A lot of vague networking issues on user workstations are sometimes troubleshot by running the netsh winsock reset catalog command, often without knowing what it does. When you run this command, you are resetting the layered service providers that come with Windows and removing all others that did not come with Windows. These “others” might be MS firewall clients, security proxies or 3rd party wireless communication apps that come with “Air Cards” used by mobile users.

In the environment that I work in, our workstations have the Microsoft Firewall Client or TMG client installed. You can directly see this as a layered service provider by opening msinfo32 and going to Components > Network > Protocol:

If you run netsh winsock reset you end up removing any LSPs that are not part of the Windows-Out-Of-The-Box installation. If your LSP application is self-aware, like in the case of the MS FWC or TMG client, you might notice a warning of some type:

This is a sign you need to run a repair or reinstall your LSP application (in this case, a repair of the FWC\TMG client is enough to fix and put the LSPs back in place).

The irony is that, if running netsh winsock reset resolved whatever mysterious networking issue you encountered, then you might have isolated the cause of the issue to a problem with the LSP application. I encountered this myself way back in my first blog post of the The Case of the Random Internet Explorer Crashes.

This case demonstrates the importance of understanding basic networking components in Windows and how they work in an environment that sits behind a proxy. The methods used to uncover the culprit did not involve a detailed analysis of network traffic or using any utilities or tools that do not already come with Windows. In fact, because this was time sensitive and I was not afforded the luxury of troubleshooting afterhours, I could not rely on any of the various tools I turn to, like Process Monitor, crash dumps, or Network Monitor. Previous troubleshooting steps taken before it got me involved timely uninstall and reinstall of the Java client, an IE Reset, and upgrading from IE 7 to IE 8, all to no avail and creating irate user syndrome.

To start my analysis, I used Process Explorer to easily see which processes were involved in starting the problem application (Task Manager makes it difficult to quickly see which processes are starting and stopping). An Internet Explorer shortcut to a login page actually initiates the launching of the stock trading application, and, after logging in, two processes are spawned, javaws.exe and javaw.exe:

Read the rest of this entry »

If you enable “Show icon in the notification area when connected” for your LAN or other network device, a small icon will blink on and off in the system tray, which gives you a simple visual indication of network activity.

One day I noticed that this icon was solid … always. I double-clicked on the icon to see the number of packets passing to and from the Local Area Connection. Read the rest of this entry »