Practical 4: Windows Commands and Network Utilities

===== SOURCE: Prac4_EH.pdf =====

Practical No.4
—------------------------------------------​
Step 1: Find the Computer Name

What it does: Displays the specific name of your computer as it is identified on your
local network.
Why it is useful: When troubleshooting network issues, mapping network drives, or
trying to connect to a specific machine remotely, you need to know its exact network
identifier.




Step 2: Display Windows Version

What it does: Short for "version," this outputs the specific version and build number
of the Windows Operating System currently running.
Why it is useful: It helps verify if your system is fully updated, which is important for
security patching or checking if your OS meets the minimum requirements to install
specific software.




Step 3: Display Detailed System Information

What it does: Pulls a comprehensive, readable summary of your computer’s hardware
and software configuration. This includes the OS version, system boot time (uptime),
computer manufacturer, processor details, total RAM, and a list of installed Windows
updates (hotfixes).
Why it is useful: It acts as a one-stop command for gathering foundational diagnostic
information about a PC without needing to click through multiple graphical menus.




Step 4: Display Network Configuration


What it does: Displays the complete network configuration for all network adapters
(Wi-Fi, Ethernet, virtual adapters) on your machine. The /all switch reveals details
beyond just your basic IP address, including your MAC address (Physical Address),
DNS servers, and whether DHCP is enabled.
Why it is useful: This is the most essential command for troubleshooting internet or
local network connectivity issues.
Options


ipconfig/flushdns : command used to clear the DNS
cache on a Windows computer, helping to resolve
network connectivity issues by discarding outdated
ipconfig/registerdns : command that refreshes and
updates the DNS (Domain Name System)
registration for a computer's network interface.
                     (Perform in administrative mode)




 ipconfig/release : command that releases the
IP address assigned to a network interface.
ipconfig/renew : command used to renew the IP
address assigned to a computer or network
interface.




Step 5: Find Logged-in User

What it does: Displays the exact username and domain of the user currently logged
into the active command prompt session.
Why it is useful: In corporate environments, servers, or home PCs with multiple
accounts, this confirms exactly which user profile (and associated security
permissions) you are operating under.
Step 6: View Running Processes


What it does: Generates a list of all currently running applications and background services.
It shows the image name (e.g., chrome.exe), its unique Process ID (PID), and how much
system memory it is currently consuming.
Why it is useful: It is the command-line equivalent of the Windows Task Manager. It helps
identify frozen programs, rogue background processes, or applications that are eating up
system resources.




Step 7: View Active Network Connections


What it does: Displays active network connections and listening ports on your machine.

   ●​ -a: Displays all active connections and listening ports.
   ●​ -n: Displays addresses and port numbers in numerical form (speeding up the
      command by skipping DNS lookups).
   ●​ -o: Includes the Process ID (PID) responsible for each connection.

Why it is useful: It is a crucial tool for security and network monitoring. If you suspect
malware or unauthorized access, this shows exactly what external servers your computer is
talking to, and allows you to trace that connection back to a specific program using the PID.




2. Netstat and its options.
Description :
● Stands for network statistics
● Monitors incoming and outgoing network
connections.
● Helps in network troubleshooting and performance
measurement.
Options :
● netstat-a : enlists all active network connections and
listening ports.
netstat -s: Give statistics of all the ports
netstat-r : giveskernel routingtableand information
regarding it.
netstat-i : gives list of networking interface.
netstat-f : Displays Fully Qualified Domain Names
(FQDN) for foreign addresses.
Step 8: Display ARP Cache

What it does: Displays the Address Resolution Protocol (ARP) cache. This table maps
IP addresses (like 192.168.1.5) to physical device MAC addresses (like
00-14-22-01-23-45) for devices on your immediate local network.
Why it is useful: It maps out the devices currently communicating with your PC on the
local network, which is useful for diagnosing local connection drops, finding hidden
devices, or identifying IP conflicts.
Step 9: Display Routing Table


What it does: Displays the IP routing table for your computer. This table contains the rules
that dictate exactly where network traffic should be sent based on its destination IP address.
Why it is useful: Primarily used by network administrators, it helps diagnose complex
networking issues, such as figuring out why you can reach a local network printer but cannot
access the internet, or verifying that a VPN is routing your traffic correctly.
Step 10: Display Shared Folders


What it does: Lists all the folders, storage drives, and printers on your computer that are
currently configured to be shared with other users on the network.
Why it is useful: It allows you to quickly audit what resources you are making publicly
accessible to other network users, ensuring you aren't accidentally sharing sensitive data or
exposing your file system unnecessarily.
3. ping
Description :

● Stands for Packet Internet Groper.
● Checks if source device is connected to
destination device.
Options :
● ping -i : Change the interval between two ping
packets. Default interval is 1ms. It can be
   increases or decreased by using this option by
   giving values greater than 1 and less than 0
                        respectively (-i 2 or -i 0.5)




ping -s : Change the packet size while
communication. Default size is 56 bytes + 28 bytes
header (84 bytes)




ping- c : Limit the number of ping packets being sent.
Thus, if we give -c 2, transmission stops after
transmitting 2 packets. (run on administrative
                         mode)
ping -w : sets time (in seconds) for the
  transmission after which transmission stops.




4. Tracert

Description :
● Stands for trace route.
● Shows details about the path that data packets
follow from the source to the destination.
Options :
● Tracert -h : Specify a number after -h and only 2 hops
taking to trace the route of data packets will be displayed.




● Tracert -w : specify the time (in milliseconds) to allow reply
before time out.
● Tracert – 4 : Forces tracert to use only ip4 addresses for
transmission.
8. Gpupdate
Description :
● Updates Group Policy settings manually.
Example: gpupdate /force.




9. Chkdsk
Description :
● Checks a disk for errors and attempts to fix
them.
Example: chkdsk C: /f
Tool : Network Miner

Use:

NetworkMiner is an open-source Network
Forensic Analysis Tool (NFAT). While tools like
Wireshark are designed to look at network
traffic packet-by-packet, NetworkMiner is
designed to be
​