Advertisement
itnetsec

Fixing a broken TCP/IP stack in Windows - For advanced users

Nov 29th, 2011
147
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 10.06 KB | None | 0 0
  1. #Written by: Michael Wood
  2. #Date 11-29-2011
  3.  
  4. Ways you can tell it's broken is:
  5. Computer will not pull a DHCP address
  6. Running the command "ipconfig" will result in an error message
  7. Obviously, you wouldn't be able to ping any address
  8.  
  9. Most people, when it comes to fixing the TCP/IP stack in Windows, would run the command:
  10. netsh int ip reset resetlog.txt
  11.  
  12. Then restart the machine.
  13.  
  14. This above command rewrites two registry keys that are used by TCP/IP:
  15. SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\
  16. SYSTEM\CurrentControlSet\Services\DHCP\Parameters\
  17.  
  18. Here is what the log file would look like after running the command:
  19. (Note: When the TCP/IP registry keys have not been altered from their original configuration, there might be no actions logged in the file)
  20.  
  21. #BEGIN LOG#
  22. reset SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\Options\15\RegLocation
  23. old REG_MULTI_SZ =
  24. SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\?\DhcpDomain
  25. SYSTEM\CurrentControlSet\Services\TcpIp\Parameters\DhcpDomain
  26.  
  27. added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{2DDD011E-B1B6-4886-87AC-B4E72693D10C}\NetbiosOptions
  28. added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{BAA9D128-54BB-43F6-8922-313D537BE03E}\NetbiosOptions
  29. reset SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{BD2859BA-B26A-4E2B-A3FE-3D246F90A81A}\NameServerList
  30. old REG_MULTI_SZ =
  31. 10.1.1.2
  32.  
  33. deleted SYSTEM\CurrentControlSet\Services\Netbt\Parameters\EnableLmhosts
  34. added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2DDD011E-B1B6-4886-87AC-B4E72693D10C}\AddressType
  35. added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2DDD011E-B1B6-4886-87AC-B4E72693D10C}\DefaultGatewayMetric
  36. added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2DDD011E-B1B6-4886-87AC-B4E72693D10C}\DisableDynamicUpdate
  37. deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2DDD011E-B1B6-4886-87AC-B4E72693D10C}\DontAddDefaultGateway
  38. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2DDD011E-B1B6-4886-87AC-B4E72693D10C}\EnableDhcp
  39. old REG_DWORD = 0
  40.  
  41. added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2DDD011E-B1B6-4886-87AC-B4E72693D10C}\NameServer
  42. added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2DDD011E-B1B6-4886-87AC-B4E72693D10C}\RawIpAllowedProtocols
  43. added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2DDD011E-B1B6-4886-87AC-B4E72693D10C}\TcpAllowedPorts
  44. added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2DDD011E-B1B6-4886-87AC-B4E72693D10C}\UdpAllowedPorts
  45. added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5B3675C3-6EB9-4936-B991-04DA31024C4E}\DisableDynamicUpdate
  46. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5B3675C3-6EB9-4936-B991-04DA31024C4E}\EnableDhcp
  47. old REG_DWORD = 0
  48.  
  49. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5B3675C3-6EB9-4936-B991-04DA31024C4E}\IpAddress
  50. old REG_MULTI_SZ =
  51. 12.12.12.12
  52.  
  53. deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5B3675C3-6EB9-4936-B991-04DA31024C4E}\IpAutoconfigurationAddress
  54. deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5B3675C3-6EB9-4936-B991-04DA31024C4E}\IpAutoconfigurationMask
  55. deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5B3675C3-6EB9-4936-B991-04DA31024C4E}\IpAutoconfigurationSeed
  56. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5B3675C3-6EB9-4936-B991-04DA31024C4E}\RawIpAllowedProtocols
  57. old REG_MULTI_SZ =
  58. 0
  59.  
  60. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5B3675C3-6EB9-4936-B991-04DA31024C4E}\SubnetMask
  61. old REG_MULTI_SZ =
  62. 255.255.255.0
  63.  
  64. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5B3675C3-6EB9-4936-B991-04DA31024C4E}\TcpAllowedPorts
  65. old REG_MULTI_SZ =
  66. 0
  67.  
  68. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5B3675C3-6EB9-4936-B991-04DA31024C4E}\UdpAllowedPorts
  69. old REG_MULTI_SZ =
  70. 0
  71.  
  72. added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BAA9D128-54BB-43F6-8922-313D537BE03E}\AddressType
  73. added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BAA9D128-54BB-43F6-8922-313D537BE03E}\DefaultGatewayMetric
  74. added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BAA9D128-54BB-43F6-8922-313D537BE03E}\DisableDynamicUpdate
  75. deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BAA9D128-54BB-43F6-8922-313D537BE03E}\DontAddDefaultGateway
  76. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BAA9D128-54BB-43F6-8922-313D537BE03E}\EnableDhcp
  77. old REG_DWORD = 0
  78.  
  79. added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BAA9D128-54BB-43F6-8922-313D537BE03E}\NameServer
  80. added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BAA9D128-54BB-43F6-8922-313D537BE03E}\RawIpAllowedProtocols
  81. added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BAA9D128-54BB-43F6-8922-313D537BE03E}\TcpAllowedPorts
  82. added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BAA9D128-54BB-43F6-8922-313D537BE03E}\UdpAllowedPorts
  83. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BD2859BA-B26A-4E2B-A3FE-3D246F90A81A}\DefaultGateway
  84. old REG_MULTI_SZ =
  85. 10.1.1.2
  86.  
  87.  
  88. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BD2859BA-B26A-4E2B-A3FE-3D246F90A81A}\DefaultGatewayMetric
  89. old REG_MULTI_SZ =
  90. 0
  91.  
  92.  
  93. added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BD2859BA-B26A-4E2B-A3FE-3D246F90A81A}\DisableDynamicUpdate
  94. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BD2859BA-B26A-4E2B-A3FE-3D246F90A81A}\EnableDhcp
  95. old REG_DWORD = 0
  96.  
  97. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BD2859BA-B26A-4E2B-A3FE-3D246F90A81A}\IpAddress
  98. old REG_MULTI_SZ =
  99. 10.1.1.1
  100.  
  101.  
  102. deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BD2859BA-B26A-4E2B-A3FE-3D246F90A81A}\IpAutoconfigurationAddress
  103. deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BD2859BA-B26A-4E2B-A3FE-3D246F90A81A}\IpAutoconfigurationMask
  104. deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BD2859BA-B26A-4E2B-A3FE-3D246F90A81A}\IpAutoconfigurationSeed
  105. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BD2859BA-B26A-4E2B-A3FE-3D246F90A81A}\NameServer
  106. old REG_SZ = 10.1.1.2,10.1.1.3
  107.  
  108. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BD2859BA-B26A-4E2B-A3FE-3D246F90A81A}\RawIpAllowedProtocols
  109. old REG_MULTI_SZ =
  110. 0
  111.  
  112. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BD2859BA-B26A-4E2B-A3FE-3D246F90A81A}\SubnetMask
  113. old REG_MULTI_SZ =
  114. 255.255.255.0
  115.  
  116.  
  117. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BD2859BA-B26A-4E2B-A3FE-3D246F90A81A}\TcpAllowedPorts
  118. old REG_MULTI_SZ =
  119. 0
  120.  
  121. reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BD2859BA-B26A-4E2B-A3FE-3D246F90A81A}\UdpAllowedPorts
  122. old REG_MULTI_SZ =
  123. 0
  124.  
  125. deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DontAddDefaultGatewayDefault
  126. deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableIcmpRedirect
  127. deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableSecurityFilters
  128. deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\SearchList
  129. deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\UseDomainNameDevolution
  130. <completed>Note In Windows Server 2003 Service Pack 1, you can use the netsh winsock reset command to repair Winsock.
  131. #END LOG#
  132.  
  133. So, this is all cool and everything but it doesn't always work.
  134.  
  135. The next best thing to do is completely uninstall the TCP/IP protocol!
  136. First, if you browse to your network connections and right click on the "Local Area Connection" and choose "Properties" the Local Area Connection properties window is displayed. In this list you should see "Internet Protocol Version 4 (TCP/IPv4)". If you select it you will notice that the "Uninstall" option is greyed out.
  137.  
  138. Now for the fun part!
  139.  
  140. Browse to C:Windows\inf (make sure you can view all hidden files and protected operating system files)
  141. Locate the file "nettcpip.inf" and open it with Notepad (or whatever text editor you use).
  142. Locate this section:
  143. #BEGIN#
  144. ;=======================
  145. ; TCP/IP Primary Install
  146. ;=======================
  147.  
  148. [MS_TCPIP.PrimaryInstall]
  149. ; TCPIP has properties to display
  150. Characteristics = 0xA0 ; NCF_HAS_UI | NCF_NOT_USER_REMOVABLE
  151. AddReg = Registry.MS_TCPIP.PrimaryInstall, Registry.MS_TCPIP, Registry.MS_TCPIP.Legacy
  152. #END#
  153.  
  154. The line containing "Characteristics = 0xA0 ; NCF_HAS_UI | NCF_NOT_USER_REMOVABLE" change the "0xA0" to "0x80" and save the file.
  155.  
  156. Now, go back to your Local Area Connection properties window and select "Install" > "Protocol" > "Add" > "Have disk" > "Browse..."
  157. Select the "nettcpip.inf" in the directory C:\Windows\inf
  158.  
  159. After it installs the driver file the option "Uninstall" should be visible, instead of greyed out. Choose "Uninstall" on "Internet Protocol Version 4 (TCP/IPv4) and restart the machine.
  160.  
  161. When the machine comes back up simply go back to your Local Area Connection properties window and select "Install" > "Protocol" > "Add" > "Have disk" > "Browse..."
  162. Select the "nettcpip.inf" in the directory C:\Windows\inf
  163. After the driver loads restart the machine once more. When it comes back up, you should have a working TCP/IP stack. The network card should have pulled a DHCP address and the "ipconfig" command should give you the correct output.
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement