Server system. If that works, try to ping an outside host (such as your search engine home page) from the Windows 2000 Server. If that works, but it does not work from the Windows 2000 Professional computer, the problem is in the Connection Sharing setup. Removing the configuration and reinstalling it on the server will correct any problem.

The next thing to try is tracing the route that packets take to a known outside host (the search engine home page again). From the Windows 2000 Professional computer enter the following command, where <host name> is the search engine hostname:

Tracert <host name>

Tracert traces the hops (routers) that a packet must take to get to the destination. If it gets to the destination, your problems are solved. If it can't display a router name and shows only IP addresses, the problem is in the DNS servers provided by your cable company. If you get to your corporate network routers (as identified by the IP address ranges) but you don't get from there to the destination, the problem is in your corporate DNS servers or gateway or the configuration provided when you logged in to the VPN server. Logging out and logging back in refreshes this configuration and solves the problem. If the problem persists, the error is likely on your corporate network and a call to tech support is in order.

Summary
The main topics of implementing, managing, and troubleshooting network protocols and services have been discussed. The essence of these topics is to understand the components of networking with emphasis on TCP/IP and the role that each component plays in successfully connecting to a network. In addition, the chapter also highlighted two other points not addressed by the objectives, but which you may be tested on:

>> The steps taken to perform name resolution in TCP/IP (primarily to help you analyze the problem occurring when all you have to work with is a null response)

Also covered were the various configurations available for accessing outside networks, including multilink, access to private RAS servers, connections to the Internet, and VPN connections through the Internet to secure servers on your corporate network.

Key Terms

>> IPX/SPX

>> DNS

>> DHCP

>> IPSec

Additional Troubleshooting Tools
There are also some Windows 2000 tools that can be used to aid in TCP/IP network troubleshooting:

>> Event Viewer tracks errors and events.

>> Performance Monitor analyzes TCP/IP network performance.

Review Questions
You have two networks that use the NetBEUI protocol. You connect the two networks with a router, but the computers on the different networks can't connect to one another. What is wrong?

1. You have installed NWLink IPX/SPX Compatible Transport protocol on your computer, but you can't establish a session with the NetWare file server. What other component do you need to install?

2. What command should you use to redirect port LPT1: to a printer named HP5 on a server named PRINTSERVE?

3. When do you need to install a default gateway on a computer configured with TCP/IP?

4. You have a computer configured for IPX and you can't make a connection to a UNIX computer running SLIP. What is the problem?

5. You have an older network adapter card that had drivers only for Windows for Workgroups. Can you use it with Windows 2000 Professional?

6. What are network bindings?

7. How many network adapter cards can you put into a single Windows 2000 Professional computer?

8. You have manually configured a TCP/IP connection with a subnet mask of 255.255.255.252 but find that you can't connect to any other computers on your network. What is the problem?

Review Answers

1. NetBEUI is not normally supported by routers. Either configure your router to support NetBEUI or switch your network protocol to IPX or TCP/IP. See "NetBIOS Extended User Interface (NetBEUI)." NWLink is not sufficient to access file shares and print services on a NetWare server. You must also install CSNW. See "NWLink IPX/SPXs Compatible Transport."

2. Use the command Net Use LPT1:\\PRINTSERVE\HP5. See "The NET USE Command."

3. You need to install a default gateway when your TCP/IP-configured computer needs to communicate with a computer located on a different physical network or subnetwork. See "Default Gateway (Router)."

4. SLIP does not support IPX or NetBEUI. SLIP stands for Serial Line Internet Protocol and supports only encapsulating TCP/IP. See "Serial Line Internet Protocol (SLIP)."

5. Windows 2000 Professional does not support any 16-bit devices. You must use a device driver written to support Windows NT or Windows 2000. See "NDIS-Compatible Network Adapter Card Drivers."

6. Network binding is the association of a network adapter card to a protocol being used. See "NDIS 5.0."

7. Windows 2000 Professional supports an unlimited number of network adapters. The number of network adapter cards that you can install in your computer, however, will be the limiting factor. See "NDIS 5.0."

8. The subnet specified has only two nodes on it. With such a restricted subnet, every address other than the one remaining address on your subnet would be considered remote. The other local address must therefore be a router if you are to communicate with any remote systems at all. This configuration is usually used for router connections; however, it is not very useful when connecting computers. See "Subnet Mask."

Suggested Readings and Resources

MCSE Training Kit Networking Essentials Plus (It-Training Kit) - by Microsoft Corporation

OSI Reference Model for Telecommunications - by Debbra Wetterot

OSI Reference Model Pocket Guide - by Howard C. Berkowitz

MCSE/MCSA Windows Server 2003 Environment Study Guide (Exam 70-290) - by Anil Desai, Tim Green (Editor)

Microsoft Windows 2000 Server Resource Kit - by Microsoft Corporation

IT Papers.com -
Links to over 20,000 white papers on practically every topic. This site is "The Yellow Pages of White Papers".

Learn to Subnet -
A Free Lecture-based Educational Course on IP Addressing and Subnetting. Excellent resource!

| Microsoft TechNet | Technet Site Map|
This should be your No. 1 technical resource Link to the Microsoft site

| Binary Primer- 1 | Binary Primer- 2 |
Help for Manipulating binary numbers

IP Routing Primer

Networking & Computer Professionals Resource Center
An internetworking reference resource

Search Networking
The Networking Specific Search Engine - A techtarget.com community

IT Encyclopedia

Windows NT/2000 FAQ -
Answers to frequently asked questions about Windows NT, Windows 2000, SQL Server, Exchange Server and Outlook, IIS and more! Brought to you by John Savill and the Windows & .NET Magazine Network.

Windows IT Library

Webopedia
The only online dictionary and search engine you need for computer and Internet technology.