Windows network troubleshooting: layer by layer with pktmon

Start DC01, DC02, SRV01 and CL01. Work as SAATLAB\adm.rahul in PowerShell as administrator.

1Check link and IP on CL01

On CL01:

Get-NetAdapter | Select-Object Name, Status, LinkSpeed
Get-NetIPConfiguration | Select-Object InterfaceAlias,
    @{ n = 'IPv4';    e = { $_.IPv4Address.IPAddress } },
    @{ n = 'Gateway'; e = { $_.IPv4DefaultGateway.NextHop } },
    @{ n = 'DNS';     e = { $_.DNSServer.ServerAddresses -join ', ' } }

You’ll see something like this:

Name     Status LinkSpeed
----     ------ ---------
Ethernet Up     1 Gbps

InterfaceAlias IPv4       Gateway  DNS
-------------- ----       -------  ---
Ethernet       10.0.0.150 10.0.0.1 10.0.0.10, 10.0.0.11

Link up, the reserved address from Lesson 15, a gateway and both DCs as DNS servers. The bottom two layers are fine.

✅ Checkpoint: CL01 shows Up, 10.0.0.150, gateway 10.0.0.1 and DNS 10.0.0.10 and 10.0.0.11.

2Check name resolution against each DNS server

On CL01, ask each DNS server directly and check the hosts file:

foreach ($s in '10.0.0.10', '10.0.0.11') {
    $r = Resolve-DnsName intranet.saatlab.internal -Server $s -DnsOnly
    [pscustomobject]@{ Server = $s; Name = $r.Name; IPAddress = $r.IPAddress }
}
Get-Content C:\Windows\System32\drivers\etc\hosts | Where-Object { $_ -notmatch '^\s*#' -and $_.Trim() }

You’ll see something like this:

Server    Name                      IPAddress
------    ----                      ---------
10.0.0.10 intranet.saatlab.internal 10.0.0.20
10.0.0.11 intranet.saatlab.internal 10.0.0.20

Both DNS servers give the same answer and the hosts file has no active entries. If the two servers disagreed, you’d check AD replication (Lesson 31) next.

✅ Checkpoint: Both DCs resolve intranet.saatlab.internal to 10.0.0.20, and the hosts file is empty.

3Check ports and who is listening

On CL01, test the ports SRV01 should offer:

foreach ($p in 443, 445, 3389, 5985) {
    $t = Test-NetConnection SRV01 -Port $p -WarningAction SilentlyContinue
    [pscustomobject]@{ Port = $p; Open = $t.TcpTestSucceeded }
}

You’ll see something like this:

Port Open
---- ----
 443 True
 445 True
3389 True
5985 True

On SRV01, see which process owns port 443:

Get-NetTCPConnection -State Listen -LocalPort 443 |
    Select-Object LocalAddress, LocalPort, OwningProcess,
        @{ n = 'Process'; e = { (Get-Process -Id $_.OwningProcess).ProcessName } }

You’ll see something like this:

LocalAddress LocalPort OwningProcess Process
------------ --------- ------------- -------
::                 443             4 System
0.0.0.0            443             4 System

IIS listens through HTTP.sys, the kernel web listener, so the owner shows as System (PID 4), not w3wp.exe. For other apps you’ll see the real process name, which tells you which service to check.

✅ Checkpoint: All four ports are open, and port 443 is owned by System (HTTP.sys).

4Check the path with pathping

On CL01:

pathping -n -q 20 1.1.1.1

You’ll see something like this:

Tracing route to 1.1.1.1 over a maximum of 30 hops

  0  10.0.0.150
  1  10.0.0.1
  2  1.1.1.1

Computing statistics for 50 seconds...
            Source to Here   This Node/Link
Hop  RTT    Lost/Sent = Pct  Lost/Sent = Pct  Address
  0                                           10.0.0.150
                                0/  20 =  0%   |
  1    0ms     0/  20 =  0%     0/  20 =  0%  10.0.0.1
                                0/  20 =  0%   |
  2   12ms     0/  20 =  0%     0/  20 =  0%  1.1.1.1

VirtualBox NAT hides the real hops, so you’ll only see the gateway and the target. On a real network you’d see every router, and the “This Node/Link” column shows where packets are lost.

✅ Checkpoint: pathping shows each hop with 0% loss.

5Capture HTTPS packets with pktmon

On SRV01, add a filter for port 443 and start a capture:

pktmon filter add Web -p 443
pktmon start --capture --pkt-size 0 --file-name C:\Lab\web.etl

On CL01, make one request:

(Invoke-WebRequest https://intranet.saatlab.internal -UseDefaultCredentials -UseBasicParsing).StatusCode

Back on SRV01, stop, convert for Wireshark and remove the filter:

pktmon stop
pktmon etl2pcap C:\Lab\web.etl --out C:\Lab\web.pcapng
pktmon filter remove
Get-Item C:\Lab\web.* | Select-Object Name, Length

You’ll see something like this:

Name        Length
----        ------
web.etl    1052672
web.pcapng   48224

Copy web.pcapng to your laptop and open it in Wireshark. You’ll see the TCP handshake (SYN, SYN-ACK, ACK) from 10.0.0.150 to 10.0.0.20 and the TLS session.

[Add your screenshot here]

✅ Checkpoint: pktmon created web.etl and web.pcapng with the HTTPS conversation between CL01 and SRV01.