Practical Lab: Windows Networking Tools

Objective

Find out how networking is set up on your own PC: the adapter and its driver, the addresses, the DNS cache, the routes, the connections, the services and the network profile. You only look. Nothing in this lab changes a setting (one optional step empties the DNS cache, which is harmless).

Time: 25–30 minutes
You need: A Windows PC that is connected to a network. No extra software.

What to Open

Part 1: My Adapter and Its Driver

In PowerShell:

Get-NetAdapter

1. Name of my active adapter (Status = Up): ________________
2. InterfaceDescription (model): ________________
3. LinkSpeed: ________________
4. MacAddress: ________________

Now the driver details:

Get-NetAdapter | Format-List Name, InterfaceDescription, DriverVersion, DriverDate, DriverFileName, NdisVersion

5. DriverVersion and DriverDate: ________________
6. DriverFileName (the miniport file): ________________

In Device Manager, open Network adapters, double-click your adapter, and open the Driver tab. The version and date should match.

7. How many adapters are listed under Network adapters? How many look virtual (Hyper-V, VPN, "WAN Miniport", loopback)? ________________

Part 2: My Addresses (ipconfig /all)

In Command Prompt:

ipconfig /all

Find your active adapter and fill in:

8. IPv4 Address: ________________
9. Subnet Mask: ________________
10. Default Gateway: ________________
11. DHCP Enabled / DHCP Server: ________________
12. Lease Obtained and Lease Expires: ________________
13. DNS Servers: ________________

If your IPv4 address starts with 169.254, DHCP did not answer (Section 6.2).

PowerShell gives the same facts in short form:

Get-NetIPConfiguration
Get-NetIPAddress

Do not run ipconfig /release or /renew in this lab: they disconnect you briefly.

Part 3: DNS (nslookup and the Cache)

nslookup example.com

14. Server (which DNS server answered): ________________
15. Address(es) returned: ________________

Now the Windows cache:

Get-DnsClientCache | Select-Object -First 10

16. Name one entry and its TTL (time left): ________________

Optional: ipconfig /flushdns (or Clear-DnsClientCache) empties the cache. It is safe: the next page you open just does a fresh lookup. Run Get-DnsClientCache again and see how short the list is.

Resolve-DnsName example.com

17. Does the address match what nslookup showed? ________________

Part 4: Routes and Neighbors

route print

18. Find the row with Network Destination 0.0.0.0 and Netmask 0.0.0.0. Its Gateway is: ________________ (it should match your default gateway from Part 2).
19. What is its Metric? ________________

Get-NetNeighbor -AddressFamily IPv4 | Select-Object -First 10
arp -a

20. Is your gateway's IP in the list? What MAC is shown? ________________

Part 5: Connections (netstat -ano)

netstat -ano

21. Find one line with LISTENING. What port is it and what is its PID? ________________
22. Find one ESTABLISHED line. What is the remote address and port (443 means HTTPS)? ________________
23. Open Task Manager → Details, add the PID column (right-click header, Select columns), and find the program owning the PID from line 22: ________________

Then open Resource Monitor → Network tab and expand TCP Connections. Match a row with what you saw.

netstat -s

24. Find the TCP section. How many Segments Retransmitted? ________________

Part 6: Services and Firewall

Get-Service Dnscache,Dhcp,BFE,mpssvc,NlaSvc
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction
netsh advfirewall show allprofiles
netsh interface tcp show global

25. Are all five services Running? ________________
26. Which firewall profiles are Enabled? ________________
27. What is the default inbound action? ________________
28. What is the Receive Window Auto-Tuning Level? ________________

In Task Manager → Services, find the same services and compare their status.

Part 7: My Network Profile

Get-NetConnectionProfile

29. NetworkCategory (Public, Private, DomainAuthenticated): ________________

In Windows 11, open Settings → Network & internet → Wi-Fi (or Ethernet) → your network and look at the Network profile type. (In Windows 10, it is under Settings → Network & Internet → Properties.) Look only. Do not change it unless you really know the network.

Part 8 (Optional): Event Viewer

Open Event Viewer (Win + R, eventvwr.msc). Go to Applications and Services Logs → Microsoft → Windows → NetworkProfile → Operational. If entries exist, notice that Windows logs when it connects to a network. (The log may be empty or missing on some PCs.)

What Should Happen

• Part 1 shows a miniport driver, a version, a date and a link speed.
• Part 2 shows an IP address, gateway and DNS from DHCP, with a lease start and end.
• Part 3 shows the name turning into an address, and the cache holding recent names.
• Part 4 shows the default route pointing at your gateway, and the gateway's MAC in the neighbor list.
• Part 5 shows listening ports and established connections that match real programs.
• Part 6 and 7 show the services running and a profile that matches your network.

Interpretation Guide

Follow-Up Questions

1. In Part 2, which service gave you the IP address and DNS servers? In Part 6, did you see that service running?
2. Why can nslookup and the browser sometimes disagree?
3. In Part 4, why is the MAC in the neighbor list the gateway's MAC and not the website's?
4. In Part 5, why does the same PID appear on many connections?
5. Name three facts from this lab that you could not have learned from looking at the outside of the PC.