MCSE Core Required Exams in a Nutshell: The required 70: 290, 291, 293 and 294 Exams (In a Nutshell (OReilly))

5.6. Maintaining a Network Infrastructure

In the Exam 70-290 Study Guide and throughout this study guide, I've discussed techniques for maintaining network infrastructure. Rather than repeat what's already been discussed, I'll give you specific pointers you can use to extend the earlier discussions and to ensure that you understand the skills required to maintain a network infrastructure.

5.6.1. Monitoring Network Traffic

Windows Server 2003 includes several tools for monitoring network traffic. Some of the most basic of these tools are often the most effective:

• Using Task Manager's Networking tab, you can determine the current utilization of each network adapter installed on a server.

• Using System Monitor in the Performance console, you can view current networking activity using the Network Interface performance object. Each adapter instance can be tracked separately.

• Using Performance Logging, you can track networking activity over a period of time to determine performance bottlenecks.

With System Monitor and Performance Logging, you'll find the following counters of the Network Interface object useful in troubleshooting:

Packet Outbound Discarded

Tracks the number of outbound packets discarded even though they did not contain errors. Packets may have been discarded to free buffer space.

Packet Outbound Errors

Tracks the number of outbound packets that could not be transmitted because of errors.

Packet Received Discarded

Tracks the number of inbound packets discarded even though they did not contain errors. Packets may have been discarded to free buffer space.

Packet Received Errors

Tracks the number of inbound packets that contained errors that prevented them from being used.

Windows Server 2003 includes Network Monitor for monitoring and logging network activity. You install Network Monitor by completing the following steps:

1. Open Add Or Remove Programs in the Control Panel.

2. In the Add Or Remove Programs window, click Add/Remove Windows Components.

3. Click Management And Monitoring Tools and then select Properties. Be careful not to clear the checkbox.

4. Select Network Monitor Tools and then click OK.

5. Click Next. Setup configures the server's components.

6. Click Finish.

Network Monitor includes the Network Monitor Driver for capturing frames received by and sent to a network adapter and the Network Monitor console for viewing and analyzing data captured by the Network Monitor Driver. To open the Network Monitor console, click Start Programs Administrative Tools Network Monitor. The first time you start Network Monitor, you must select the network on which you want to capture data. Click OK when prompted. In the Select A Network dialog box, expand the Local Computer node, select the network adapter that is connected to the network to monitor, and then click OK. If you need to change the monitored network, click Capture Networks.

After you select a network, Network Monitor connects to the network but does not begin capturing data until you click Capture Start. Once you start capturing data, Network Monitor displays captured data as shown in Figure 5-50.

The Network Statistics and Captured Statistics provide summary data about frames passed on the network. You can use this information to watch for excessive broadcasts and excessive packet loss as compared to the total number of frames.

Network utilization bar graphs show the percentage of network utilization as well as the number of frames, bytes, broadcasts, and multicasts per second. If the percentage network utilization is consistently more than 50 percent of the total capacity, the network may have capacity bottleneck.

To view the details of the capture data, you must click Capture Stop And View. In View mode, Network Monitor displays all of the frames captured in a summary window. You can examine a specific frame by double-clicking the related entry. You can switch between the network window and the summary window using the options of the Window menu.

If you are looking for a specific type of frame, you can specify a capture filter. To define a capture filter, click Capture Filter.

If you want to monitor the network traffic and receive an alert when a specific condition is met, you can use a capture trigger. To define a capture trigger, click Capture Trigger.

5.6.2. Troubleshooting Connectivity to the Internet

Throughout this study guide, I've provide specific tips for troubleshooting various aspects of networking. For TCP/IP configuration issues, see "Troubleshooting TCP/IP Addressing," and or troubleshooting remote access, see "Troubleshooting User Access to Remote Access Services," both earlier in this chapter.

5.6.3. Troubleshooting Server Services

Windows Server 2003 includes many processes that run when you start the operating system. Each of these processes performs a specific task. Most manageable tasks run as services. Depending on the operating system components installed on a server, there can be any where from a few dozen configured services to many dozens of configured services.

5.6.3.1. Diagnosing and resolving issues related to service dependency

You can view the currently configured services using the Services utility in Administrative Tools. In Computer Management, expand the Services And Applications node and then select Services to see the configured services.

Services can be in one of three possible states: started, paused, or stopped. If the service is running, the status is listed as Started. If the service is stopped, the status is listed as blank. If a service can be paused, as indicated by the availability of the Pause option, the status is listed as Paused if you or another administrator has paused the service.

The actions you can perform depend on the run state of the service and whether a service can be paused. You can start or stop a service by clicking it, and then clicking the Start or Stop button as appropriate. You can stop and then restart a service by clicking Restart. You can pause a service by clicking Pause, and then resume the service by clicking Pause again.

The startup type of a service determines whether and how a service is started. The startup type can be set to the following:

Automatic

The service starts automatically with the operating system.

Manual

The service does not start automatically with the operating system. Instead, the service can be manually started if it is called by another process.

Disabled

The service does not start automatically and also cannot be started manually until it is enabled.

Some services depend on other services in order to start. If a service depends on other services, it can only start when those services are running. Because some low-level services are the dependencies of multiple high-level services, a single low-level service that doesn't start properly can have a cascading effect on a server.

Before you stop a service, it is a good idea to determine which services depend on it. If a service isn't running and it should be, the reason might be that a dependent service isn't running. To view a service's dependencies, follow these steps:

1. Open Computer Management. Expand the Services And Applications node, and then select Services.

2. Double-click the service, and then select the Dependencies tab. Dependent services are listed as shown in Figure 5-51.

   Figure 5-51. Viewing dependent services.

3. If the services on which the currently selected service depends in turn depend on other services, you can view those dependencies by expanding the service node in the list provided.

4. If other services depend in this service, they are listed in the lower panel.

5.6.3.2. Using service recovery options to diagnose and resolve service-related issues

Service recovery options allow you to specify the actions that should be taken if a service fails. For example, you could attempt to restart the service or run an application.

The operating system can take one of four actions should a service fail. These actions are to:

• Take no action

• Restart the service

• Run a program

• Restart the computer

You can configure recovery options for a service by completing the following steps:

1. Open Computer Management.

2. Expand the Services And Applications node, and then click Services.

3. Right-click the service you want to configure, and then choose Properties.

4. Select the Recovery tab.

5. Configure recovery options for the first, second, and subsequent recovery attempts. If you elect to run a program, set the full file path to the program you want to run and then set any necessary command-line parameters to pass in to the program when it starts.

6. Click OK.

With Windows Server 2003, many services have recovery options set, so restart the service automatically should it fail. Event Log, Protected Storage, Plug And Play, NT LM Security Support Provider, and Security Accounts Manager service will restart the computer if the service fails, and this configuration cannot be changed.