As a consultant, I've spent many years helping clients with hardware, software, and network problems. The most common—and frustrating—way people report a problem is to say “I can't…” or “The computer won't…” Usually, knowing what doesn't happen isn't very helpful at all. To solve a mystery, you have to start with what you do know. I always have to ask “What happens when you try?” The answer to that question usually gets me well on the way to solving the problem. The original report usually leaves out important error messages and symptoms that might immediately identify the problem.

Also, as you work on a problem, pay as much attention to what does work as to what doesn't. Knowing what isn't broken lets you eliminate whole categories of problems. It also helps you to see whether a problem affects just one computer or all the computers on your local area network (LAN).

The following are some other questions I ask:

These questions can help you determine whether the problem is fundamental (for example, due to a nonfunctioning network card) or interactive (that is, due to a conflict with other users, with new software, or confined to a particular subsystem of the network). You might be able to spot the problem right off the bat if you look at the scene this way. If you can't, you can use some tools to help narrow down the problem.

Generally, network problems fall into one or more of these categories:

If you can determine which category a problem falls in, you're halfway there. At this point, diagnostic tools and good, old-fashioned deductive reasoning come into play.

You might be able to eliminate one or more categories right away. For example, if your computer can communicate with some other computers but not all, and your network uses a central hub, you can deduce that at least your computer's network card and the wiring from your computer to the hub are working properly.

Windows comes with some diagnostic tools to further help you narrow down the cause of a network problem. In the rest of this chapter, I'll outline the tools and suggest how to use them. (You might also peruse Chapter 14, “Troubleshooting Your Internet Connection,” for tips on diagnosing network problems specific to the Internet [TCP/IP] protocol.)

You might not think of it as a diagnostic tool, but My Network Places can be one. It can quickly tell you whether your computer can communicate with any other computers on your LAN using Windows's file and printer sharing client services. If at least one other computer is visible and online, then you can be pretty sure that your computer's network card and cabling are okay.

To use it, open My Network Places, and then open View Workgroup Computers or View Entire Network from the Network Tasks list. Delve into either of these folders to see if you can find any computers listed.

If you see at least one other computer displayed here, your network cabling and network card are probably okay, and you need to check to be sure that each computer on your network has the same set of network protocols installed; skip down to “Network Protocols and Bindings” later in this chapter. If no other computer appears, My Network Places won't tell why, so you have to begin the process of diagnosing connectivity and/or higher-level problems. The next place to go is the Event Viewer, which might have recorded informative error messages from network components.

The Event Viewer is another very important diagnostic tool, one of the first to check, as Windows often silently records very useful information about problems with hardware and software in its Event Log. To display the Event Log, click Start, right-click My Computer, select Manage, and select the Event Viewer system tool. (Alternatively, if you've added Administrative Tools to your Start Menu, you can choose Start, All Programs, Administrative Tools, Event Viewer.)

On the left pane, select the System, Application, and Security logs in turn. The Event Viewer displays Event Log entries, most recent first, on the right (see Figure 22.1).

Figure 22.1. The Event Viewer might display important diagnostic information when you have network problems. View the System, Application, and Security logs in turn.

Log entries for serious errors are displayed with a red X in a circle; warnings appear with a yellow ! in a triangle. Informational entries (marked with a blue i) usually don't relate to problems. Double-click any error or warning entries in the log to view the detailed description and any associated data recorded with the entry. (The Error entries in Figure 22.1 told me that my computer had the same name as another computer on the network: problem solved!)

These messages are usually quite significant and informative to help diagnose network problems; they may indicate that a network card is malfunctioning, that a domain controller for authentication or a DHCP server for configuration can't be found, and so on. The Source column in the error log indicates which Windows component or service recorded the event. These names are usually fairly cryptic. A few of the more common nonobvious ones are listed in Table 22.1.

If you're at a loss to solve the problem even with the information given, check the configuration of the indicated component, or remove and reinstall it to see whether you can clear up the problem.

Hardware problems with your network card will most likely be recorded in the Event Log. If you suspect that your network card is the culprit, and nothing is recorded in the Event Log, check the Device Manager.

To use it, click Start, right-click My Computer, select Manage, and choose the Device Manager system tool. Any devices with detectable hardware problems or configuration conflicts appear with a yellow ! icon when you display the Device Manager. If no yellow icons appear, you don't have a detected hardware problem. This doesn't mean that you don't have any, but the odds are slim that your network card is the problem.

If devices are shown with ! icons, double-click the device name to see the Windows explanation of the device status and any problems. A device that you've told Windows not to use (disabled) will have a red X on it; this is generally not a problem.

If your computer can't communicate with other computers on your LAN, after you check the Event Log and Device Manager, use the ipconfig command-line utility to see whether your computer has a valid IP address. Check others on the LAN, too, to ensure that they do as well.

At the command prompt (which you open by choosing Start, All Programs, Accessories, Command Prompt), type the following command:

ipconfig /all

The results should look something like this:

Windows IP Configuration
        Host Name . . . . . . . . . . . . : AMBON
        Primary DNS Suffix  . . . . . . . : mycompany.com
        Node Type . . . . . . . . . . . . : Broadcast
        IP Routing Enabled. . . . . . . . : Yes
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : mycompany.com

Ethernet adapter Local Area Connection:
        Connection-specific DNS Suffix  . : mycompany.com
        Description . . . . . . . . . . . : Realtek RTL8139(A) PCI Fast Ethernet Adapter
Physical Address. . . . . . . . . : 00-C0-CA-14-09-7F
        DHCP Enabled. . . . . . . . . . . : No
        IP Address. . . . . . . . . . . . : 202.201.200.166
        Subnet Mask . . . . . . . . . . . : 255.255.255.224
        Default Gateway . . . . . . . . . : 202.201.200.190
        DNS Servers . . . . . . . . . . . : 201.202.203.72
                                            201.202.213.72

The most important items to look for are the following:

Each computer on the same LAN should have a similar valid IP address and the same network mask. If they don't, check your network configuration. The “Repair” network task may also be used to help fix problems with DHCP-based (automatic) IP address assignment.

Windows XP features a Network Troubleshooting Wizard that can check for some common network setup problems. Sadly, it holds more promise than good advice. I suggest that you do give it a try, because one of these days it might surprise us all and propose a solution that actually fixes the problem.

To run it, click Start, My Network Places. From the Network Tasks list select View Network Connections. Then, under See Also, select Network Troubleshooter. The troubleshooter is shown in Figure 22.2. At the very least, it will walk you through some helpful, if generic, steps to diagnose your network.

Figure 22.2. The Network Troubleshooter can be reached from the Network Connections window.

netdiag is a comprehensive network connectivity and configuration diagnosis tool included with the Windows XP Professional Resource Kit, a set of extra utility programs and diagnostic tools sold by Microsoft. It's also provided as one of the optional Support tools on your XP installation CD.

To install it, browse your Windows XP installation CD, and double-click SUPPORTTOOLSSUPTOOLS.MSI. Be sure to select the Complete setup mode, as opposed to Typical. This will install a set of diagnostic and maintenance tools, including the netdiag program I'm about to describe.

To use netdiag, open a command prompt window and issue the command

netdiag >x & notepad x

This will run the diagnostic program and display the results with Notepad.

The output of netdiag is long—over 180 lines on my computer—because it tests quite a number of network subcomponents. Scroll through the output and look for tests marked Failed. They help point you toward fixing a network problem. You can get even more detailed information with the command

netdiag /v >x & notepad x

If you have a Windows 200x Server-based domain network, you should refer any failed tests in the Global Results section to your network administrator because they indicate problems with your computer's domain membership.

You can check your computer's identification and domain membership setup by using My Computer. To do so, right-click My Computer, select Properties, and view the Computer Name tab.

On a Windows Workgroup network, you should see your computer's name and the name of your workgroup. The workgroup name should be the same on all computers on your workgroup LAN. All of the computer names must be different.

On a Windows domain network, you should see your computer's name displayed as part of a Windows domain name (for example, my computer AMBON would be called AMBON.mycompany.com on a domain network) and the domain name. Your domain name might not include .com; in any case, though, all computers on the LAN should have the same domain name.

You can manually check all installed network protocols and services and their configuration by viewing Network Connections and viewing the properties for Local Area Connection. Confirm that each required protocol is installed and correctly configured. In general, the settings on each computer on your LAN should match, except that the IP address differs (usually only in the last of its four dot-separated numbers). If your LAN uses Automatic IP address configuration, you need to use the ipconfig command, which I described earlier, to check the settings.

One very common source of problems on Windows networks is a mismatch between the network protocols installed on the network's computers. This very often leads to the situation where the network is fundamentally okay, but the computers still can't “see” each other. It's especially common when the computers are running different versions of Windows.

On each computer that should be participating in file and printer sharing, view the Network Connections window, select the Local Area Connection icon (or Wireless Connection icon, if you have a wireless network), right-click it, and select Properties.

Each computer should have the same network protocol(s) installed, preferably just one, but possibly two or more of the following:

There should be a check mark to the left of the protocol so that it's bound (connected) to the network adapter.

(The procedure to check these protocols will be somewhat different for older versions of Windows.)

In any case, if some of the computers have a different protocol or mix of protocols installed, Windows will have a hard time getting the computers to communicate with each other. (Mixing protocols isn't the problem. Bugs in the Windows “browser” service since 1995 have never been fixed.)

If your network is okay at the electrical level (that is, if the ping test described in the next section works, and Internet connection sharing works), and you have computers running Windows 95, 98 or Me, but you still can't find all of your computers in the View Entire Network display, try installing NetBEUI on all of the computers. NetBEUI can be installed on Windows XP by following the procedure described in VALUEADDMSFTNETNETBEUINETBEUI.TXT on your Windows XP installation CD-ROM.

Another configuration setting that could prevent File and Printer sharing from working correctly is the Windows Firewall. To ensure that File and Printer sharing aren't blocked, open the Windows Firewall window by opening the Network Connections window and clicking Change Windows Firewall Settings. On the General tab, be sure that Windows Firewall is enabled (On is checked), and Don't Allow Exceptions is not checked. View the Exceptions tab, and be sure that there is a check next to File and Printer Sharing. Highlight File and Printer Sharing and click Edit. Be sure that the Scope for each of the four listed items is set to Subnet.

ping is a fundamental tool for testing TCP/IP network connectivity. Because most Windows XP Professional networks use the Internet (TCP/IP) protocol for file and printer sharing services, as well as for Internet access, most Windows XP Professional users can use the ping test to confirm that their network cabling, hardware, and the TCP/IP protocol are all functioning correctly. ping sends several data packets to a specified computer and waits for the other computer to send the packets back. By default, it sends four packets and prints the results of the four tests.

To see whether the network can carry data between a pair of computers, use the ipconfig command (described previously) to find the IP address of the two computers. Then, on one computer, open a Command Prompt window by choosing Start, All Programs, Accessories, Command Prompt.

Next, type the following command:

ping 127.0.0.1

This command tests the networking software of the computer itself, by sending packets to the special internal IP address 127.0.0.1; this test has the computer send data to itself. It should print the following:

Reply from 127.0.0.1: bytes=32 time<10ms TTL=128
Reply from 127.0.0.1: bytes=32 time<10ms TTL=128
Reply from 127.0.0.1: bytes=32 time<10ms TTL=128
Reply from 127.0.0.1: bytes=32 time<10ms TTL=128

If it doesn't, the TCP/IP protocol itself is incorrectly installed or configured; check the computer's IP address configuration, or, if that seems correct, remove and reinstall the Internet Protocol from Local Area Connection in Network Connections. (I have to say, in more than 10 years of working with PC networks, I've never seen this test fail.)

If your computer can send data to itself, try another computer on your LAN. Find its IP address by running ipconfig on that computer, and then issue the ping command again on the first computer, as in this example:

ping 192.168.0.23

Of course, you should use the other computer's real IP address in place of 192.168.0.23. You should get four replies as before:

Reply from 192.168.0.23: bytes=32 time<10ms TTL=32
Reply from 192.168.0.23: bytes=32 time<10ms TTL=32
Reply from 192.168.0.23: bytes=32 time<10ms TTL=32
Reply from 192.168.0.23: bytes=32 time<10ms TTL=32

These replies indicate that you have successfully sent data to the other machine and received it back.

If, on the other hand, the ping command returns Request timed out, the packets either didn't make it to the other computer or were not returned. In either case, you have problem with your cabling, network adapter or the TCP/IP protocol setup.

You can use ping to determine which computers can send to which other computers on your LAN or across wide area networks (WANs) or the Internet. ping works when given a computer's IP address or its network name.

In the right pane of the Performance console, you can add an item to the graph of performance statistics like this:

The Performance Monitor then graphs the amount of data traffic on your network connection or connections and the plot is updated as you watch. Now you can visually monitor the traffic on your network.

To remove counters from the Performance graph, you can select the items in the legend below the graph and click the X icon at the top of the graph. Alternatively, you can right-click the graph and select Properties; next, select the Data tab, select Counters, and then click Remove.