Hello, my name is Matthew McAnally. And in these lessons, you will learn about "Built-in Windows Tools, Wireshark, and NetFlow". So I'm gonna be showing you how to do these built-in commands on command prompt. Command prompt is a natively installed command line tool, formally was the MS-DOS prompt and analysis called command prompt. Newer version is now called PowerShell, which is also used with Windows Home PowerShell language, but it can still be used for all of the basic command prompt tools here. So one of the more commonly used ones is called ping. So ping allows us to try and get connectivity to a certain website, and it will tell us what the IP address is of that website. So we'll do ping and we see here are again, our IP address of Knowledge City, however, request is timed out. Now you're gonna get this from time to time. A lot of times, websites or companies will block inbound ping traffic. It is their security measure on there because with the ping command, you can specify the size of the packet and you can flood it with ping. You can do a ping dash T. This ping will go on forever until you kill the process. And the reason why you would do that is, you know if you're doing some networking work and you wanna make sure you always have connectivity to a certain site or to the internet, or to a certain server, you're gonna want this. Another powerful tool for ping is the reverse DNS lookup. So again, ping dash A and the IP address that we're going to ping is this guy right here. And here, we see that the IP address belongs to knowledgecity.com. Now another commonly used one is NS lookup. So NS lookup will tell us everything there is that Windows can find out about a certain website. They could tell us what the IP address is, tells us that the IP address of knowledgecity.com is what we found right there in ping. We could also put in the IP address in here and we see that again, through our DNS servers, that the IP address belongs to knowledgecity.com. Now, let's say, I changed the DNS server, so if I change this to level 3s and I put in the IP address here, we see level 3 detects the IP address as being part of AWS. Now, both answers are correctness aspect. Knowledge City, I believe, is hosted off of Amazon AWS, is this is just what level 3 is detecting, this IP address is belonging to. Meanwhile, my DNS server is detecting this IP address belonging to Knowledge City. Now, let's say, we wanna get more information and we see what we get with knowledgecity.com. And here, we're going to get the DNS records here. So Knowledge City, for example, uses a primary name server of DNS Made Easy, tells us what the TTLs are, the serial, the refresh rates, all that good stuff. Another thing we could do is just type in the IP address and see what we get. Now, this is going to give us a little less information here. Well, it's basically going to give us the same information, but just reverse order here. So here, it's going to tell us more specifically, you know, what my WAN address is and how it's trying to connect. And it's detecting that the IP address belongs to Amazon AWS. Nothing too complicated on here, but still is a very, very useful tool. Another one is trace route. So we're going to get two different types of information here. Two different ways of approaching trace route. One is going to be from Windows. So Windows, you do tracert and let's say, we wanna do trace route to 4.2.2.2. We see it's going go to the router and then it's going to reach 4.2.2.2. Well, that's because this PC doesn't have direct access to the internet, my router does. So yeah, it's reaching it, but it's ending here because of NATing. So from my router here, which is a ordered device, we do a trace route. And from here, I could do 4.2.2.2. I could also do other options at source. I could set numeric numbers. Now, one thing I don't like doing now on Cisco here is if I just press enter here, what's going to happen is I'm going to go through all 30 hops, which is a default number. And this could actually take, like a good, like two or three minutes. And yeah, there's a way to escape it, but I always have a hard time doing escape. So I normally do this. You trace route IP, source address, I just leave as a default, display, time out seconds, probe count, time to live, maximum time to live. Let's set this to like, five. By the way, trace route, it's a ICMP request and I think you can also set to use UDP, just so everyone's aware, or both, just to get a little bit more information. And right here, we see it dies after five because I specified five. If I put 10, it'll go on till 10. But we see here how it's all going out. Now, seeing the stars here, and it's nothing to be concerned about because that just means that that next device here is not accepting the trace route command. It's like blocking it. It is just a security measure on here, but we see here is going over to next hops. Again, this just means that these are all like equal costs. Well, this could mean like equal-cost routing or it could mean like, maybe there's, without getting too technical, like VRRP or HSRP on here where it's basically one of these is a virtual IP address and the other one's the physical IP. We see here, it's going out to Alter.net. It's gonna continue going on. If I were to do a full amount here, so just to show everyone, we see trace route, it's going through all these stars here. Then it's going over these basic IPs it's going over to Alter.net. And one good aspect of this is if let's say, it died out on four, it just kept dying out, we know where the issue is. The issues would be in Alter.net. Now, I could tell you that from my own experience, that if the issue with a client reaching on a destination server with destination website or web application, I should say, is something to do with the intermediary ISP. So one of the next hops, not the actual hosting ISP, which you know, would be like level 3 or my ISP, which is Verizon is one of these. This becomes very, very difficult to troubleshoot because you don't have access to contact Alter.net. The vendor doesn't have access to contact Alter.net. You have to get in touch with your ISP and your ISP then has to open up a ticket with that other ISP to try and resolve the issue, because the issue has to do with routing on their end. And you might get lucky. It might get resolved in a day, it might get resolved in a week, it might resolve on its own, or might never get resolved. It really depends on the tech you're dealing with and the tech on the other end. That's it for this lesson. Thank you for listening.
