"The Network Map" — Windows Networking & Remote Access

Every device on a TCP/IP network needs a unique IP address to communicate. An IPv4 address is a 32-bit number, typically written in dotted-decimal notation — four octets separated by dots, like 10.10.30.104.

An IP address has two parts: the network portion (which network the device belongs to) and the host portion (which specific device on that network). The subnet mask tells the system where the dividing line is.

The default gateway is the router interface that connects your subnet to other networks. When a device wants to talk to an IP address outside its own subnet, it sends the packet to its default gateway, which routes it onward. At Meridian Dynamics, each VLAN has its own gateway (e.g., 10.10.30.1 for IT-ADMIN, 10.10.40.1 for CORP-WIFI).

DNS translates human-friendly names (like md-fs01.meridian.local) into IP addresses (like 10.10.10.12). Without DNS, you'd have to memorize IP addresses for every server you need to reach.

DNS resolution follows a hierarchy. When your workstation needs to resolve a name, it first checks its local DNS cache. If the name isn't cached, it sends a query to the configured DNS server (at Meridian, that's MD-DC01 at 10.10.10.10). If the DNS server doesn't have the answer, it queries upstream — root nameservers, TLD nameservers, and finally the authoritative nameserver for the target domain.

DHCP automatically assigns IP addresses and network configuration to devices when they connect. Without DHCP, every device would need to be configured manually — a nightmare in an organization with hundreds of machines.

The DHCP process follows four steps, known as DORA:

Lease time determines how long a device keeps its IP address before it must renew. Short leases (e.g., 1 hour) are good for guest networks where devices come and go. Longer leases (e.g., 8+ hours) reduce DHCP traffic on stable networks.

DHCP reservations let you "pre-assign" a specific IP to a specific MAC address. The device still uses DHCP (gets its config automatically), but always receives the same IP. Servers and printers often use reservations so they have predictable addresses.

A VLAN (Virtual LAN) logically divides a physical switch into separate broadcast domains. Devices on different VLANs cannot communicate with each other directly — they need a router (or Layer 3 switch) to route traffic between them. This is called inter-VLAN routing.

VLANs provide security through segmentation. By isolating traffic, a compromised device on the Guest Wi-Fi VLAN cannot directly access the Server VLAN. At Meridian Dynamics, the network is divided into 7 VLANs:

The Windows networking stack is a layered architecture that processes network traffic from application requests down to raw packets on the wire:

• Winsock (Windows Sockets) — The user-mode API that applications use to send and receive network data. When an application calls connect() or send(), it goes through Winsock. This is the Windows implementation of the Berkeley sockets API.
• AFD (Ancillary Function Driver) — The kernel-mode driver that implements the actual socket operations. It sits between Winsock in user mode and the transport layer (TCP/IP) in kernel mode.
• TCP/IP Stack (tcpip.sys) — The kernel-mode driver that implements TCP, UDP, IP, ICMP, and other protocols. Handles packet construction, routing decisions, and fragmentation.
• WFP (Windows Filtering Platform) — A framework built into the TCP/IP stack that provides packet filtering and inspection. Windows Firewall, third-party firewalls, and VPN clients all plug into WFP. It operates at multiple layers, from the application layer down to the network layer.
• NDIS (Network Driver Interface Specification) — The interface between the protocol stack and the network adapter driver. NDIS allows multiple protocols to share a single network adapter and multiple adapters to serve a single protocol. Miniport drivers (for NICs) register with NDIS.

Understanding this stack helps you diagnose where a network problem occurs. If ping works but a specific application fails, the problem is likely above the TCP/IP layer (Winsock, application config, or WFP filtering). If ping fails, the problem is at the TCP/IP layer or below (routing, NDIS, hardware).

When Windows needs to resolve a hostname, it doesn't just use DNS. It follows a specific name resolution order:

1. Local Hosts file (C:\Windows\System32\drivers\etc\hosts) — A static text file mapping names to IPs. Checked first.
2. DNS Cache — Previously resolved names cached in memory. View with ipconfig /displaydns.
3. DNS Server Query — The configured DNS server (10.10.10.10 at Meridian).
4. LLMNR (Link-Local Multicast Name Resolution) — If DNS fails, Windows broadcasts an LLMNR query to the local subnet (multicast to 224.0.0.252).
5. NetBIOS Name Service (NBT-NS) — Legacy broadcast name resolution on UDP port 137.
6. mDNS (Multicast DNS) — Used on newer systems, multicast to 224.0.0.251.

SMB (Server Message Block) is the protocol Windows uses for file sharing, printer sharing, and inter-process communication. It operates over TCP port 445.

Windows provides multiple remote access technologies for managing systems without physical access:

These are the essential command-line tools every IT professional needs for diagnosing network problems on Windows: