Network Monitor and System Monitor

Network Monitor and System Monitor.

Two common tools, Network Monitor and System Monitor, are useful in monitoring your system. While both can be used to gather some information related to network performance, Network Monitor is the tool you will use most often to analyze network traffic and gather information about communication between two computers. The following table compares the features of Network Monitor and System Monitor.

Characteristic	Network Monitor	System Monitor
Data collected	Captures packets (or packet fragments) and their contents. Reports statistics about network traffic.	Monitors system statistics, producing counters and charts of system performance. Monitors local system components including disk, processor, memory, and network statistics.
Data reports	View contents of sent and received packets. View network traffic statistics.	View graphs of system performance and counters.
Event tracking	Configure triggers to stop capture or execute a command based on a specific network traffic event (or packet type).	Configure alerts to log an entry, send a message, or run a program when a counter reaches a specific threshold.
Identifying captured data	Configure filters to capture only specific packets or to display only certain packets.	Select objects and counters to identify the statistics you want to track.

You should know the following facts about Network Monitor:

• The free version of Network Monitor that comes with Windows can only monitor traffic to and from the local computer.
• To capture all network packets, use the SMS version of Network Monitor.
• Even when using the SMS version, you cannot capture packets sent to other computers on other segments through a switch. (Switched traffic is only sent to the segment where the destination computer sits.)
• Use Dedicated Capture mode with Network Monitor to ensure you capture all packets.

TCP/IP Configuration Settings.

The following table summarizes many of the configuration settings for a TCP/IP network.

Parameter	Purpose
IP address	Identifies both the logical host and logical network addresses.
Subnet mask	Identifies which portion of the IP address is the network address.
Default gateway	Identifies the router to which packets for remote networks are sent.
Host name	Identifies the logical name of the local system.
DNS server	Identifies the DNS server that is used to resolve host names to IP addresses.
WINS server	Identifies the WINS server that is used to resolve host names to IP addresses.
MAC address	Identifies the physical address. On an Ethernet network, this address is burned in to the network adapter hardware.

Keep in mind the following regarding TCP/IP configuration:

• All computers must be assigned a unique IP address.
• Hosts on the same physical network should have IP addresses in the same address range.
• The subnet mask value for all computers on the same physical network must be the same.
• Configure the default gateway value to enable internetwork communication.
• The default gateway address must be on the same subnet as the host's IP address.

Choosing the Addressing Method.

The table below lists options for assigning IP addresses.

Method	Uses
Static (manual) assignment	Small number of hosts. Network will not change or grow. Hosts that must have the same address each time. For small networks (if the administrative time and cost is acceptable). For non-DHCP hosts (hosts that cannot accept an IP address from DHCP). To reduce DHCP-related traffic.
APIPA	Single-subnet network. No DNS services. Automatic configuration of IP address and subnet mask only. Small, non-subnetted networks. Implementation for which you do not need to customize the default address range.
DHCP	Small, medium, or large networks. Automatic configuration. Automatically deliver additional configuration parameters (such as default gateway, DNS servers).
Alternate	A single computer connects to two networks, one without a DHCP server. A computer is connected to a network using DHCP, but you want it to be properly configured when the DHCP server is unavailable.

You should know the following facts about IP address assignments:

• By default, all Windows computers try to use DHCP for TCP/IP configuration information.
• APIPA is used to automatically generate an IP address if the DHCP server is unavailable and if no alternate address is configured.
• The APIPA range is 169.254.0.1 to 169.254.255.255 with a mask of 255.255.0.0.
• If the computer assigned itself an IP address (using APIPA), this means the computer could not contact a DHCP server.
• When you configure a static IP address, you disable DHCP and APIPA.
• Use an alternate IP address to use DHCP on one network and static addressing on another without reconfiguring the connection.
• When you configure an alternate IP address, APIPA is no longer used when the DHCP server can't be contacted.
• You can rely on APIPA for your IP addressing solution, but only for a network with a single subnet. APIPA does not set the default gateway or name server address.

IP Addressing Facts.

The following table lists the default IP addressing classes and masks:

Class	Address Range	Default Mask
A	1.0.0.0 to 126.255.255.255	255.0.0.0
B	128.0.0.0 to 191.255.255.255	255.255.0.0
C	192.0.0.0 to 223.255.255.255	255.255.255.0
D	224.0.0.0 to 239.255.255.255	(multicast addresses)
E	240.0.0.0 to 255.255.255.255	(experimental addresses)

You should also know the following address ranges that are reserved for private addresses. Use these addresses on a private network that is connected to the Internet through a network address translation (NAT) router.

• 10.0.0.0 to 10.255.255.255
• 172.16.0.0 to 172.31.255.255
• 192.168.0.0 to 192.168.255.255

Keep in mind the following facts about IP addresses:

• The first address in a range on the subnet is the subnet address. Typically, this address is not assigned to hosts.
• The last address in a range on the subnet is the broadcast address. Typically, this address is not assigned to hosts.

Troubleshooting TCP/IP.

Use the following tips to troubleshoot TCP/IP:

• Use Ipconfig /all to verify your IP address, subnet mask, default gateway, and other IP configuration values.
• If the IP address is in the APIPA range (169.254.0.0 to 169.254.255.254), the computer could not contact a DHCP server. Use Ipconfig /renew to try contacting the DHCP server again.
• Use Ping (Packet Internet Groper) to send small packets to a computer to see if the computer responds. Microsoft recommends the following use of Ping:
1. Ping the loopback address (127.0.0.1). This verifies that the TCP/IP protocol stack has been properly installed.
2. Ping the local IP address assigned to the machine. This verifies communication to the NIC.
3. Ping the default gateway. This verifies connectivity to the default gateway or to another machine on the local network. This verifies that the local network is accessible.
4. Ping a remote host. This checks the connectivity between the default gateway and the remote host.
• Use Tracert to see the route packets take through an internetwork between two devices.
• Use Pathping to view the route of the connection and the connectivity response time. This can help identify where communication latency occurs.
• Use the Arp -d * command to remove all dynamic ARP entries from the ARP list. (Arp -d clears the ARP cache.)
• Use the Windows system logs to track DHCP service startup and shutdown as well as critical errors.

DHCP Authorization.

Be aware of the following facts about DHCP server authorization.

• Authorization is required if you are using Active Directory; no authorization is required, however, for a standalone server.
• When you authorize a DHCP server, its IP address is added to a list of authorized DHCP server maintained in Active Directory.
• When a DHCP server starts, its IP address is compared to the Active Directory list. If it is found, the server is allowed to issue IP addresses. If it is not found, the server is not allowed to issue IP addresses, and the server does not respond to DHCP requests.
• Only Windows 2000 or Windows 2003 servers check for authorization.
• You can authorize a server before DHCP is installed.
• Rogue DHCP servers running other operating systems (like Unix, NetWare, or Windows NT) do not check for authorization before assigning addresses.
• A Windows DHCP server checks for authorization when it boots and reauthorizes every five minutes.
• You must be a member of the Enterprise Admins group to authorize a server.
• In some cases, when you install DHCP on a domain controller, it will be authorized automatically.
• When you install DHCP, the server is added automatically to the DHCP console on the local machine. When it is installed on another machine, you must add it manually to the local DHCP console.

Scope Facts.

You should know the following facts about DHCP scopes:

• Use exclusions to prevent the DHCP server from assigning certain IP addresses. For example, exclude any IP addresses for devices that are not DHCP clients.
• Use reservations to make sure a client gets the same IP address each time from the DHCP server. The reservation associates the MAC address with the IP address the client should receive. For example, use a reservation for servers and printers to keep their IP addresses consistent while still assigning the addresses dynamically.
• When using reservations, do not exclude the addresses you want to assign.
• To change the subnet mask used by a scope, you must delete and recreate the scope. You cannot selectively change the subnet mask in an existing DHCP scope.
• The scope must be activated before the DHCP server will assign addresses to clients.

DHCP Option Facts.

Through DHCP, you can deliver a wide range of TCP/IP configuration parameters (not just the IP address and mask). Additional parameters are delivered by configuring DHCP options. Options can be set at the following levels:

• Server. Options set on the server are delivered to all clients of that DHCP server.
• Scope. Options set on the scope are delivered to all computers that obtain an IP address from within the scope.
• Class. A class defines a group of computers that share common characteristics. For example, the vendor class can be used to deliver options to Microsoft Windows clients. Class options are delivered to all computers within the class.
• Reserved client. Options set on a reservation are delivered to the specific client.

Options are applied in the order listed above. If conflicting settings are delivered, the last parameters delivered will take precedence over the previous settings.

Common options include:

• 003 Router, the IP address of the default router (the default gateway)
• 006 DNS Servers, the IP address of DNS server or servers
• 015 DNS Domain Name, the domain that the client belongs to; used to update DNS server
• 044 WINS/NBNS Servers, the IP address of WINS server or servers
• 046 WINS/NBT Node Type, controls the order in which a client uses NetBIOS name servers

DHCP Server Backup and Recovery.

To move the DHCP service from one server to another, you must perform operations on the source and destination machines.

Source machine:

1. In DHCP Console, back up DHCP. The backup includes:
• Scopes, exclusions, and reservations.
• DHCP configurations.
• DHCP-related registry settings.
2. Stop and disable the DHCP service.
3. Copy the DHCP backup files to the destination machine.

On the destination machine:

1. Install DHCP.
2. Stop the DHCP service.
3. In DHCP Console, restore the DHCP backup files.
4. Verify the DHCP configuration and start DHCP.

DHCP Lease and Renewal Processes.

A DHCP client uses the following process to obtain an IP address:

1. Lease Request. The client initializes a limited version of TCP/IP and broadcasts a DHCPDISCOVER packet requesting the location of a DHCP server.
2. Lease Offer. All DHCP servers with available IP addresses send DHCPOFFER packets to the client. These include the client's hardware address, the IP address the server is offering, the subnet mask, the duration of the IP lease, and the IP address of the DHCP server making the offer.
3. Lease Selection. The client selects the IP address from the first offer it receives and broadcasts a DHCPREQUEST packet requesting to lease the IP address in that offer.
4. IP Lease Acknowledgment. The DHCP server that made the offer responds and all other DHCP servers withdraw their offers. The IP addressing information is assigned to the client and the offering DHCP server sends a DHCPACK (acknowledgement) packet directly to the client. The client finishes initializing and binding the TCP/IP protocol.

Part of the IP address lease includes a lease duration (or the amount of time the client can use the IP address it has been allocated). Periodically, DHCP clients try to renew their IP address with the DHCP server. Microsoft clients use the following rules when renewing leases:

• When the lease time reaches 50%, the client tries to renew its lease with the DHCP server. It sends a DHCPREQUEST unicast message to the DHCP server requesting a lease renewal. If the DHCP server does not respond, it continues to use the IP address.
• When the lease time reaches 87.5%, the client sends a DHCPREQUEST unicast message to renew the lease. If the DHCP server does not respond, it continues to use the IP address.
• When the lease time expires, the client broadcasts a DHCPREQUEST message to renew the lease.
• When the client boots, it broadcasts a DHCPREQUEST message to renew the lease.
• If the server sends a negative acknowledgement (a DHCPNAK packet) during any renewal attempt, the client must reinitialize TCP/IP and restart the DHCP lease at the beginning.
• Enable BootP forwarding on routers to ensure that lease request broadcast packets are forwarded through the routers.

The following table summarizes the packets exchanged between DHCP clients and servers.

Message	Description
DHCPDISCOVER	Sent from client to server or servers to ask for an IP address. Used when client starts or cannot renew current lease.
DHCPREQUEST	Requests a specific new IP address or renewal of its current IP address. Used to select one lease offer from among multiple offers or to confirm a previous address lease.
DHCPOFFER	Offers to lease of an IP address to a client when it starts on the network. Client can receive multiple offers from multiple DHCP servers but usually selects the first.
DHCPACK	Sent from server to client to acknowledge and complete a client's requested address lease. Contains IP address, lease duration, and possibly other parameters.
DHCPNAK	Sent from server to a client when the requested IP address is not available (negative acknowledgement).
DHCPDECLINE	Used by client to decline the offer of an IP address because of a potential conflict.
DHCPRELEASE	Sent from client to server to release an IP address. Used to cancel a currently active lease. Cancellation can be done manually with the Ipconfig /release command.
DHCPINFORM	Used by a computer to obtain information from a DHCP server for use in its local configuration. Used when the sender already has an IP address, possibly not from DHCP.

Troubleshooting DHCP.

For a Windows 2003 Server DHCP server to deliver IP addresses, the following conditions must be met:

• The server must be authorized.
• The DHCP service must be running (the DHCP server is started).
• The scope must be started.
• There must be IP addresses in the scope that are free to be assigned, or a reservation for the client must be defined.
• The client must be configured to receive its IP address from the DHCP server.

One useful tool for troubleshooting and fixing DHCP lease problems is Ipconfig. The following table lists the command switches useful in troubleshooting DHCP.

Command	Use
Ipconfig /all	View TCP/IP configuration including the IP address, mask, default gateway, and any other DHCP-delivered parameters. In addition, the command shows the IP address of the DHCP server from which configuration information was received.
Ipconfig /renew	Renew DHCP configuration for specific or multiple adapters.
Ipconfig /release	Releases DHCP configuration and discards IP address configuration for specific or multiple adapters.

An address IP address in the 169.254.0.0 range indicates that the client could not contact the DHCP server and has used APIPA to assign itself an address.

You should recognize the following symptoms of a rogue server:

• Incorrect IP configuration information.
• Duplicate addresses assigned.
• Ipconfig /all shows the DHCP server address incorrectly.
• DHCPNAK messages at the client during lease renewal.

If the client has an address from the wrong server, remove the rogue server, then do Ipconfig /release followed by Ipconfig /renew.

DNS Name Resolution Process.

You should be familiar with the DNS name resolution process:

1. When a DNS name resolution request is forwarded to a DNS server, the DNS server examines its local DNS cache for the IP address.
2. If the IP address is not in the DNS server's cache, it checks its Hosts file. (Since the Hosts file is a static text file, it is not commonly used.)
3. If the DNS server is not authoritative and configured for forwarding, the DNS server forwards the request to a higher-level DNS server.
4. If the DNS server cannot forward the request, or if forwarding fails, the DNS server uses its Root Hints file (also known as Cache.dns). The Root Hints file lists the 13 root DNS servers.
5. The root DNS server responds with the address of a com, edu, net, or other DNS server type (depending on the request).
6. The DNS server forwards the request to the high-level DNS server, which can respond with a variety of IP addresses.

You should know the following facts about DNS:

• DNS translates a hostname to an IP address.
• The DNS hierarchy is made up of the following components:
• . (dot) domain (also called the root domain)
• Top Level Domains (TLDs) (.com, .edu, .gov)
• Domains
• Hosts
• A fully qualified domain name (FQDN) must include the name of the host and the domain, not just the domain.
• A forward lookup uses the host name (or the FQDN) to find the IP address.
• A reverse lookup uses the IP address to find host name (or FQDN).
• A DNS server can forward a DNS request to an upstream DNS server if it cannot resolve a host name to an IP address.
• An authoritative server is a DNS server that has a full, complete copy of all the records for a particular domain.
• A caching-only DNS server has no zone information; it is not authoritative for any domains.
• The Root Hints file (also called the Cache.DNS file) lists the 13 root DNS servers. A DNS server uses the Root Hints file to forward a request to a Root DNS server as a last resort to resolve a host name to an IP address.
• A Root DNS server refers DNS servers to .com or .edu or .gov level DNS servers.
• Recursion is the process by which a DNS server or host uses root name servers and subsequent servers to perform name resolution. Most client computers do not perform recursion, rather they submit a DNS request to the DNS server and wait for a complete response. Many DNS servers will perform recursion.

Zone Types.

The table below lists the types of DNS zones:

Zone Type	Description
Standard primary	Host name-to-IP address name resolution. Data is stored in a flat text file. Read-write copy of the data.
Standard secondary	Host name-to-IP address name resolution. Data is copied from another DNS server. Read-only copy of the data.
Reverse lookup	IP address to host name resolution. Can be both primary and secondary zones.
Active Directory-integrated	Data is stored in Active Directory. Data is shared between domain controllers. Data is read-write on all servers with the data. Provides automatic replication, fault tolerance, and distributed administration of DNS data.

You should also know the following facts about zones:

• To configure reverse lookup for a subnetted IP network, enable the Advanced view in the DNS console.
• Reverse lookup zones for IPv6 addresses should be created in the ip6.arpa namespace.

·         Common Resource Records.

·         The table below lists the most common resource records.

Record Type	Use
A (host address)	The A record maps a DNS host name to an IP address. This is the most common resource record type.
CNAME (canonical name)	The CNAME record provides alternate names (or aliases) to hosts that already have an A record.
MX (Mail Exchanger)	The MX record identifies servers that can be used to deliver mail.
NS (name server)	The NS resource record identifies all name servers that can perform name resolution for the zone. Typically, there is an entry for the primary server and all secondary servers for the zone.
PTR (pointer)	In a reverse lookup zone, the PTR record maps an IP address to a host name (i.e. "points" to an A record).
SOA (Start of Authority)	The first record in any DNS database file is the SOA. It defines the general parameters for the DNS zone. The SOA record includes parameters such as the authoritative server and the zone file serial number.
SRV (service locator)	The SRV record is used by Windows 2003 to register network services. This allows clients to find services (such as domain controllers) through DNS. Windows 2003 automatically creates these records as needed.

Dynamic DNS Facts.

For a Windows 2000/XP/2003 client, the following process is used to dynamically update the DNS database.

1. The client boots and receives an IP address from the DHCP server.
2. The client sends a DNS update request to update the forward lookup record.
3. The DHCP server sends an update request to update the reverse lookup record.

For non-dynamic update clients, the DHCP server sends both the forward and reverse lookup updates. You can also configure the DHCP server to perform both tasks for Windows clients.

To enable dynamic updates, use the following steps:

1. On the Windows DNS server, open the Zone Properties dialog box and enable dynamic updates.
2. In the TCP/IP Properties of the client, make sure dynamic DNS is enabled (enabled is the default setting).

Note: You may also need to enable dynamic updates on the DHCP server if you're doing dynamic updates by proxy.

You should know the following facts about secure dynamic DNS:

• Secure dynamic updates are only available for Active Directory-integrated zones.
• To use secure DDNS, a client must be a member of the same Active Directory domain as the DDNS server.
• Only the original client can alter or remove records when using secure DDNS.

DNS Client Settings.

DNS uses fully qualified domain names (FQDN) to identify a computer. FQDNs are composed of the host name and the domain name (also called a suffix). Windows client computers can be identified using two different DNS suffixes:

• Primary suffix, set through the System properties.
• Connection-specific suffix, configured through the TCP/IP properties for the network adapter.

With dynamic DNS, client computers can update the DNS database with their host name. Keep in mind the following facts about client dynamic updates:

• By default, Windows 2000/XP/2003 clients register their DNS name with the DNS server.
• In the TCP/IP properties, Advanced settings, DNS tab, the Register this connection's addresses in DNS setting controls whether the client dynamically registers its name with DNS.
• With dynamic DNS enabled on the client, the computer will register its full DNS name from the configuration on the Network Identification tab of the System applet (using the primary suffix).
• You can configure the client to register two different DNS names with the DNS server. To do this, in the TCP/IP properties, Advanced settings, DNS tab, identify an additional DNS suffix for the client and enable the Use this connection's DNS suffix in DNS registration option. When enabled, the client will register its name with the connection-specific suffix as well as the primary suffix.

You can also configure the client with custom search suffixes.

• By default, when you submit a DNS query without using the fully qualified domain name (FQDN), the client computer appends the computer's domain to the name to perform the DNS lookup. The client will also use parent suffixes to try the request multiple times.
• Edit the Advanced TCP/IP properties to customize the search suffixes. You can specify search suffixes outside of the parent suffixes, and modify the order in which suffixes are used for searches.

AD-Integrated Zone Facts.

Using Active Directory to manage zone information has the following advantages:

• No single point of failure. Changes are made to multiple rather than individual servers.
• Fault tolerance. Each host server maintains up-to-date zone information.
• Single replication topology. Zone transfers occur through Active Directory replication.
• Secure dynamic updates. Only authorized computers can update dynamically.
• Simplified management. Any authorized computer can initiate changes to the zone file (not just the primary server).

In Windows 2000, all DNS data is replicated with all domain controllers. With 2003, you have the following options:

Replication Option	Where data is replicated
2000 Default	All domain controllers in a domain receive the information whether or not they have DNS installed.
DomainDNSZones	All domain controllers with DNS in the domain receive the information.
ForestDNSZones	All domain controllers with DNS in the forest receive the information. (Used most effectively when you have very important records that need to be available throughout the forest.)
Application Partitions	All domain controllers within the application partition. By using an application partition, you can customize which domain controllers will receive the DNS data.

Root Hint Facts.

Keep in mind the following facts regarding root hints.

• The Cache.dns file holds the 13 root hint addresses for the Internet root servers. The Cache.dns file can be found in two locations:
• %SystemRoot%\system32\dns\Cache.dns (the copy in use)
• %SystemRoot%\system32\dns\backup\Cache.dns (the copy reserved in the backup location)
• If you have a root zone configured on a DNS server, the server will act as a root zone server.
• A DNS server configured as a root zone server will never use the root hints file (Cache.dns). It considers itself authoritative. Consequently, the server won't access the Internet to forward DNS queries.
• If you want the DNS server to access the Internet, delete the root zone in the DNS Console.
• You can configure root hints through the properties of a DNS server or by configuring the DNS server's Cache.dns file. If the server is configured to load data from Active Directory, you must configure root hints using the DNS snap-in because the local Cache.dns is not used (the root hints data is stored in AD).

Stub Zones and Forwarding Facts.

You should know the following facts about DNS performance:

• A stub zone holds copies of the following DNS record types:
• NS records for all DNS servers (primary and secondary).
• SOA record for the primary server.
• DNS A records (also called glue records) for the DNS servers.
• A stub zone is dynamic. It will update itself with changes.
• Use a stub zone to provide quick access to the name server list and to provide a method of keeping the name server list updated without replicating zone data.
• Conditional forwarding allows DNS queries to be forwarded to specific DNS servers that have specific zones.
• Conditional forwarding is static. You set up an IP address which handles a specific type of query.
• Conditional forwarding must be updated when changes to forwarders are made.
• If a DNS server is configured to use forwarders, you can disable recursion on the DNS server. This means the server submits requests to the forwarder and waits for a response.

Zone Transfer Facts.

Replication through standard zones takes place through zone transfers. Secondary servers contact their master servers for new zone information. You should know the following facts about zone transfers:

• The zone serial number is modified when changes are made to the zone file.
• Zone transfer is initiated when a secondary server checks the master server and finds an incremented zone serial number.
• Zone transfer notification occurs when the master server contacts the secondary server when changes have been made.
• By default, a DNS server replicates the entire zone database (called a full zone transfer or AXFR).
• A partial zone transfer, in which only the changed information is replicated, is also called an incremental zone transfer or IXFR.
• To initiate a manual transfer, increment the serial number first. Otherwise, no transfer will occur (a transfer only occurs when the serial number has changed).
• You can improve DNS performance by placing multiple DNS servers on your network. For example, you can place a secondary server on the other side of a WAN link to reduce WAN traffic caused by name resolution. However, zone replication traffic must still cross the WAN link.
• A caching only server runs DNS but has no zones configured. Use a caching only server to improve performance while eliminating zone transfers.
• An Active Directory-integrated zone stores DNS information in Active Directory rather than in a zone file. Zone information is copied automatically when AD replicates.
• If a zone is Active Directory-integrated and has no secondary servers, you can disable zone transfers. Zone data will continue to be replicated through Active Directory.

Normally, zone transfers happen automatically at periodic intervals. You can force an update of zone data through the DNS console or by using the Dnscmd command. The following table lists some actions you can take to refresh zone data manually.

DNS Console Action	Dnscmd Option	Result
Reload	Dnscmd /ReloadZone	The server reloads zone data from its local copy (it reads the data back in from the zone file on the hard disk).
Transfer from Master	Dnscmd /Refresh	Initiates a normal zone transfer. The DNS server compares its version number with the version of the zone master. If the version numbers are the same, no zone transfer takes place.
Reload from Master	N/A	The DNS server dumps its copy of the data and reloads the entire data from the master server.

To force a zone transfer, you can either update the sequence number on the master server and then transfer the data from the master, or you can simply reload the data from the master.

DNS Design Guidelines.

Keep in mind the following facts about DNS namespace design:

• Active Directory requires DNS.
• A split-brain DNS solution allows you to run internal DNS and external DNS that don't communicate with one another. This helps to maintain internal security.
• Following are three split-brain DNS configuration options:
• Set up the same DNS name internally and externally.
• Set up different DNS names internally and externally.
• Set up the internal DNS as a subdomain of the external DNS.
• The purpose of a split-brain DNS solution is to:
• Allow external clients to access only external resources.
• Allow internal clients to access all resources.

The table below lists the split-brain DNS configurations.

Split-brain DNS Configuration	Implementation
Same Internal and External DNS Names	Set both DNS servers as primary to prevent zone transfer traffic. Allow internal client access to external resources by copying external resource records to the internal DNS server.
Different Internal and External DNS Names	To allow internal clients to access external resources, set up a forwarder, either a regular forwarder or a conditional forwarder.
Internal DNS Name as Subdomain of External DNS Name	One possible advantage is that you can run separate DNS infrastructures (e.g., an external Unix infrastructure and an internal Microsoft infrastructure). One danger is that outside queries could include the internal namespace. Use the firewall to block these types of queries. Set up a forwarder to allow internal clients to access external resources.

DNS Solutions.

You have a wide variety of tools to help you in designing a DNS solution. The following table lists various zone types and configuration options and when to use each.

Solution	Use
Primary zone	Select a primary zone to manage zone data on non-domain controllers or non-Windows DNS servers.
Secondary zone	Select a secondary zone to copy read-only zone data from another server. For example, your Windows server can be a secondary server to a non-Windows server, or a non-Windows server can be a secondary server to an Active Directory-integrated zone. Secondary zone servers accomplish three tasks: Fault tolerance Load balancing Reduce name resolution traffic over WAN links
Reverse lookup zone	Use a reverse lookup zone to find the host name for a given IP address. For example, use a reverse lookup zone if you need to identify the host name of clients who connect to a server or services. Following are reasons to set up reverse lookup zones: To use Nslookup by using the IP address. To use IP filtering in IIS. To accommodate applications that rely on reverse lookups.
Active Directory-integrated zone	Use when you have DNS servers that are also domain controllers. AD-I zones allow multi-master updates to the DNS database, automatically replicate data through Active Directory (rather than conventional DNS replication), secures zone updates, and allow secure dynamic client registration.
Caching only server	Use to reduce DNS name resolution traffic over WAN links without the zone transfer traffic.
Zone delegation	Use to subdivide a zone into multiple zones. This allows other administrators to manage parts of your name space.
Forwarders	Use to send DNS queries to other servers when the current server does not hold the data.
Conditional forwarding	Use to forward DNS queries based on the domain name characteristics. Without conditional forwarding, all requests are forwarded to the same servers. With conditional forwarding, requests are forwarded based on the domain name.
Stub zone	Use when you need to automatically update lists of name servers for a domain but do not want to replicate zone data.
Root zone	Use to make your DNS server authoritative for the entire name space. For example, you can configure a root zone to prevent name queries from being forwarded to the Internet root zone servers.
Root hints	Root hints point to the root zone servers. Normally root hints point to the Internet root zone servers. If you have a custom root zone, make sure root hints on internal servers point to your root zone servers.
Dynamic DNS	Use to allow clients to update DNS records.
Secure updates	Use to prevent unauthorized changes to dynamically-created DNS records. When enabled, only domain members can register DNS records, and only the same computer can modify those records. Secure updates are available only on Active Directory-integrated zones.

DNS Troubleshooting Tools.

You should know how to use the tools listed in this table:

Tool	Use
Nslookup	Use the Nslookup tool to perform DNS name resolution. Enter the name of the host, and Nslookup performs DNS queries to report the host's IP address.
Dnscmd	Dnscmd displays the properties of DNS servers, zones, and resource records. You can also use Dnscmd to modify these properties, create and delete zones and resource records, and force replication.
Ping	Use Ping to determine if an IP address is accessible. If you can ping an IP address, try to ping the logical name of the host. If the logical name test fails, you should troubleshoot the name resolution system.
Network Monitor	Use Network Monitor to analyze and monitor network traffic.
Ipconfig	You can use Ipconfig without switches to display the IP address, subnet mask, and default gateway for all adapters. However, the following switches are useful when troubleshooting DNS. /Displaydns, to display the contents of the local DNS cache. /Flushdns, to flush the local DNS cache. /Registerdns, to force a client to register its DNS information.
DNSLint	The DNSLint utility helps you to isolate and diagnose DNS problems. You must use one of the three following switches with DNSLint. /d, to perform domain name tests /ad, to perform AD tests /ql, to perform DNS query tests from a list

To provide fault tolerance for DNS servers, use one of the following strategies:

• Use Active Directory-integrated zones. If one DNS server goes down, zone data is still stored in Active Directory. Be sure to analyze the replication scope to make sure you have at least two servers holding the DNS data for each zone.
• Create secondary zones. If the primary server goes down, you can change one of the secondary zones to the primary zone.
• Back up the DNS database. If you have only one DNS server, be sure to back up the DNS database. For non-Active Directory-integrated zones, you can back up the DNS files or copy them to another location. For Active Directory-integrated zones, you must back up the system state data (because DNS is stored in Active Directory).