# Compaq TCP/IP Services for OpenVMS
Tuning and Troubleshooting

Previous | Contents | Index

This example shows how to display the routing tables with network addresses.

# nslookup

Queries Internet name servers interactively.

## Format

> nslookup [-option ...] [host_to_find | - [server] ]

### description

> The `nslookup` command is a program that is used to query Internet domain name servers. The `nslookup` command has two modes: noninteractive and interactive.

> Noninteractive mode

> Noninteractive mode is used to display just the name and requested information for a host or domain. Noninteractive mode is invoked when the name or Internet address of the host to be looked up is given as the first argument. The optional second argument specifies the host name or address of a name server.

> Interactive mode

> Interactive mode allows the user to query name servers for information about various hosts and domains or to display a list of hosts in a domain. Interactive mode is invoked when you specify `nslookup` without arguments (the default name server will be used), or when the first argument you specify is a hyphen (-) and the second argument is the host name or IP address of a name server.

> The options listed under the `set` command can be specified in the `.nslookuprc` file in the user's home directory if they are listed one per line. Options can also be specified on the command line if they precede the arguments and are prefixed with a hyphen (-). For example, to change the default query type to host information, and the initial time out to 10 seconds, enter the following command:

>     $ nslookup -query=hinfo  -timeout=10

> Interactive commands

> Commands can be interrupted at any time by pressing Ctrl/C. To exit, press Ctrl/D (EOF) or type `exit` . The command line length must be less than 256 characters. To treat a built-in command as a host name, prefix it with an escape character (^) plus a backslash (\). Note that an unrecognized command will be interpreted as a host name.

## Commands

> ### host [server]

> Looks up information for the host using either the current default server or the specified server. If `host` is an IP address and the query type is A or PTR, the name of the host is returned. If `host` is a name and does not have a trailing period, the default domain name is appended to the name. (This behavior depends on the state of the `set` options `domain` , `srchlist` , `defname` , and `search` .) To look up a host not in the current domain, append a dot (.) to the end of the domain name.

> ### server domain
> lserver domain

> Changes the default server to `domain` . The `lserver` command uses the initial server to look up information about `domain` , while the `server` command uses the current default server. If an authoritative answer cannot be found, the names of servers that might have the answer are returned.

> ### root

> Changes the default server to the server for the root of the domain name space. Currently, the host `ns.internic.net` is used. (This command is a synonym for `lserver ns.internic.net.` ) The name of the root server can be changed with the `set root` command.

> ### finger [name] [> filename]
> finger [name] [>> filename]

> Connects with the `finger` server on the current host. The current host is defined when a previous lookup for a host was successful and returned address information (see the `set querytype=A` command). The redirection symbols (> and >>) can be used to redirect output in the usual manner.

> ### ls [option] domain [> filename]
> ls [option] domain [>> filename]

> Lists the information available for domain, optionally creating or appending to filename. The default output contains host names and their IP addresses. The value for `option` can be one of the following:

> Option | Description
> --- | ---
> `-t` querytype | Lists all records of the specified type. (See `querytype` in Table A-2.)
> `-a` | Lists aliases of hosts in the domain. This option is a synonym for `-t CNAME` .
> `-d` | Lists all records for the domain. This option is a synonym for `-t ANY` .
> `-h` | Lists CPU and operating system information for the domain. This option is a synonym for `-t HINFO` .
> `-s` | Lists well-known services of hosts in the domain. This option is a synonym for `-t WKS` . When output is directed to a file, a pound sign (#) is displayed for every 50 records received from the server.

> ### view filename

> Sorts and lists the output of previous `ls` commands.

> ### help

> Displays a brief summary of commands.

> ### exit

> Exits the program.

> ### set keyword [=value]

> Use the command to change state information that affects the lookups. Table A-2 lists the valid keywords.

> Table A-2 Options to the `nslookup set` Command
> Keyword | Function
> --- | ---
> `ALL` | Displays the current values of the options you can set as well as information about the current default server. For example:
>     > set all
> `class= value` | Changes the query class to one of the following: `IN` --- The internet class (default) `CHAOS` --- The chaos class `ANY` --- Wildcard The class specifies the protocol group of the information. You abbreviate this keyword to `cl` . This command tells `nslookup` to resolve both `in` and `chaos` class queries (you can enter `in` and `chaos` ):
>     > set class=ANY
> `querytype` | Specifies the type of information you want. For example:
>     > set querytype=A

>     > set querytype=ANY
> Valid types are:
> SOA | Start of authority. Marks the beginning of a zone's data and defines parameters that affect the entire zone.
> NS | Name server. Identifies a domain's name server.
> A | Address. Maps a host name to an address.
> ANY | Defines all available resource records for a given name.
> PTR | Pointer. Maps an address to a host name.
> MX | Identifies where to deliver mail for a given domain.
> CNAME | Defines an alias host name.
> HINFO | Host information. Describes a host's hardware and operating system.
> WKS | Well-known service. Advertises network services.
> `[no]debug` | Turns on debugging (default is `nodebug` ). `nslookup` displays detailed information about the packet sent to the server and the answer. For example:
>     > set debug
> You can use the abbreviations `nodeb` and `deb` .
> `[no]d2` | Returns all-inclusive debugging information (default is `nod2` ). Displays all the fields of every packet. For example:
>     > set d2
> `recurse` | Tells the BIND server to contact other servers if it does not have the information you want. The servers carry out a complete (recursive) resolution for each query. For example:
>     > set recurse
> `retry` | Number of times that `nslookup` attempts to contact a BIND server if repeated tries fail. For example:
>     > set retry=8
> `timeout` | Length of time to wait for a reply from each attempt. For example:
>     > set timeout=9
> `root= value` | Changes the root server. For example, the following command changes the root server to `ns.nasa.gov` .
>     > set root=ns.nasa.gov
> `ignoretc` | Tells `nslookup` to ignore packet truncation errors. For example:
>     > set ignoretc
> `domain name` | Changes the default domain to the domain you specify. The settings of the `defname` and `search` options control how the default domain name is appended to lookup requests. The domain search list contains the parents of the default domain if the default domain has at least two components in its name. The default value is set in the TCP/IP configuration database. To specify the default, type the abbreviation `do` . For example, if the default domain is `CC.Berkeley.EDU` , the search list is `CC.Berkeley.EDU` and `Berkeley.EDU.`
> `srchlist` | If set, `nslookup` appends each of the domain names specified in the `srchlist` option to an unqualified host name and performs a query until an answer is received.
> `srchlist= names` | Changes the default domain name to the first name you specify, and changes the domain search list to all the names you specify. Specify a maximum of six names separated by slashes (/). In the following example, the command sets the default domain to `lcs.MIT.EDU` and changes the search list to the three specified domains. The command overrides the default domain name and associated search list for the `set domain` command.
>     > set srchlist=lcs.MIT.EDU/ai.MIT.EDU/MIT.EDU
> The default is the domain name specified in the TCP/IP configuration database. The abbreviated form of the command is `srchl` .
> `[no]defname` | Tells `nslookup` to append a default domain name to a lookup request if the specified DNS name is not fully qualified. 1 The abbreviated form is `[no]def` . For example, an `nslookup` query for the host `rainy` becomes `rainy.cc.berkeley.edu` .
> `[no]search` | Tells `nslookup` to append the search list domain names to the lookup request domain name if the lookup request domain name is not fully qualified. 1 The default is `search` . The abbreviated form is `[no]sea` .

1A fully qualified domain name is a name that ends with a dot (.), as in host.domain.

##

### Examples

> The following example shows how to use `nslookup` interactively.

#1
    $ nslookup
    Default Server:  condor.lgk.dec.com
    Address:  16.99.208.53

    > set all
    Default Server:  condor.lgk.dec.com
    Address:  16.99.208.53

    Set options:
      nodebug             defname         search          recurse
      nod2                novc            noignoretc      port=53
      querytype=A         class=IN        timeout=4       retry=4
      root=a.root-servers.net.
      domain=xyz.prq.dec.com
      srchlist=xyz.prq.dec.com

# ping

Send ICMP ECHO_REQUEST packets to network hosts.

## Format

> ping [-dfnqruvR] -c count [-i wait] [-l preload] [-p pattern] [-s packetsize] host

### description

> The `ping` command uses the ICMP (Internet Control Message Protocol) mandatory ECHO_REQUEST datagram to elicit an ICMP ECHO_RESPONSE message from the specified host or gateway host. ECHO_REQUEST datagrams ( `ping` ) have an IP (Internet Protocol) and ICMP header, followed by a `struct timeval` and then an arbitrary number of pad bytes used to fill out the packet.

> When using `ping` for fault isolation, first run the command on the local host to verify that the local network interface is up and running. Then, hosts and gateways further and further away should be sent the `ping` command. Round-trip times and packet loss statistics are computed. If duplicate packets are received, they are not included in the packet loss calculations, although the round-trip time of these packets is used in calculating the minimum, average, and maximum round-trip time numbers. When the specified number of packets have been sent (and received), or if the program is terminated with a SIGINT, a brief summary is displayed.

> This program is intended for use in network testing, measurement, and management. Because of the load it can impose on the network, it is unwise to use `ping` during normal operations or from automated scripts.

> ICMP packet details

> An IP header without options is 20 bytes. An ICMP ECHO_REQUEST packet contains an additional 8 bytes worth of ICMP header followed by an arbitrary amount of data. When a packetsize is given, this indicates the size of this extra piece of data (the default is 56). Thus, the amount of data received inside of an IP packet of type ICMP ECHO_REPLY will always be 8 bytes more than the requested data space (the ICMP header).

> If the data space is at least 8 bytes large, `ping` uses the first 8 bytes of this space to include a timestamp, which it uses in the computation of round-trip times. If less than 8 bytes of pad are specified, no round-trip times are given.

> Duplicate and damaged packets

> The `ping` command will report duplicate and damaged packets. Duplicate packets should never occur, and seem to be caused by inappropriate link-level retransmissions. Duplicates can occur in many situations and are rarely (if ever) a good sign, although the presence of low levels of duplicates can not always be cause for alarm.

> Damaged packets are obviously serious cause for alarm and often indicate broken hardware somewhere in the `ping` packet's path (in the network or in the hosts).

> Different data patterns

> The network layer should never treat packets differently depending on the data contained in the data portion. Unfortunately, data-dependent problems have been known to invade networks and remain undetected for long periods of time. In many cases the problematic pattern does not have sufficient transitions, such as all ones (1) or all zeros (0), or has a pattern at the right, such as almost all zeros (0). It is not necessarily enough to specify a data pattern of all zeros on the command line because the problematic pattern of interest is at the data-link level, and the relationship between what you enter and what the controllers transmit can be complicated.

> Data-dependent problems can be identified only by extensive testing. If you are lucky, you can manage to find a file that either cannot be sent across your network or that takes much longer to transfer than other files of similar length. You can then examine this file for repeated patterns that you can test by using the `-p` option to the `ping` command.

> TTL details

> The TTL value of an IP packet represents the maximum number of IP routers that the packet can go through before being thrown away. You can expect each router in the Internet to decrement the TTL field by exactly one.

> The maximum possible value of this field is 255, and most UNIX compatible systems set the TTL field of ICMP ECHO_REQUEST packets to 255. This is why you can use the `ping` command on some hosts but not reach them with `TELNET` or `FTP` .

> In normal operation, `ping` displays the TTL value from the packet it receives. When a remote system receives a `ping` packet, it can do one of three things with the TTL field in response:

> - Not change the field. This is what Berkeley UNIX compatible systems did before BSD Version 4.3. In this case, the TTL value in the received packet will be 255 minus the number of routers in the round-trip path.
> - Set the field to 255. This is what current Berkeley UNIX compatible systems do. In this case, the TTL value in the received packet will be 255 minus the number of routers in the path from the remote system to the host that received the `ping` commands.
> - Set the field to some other value. Some machines use the same value for ICMP packets that they use for TCP packets; for example, either 30 or 60. Others may use completely wild values.

### cautions

> Many hosts and gateways ignore the RECORD_ROUTE option.

> Flooding and preloading the `ping` command is generally not recommended, and flooding `ping` messages on the broadcast address should be done only under very controlled conditions.

## Flags

> ### -c count

> Stops after sending (and receiving) the specified number (count) of ECHO_RESPONSE packets.

> ### -d

> Sets the `SO_DEBUG` option on the socket being used.

> ### -f

> Floods `ping` . Outputs packets as fast as they come back or 100 times per second, whichever is more. For every `ECHO_REQUEST` sent, a dot (.) is displayed, while for every `ECHO_REPLY` received a backspace is used. This provides a rapid display of how many packets are being dropped. You must have system privileges to use this option. Using the `-f` flag can be very hard on a network and should be used with caution.

> ### -i wait

> Waits the specified number of seconds between sending each packet. The default is to wait for 1 second between each packet. This option is incompatible with the `-f` option.

> ### -l preload

> If preload is specified, `ping` sends that many packets as fast as possible before falling into its normal mode of behavior. You must have system privileges to use this option. Using the `-l` option can be very hard on a network and should be used with caution.

> ### -n

> Numeric output only. No attempt is made to look up symbolic names for host addresses. This occurs only when displaying ICMP packets other than ECHO_RESPONSE.

> ### -p pattern

> Specifies up to 16 pad bytes to fill out the packet you send. This is useful for diagnosing data-dependent problems in a network. For example, `-p ff` will cause the sent packet to be filled with all ones (1).

> ### -q

> Suppresses output. Nothing is displayed except the summary lines at startup time and at completion.

> ### -R

> Records route. Includes the RECORD_ROUTE option in the ECHO_REQUEST packet and displays the route buffer on returned packets. Note that the IP header is large enough for only nine such routes. Many hosts ignore or discard this option.

> ### -r

> Bypasses the normal routing tables and sends directly to a host on an attached network. If the host is not on a directly attached network, an error is returned. This option can be used to send `ping` to a local host through an interface that has no route through it (for example, after the interface was dropped by ROUTED).

> ### -s packetsize

> Specifies the number of data bytes to be sent. The default is 56, which translates into 64 ICMP data bytes when combined with the 8 bytes of ICMP header data.

> ### -u

> Displays the time in microseconds (three decimal places). In order to ensure this microsecond precision, the NTP_TIME and MICRO_TIME kernel options must be on. By default, NTP_TIME and MICRO_TIME kernel options are off. If these kernel options are off and this flag is used, the time is displayed to three decimal places, but in milliseconds.

> ### -v

> Specifies detailed output. ICMP packets other than ECHO_RESPONSE that are received are listed.

##

### Examples

> The following example shows how to use the `ping` command.

#1
    TCPIP> ping
    PING rufus.lkg.dec.com (10.10.2.4): 56 data bytes
    64 bytes from 10.10.2.4: icmp_seq=0 ttl=64 time=30 ms
    64 bytes from 10.10.2.4: icmp_seq=1 ttl=64 time=0 ms
    64 bytes from 10.10.2.4: icmp_seq=2 ttl=64 time=0 ms
    64 bytes from 10.10.2.4: icmp_seq=3 ttl=64 time=0 ms

    ----rufus.lkg.dec.com PING Statistics----
    4 packets transmitted, 4 packets received, 0% packet loss
    round-trip (ms)  min/avg/max = 0/8/30 ms

Previous | Next | Contents | Index