NetScanTools® Inside Out

NetScanTools Pro 11.20 Released January 19

2012-01-19T20:28:00.000-08:00

NetScanTools Pro v11.20 was release today. It has one new tool and 2 revised tools.

The new tool is called Country to IP or ASN. Select a country from the list and find the IPv4, IPv6 or ASN records assigned or allocated to that country. This tool works from a local database that is updated with each release. It is a complementary tool to the IP to Country tool and there are now 'jump' buttons on each to switch between them. This tool is really useful if you maintain a firewall or an email server. If you prefer to block a whole country - this is where you get your information.

DHCP Server Discovery now has the ability to do DHCP Discovery on more than one network. You can now select the network interface to do the discovery on. This would apply to a laptop running both a wired and wireless connection.

Port Scanner now allows you to do a port scan on a list of IPv4 addresses. This was something that existed in v10 and earlier, but we did not have it ready for the release of version 11. It's back and better than before.

There are a few other minor fixes. This release was planned for December, but some users made suggestions that were necessary (like the DHCP changes) and here we are.

Look for the USB version patch release next week.

Kirk

Managed Switch Port Mapping Tool v1.99.9.2 Released

2012-01-09T10:00:00.000-08:00

v1.99.9.2 was released on Friday, January 6, 2012. This release has significant improvements to the qBridge mib processing algorithm. This version was tested extensively with Juniper switches in an enterprise setting and we think you will see quite a bit of improvement when mapping switches that report using qBridge mib. Cisco users will not see any change since Cisco uses standard bridge mib for reporting (with the exception of the Small Business series). Switch brands that may see mapping improvements are HP, Juniper, Netgear, D-Link, 3Com, Linksys, SMC, Nortel and the Cisco Small Business Series.

Please visit http://www.SwitchPortMapper.com/ to get the latest release or click on Help/Check for Update from within the program. If you need more trial time, please contact us.

Managed Switch Port Mapping Tool v1.99.9.1 Released

2012-01-03T14:53:00.000-08:00

Yes, I know the version numbers look out of control - but it's a real important minor version. Only 5 lines of code changed, but they affected the way a table was updated from qBridge mib data. It's working fine now and this was all thanks to an end-user who made me aware of the problem on Friday Dec 30 (why is it always a Friday?).

Come and get it:
http://www.SwitchPortMapper.com/

Or if you have the program installed, click on Help/Check for Update.

Recent Software Releases

2011-12-07T09:07:00.000-08:00

We have put out several new releases in October, November and December. Let's start with the Managed Switch Port Mapping Tool. We released 1.99.6, 1.99.7, 1.99.8 and we are now on v1.99.9. These new versions address issues recently found during our work on v2.0 and we added some new minor features.

We also released ipPulse v1.81 and v1.82 in that same timeframe. The most important changes were in the secure email sending section of the program.

NetScanTools Pro was also updated with a minor release 11.11 back in October. There will be one more release of it before the end of the year.

The new IPv6ScopeFinder program was also released back in October. It's free so try it out if you use IPv6.

-Kirk

IPv6ScopeFinder

2011-10-18T16:41:00.001-07:00

What? It's a new freeware tool designed to quickly help you locate the right Scope ID to use when trying to send packets to a neighboring link local IPv6 address. For instance, you could use it to find the ScopeID when you needed to use command line ping to find out if IPv6 is working on the workstation across the room. I'm talking about the part of the link local address after the percent sign: fe80:11:22:33%6, where '6' is the Scope ID of the network interface on your machine that connects to the network that routes packets to the machine with the IPv6 address fe80:11:22:33.

Read about it and download it here.

IsThreadDesktopComposited prevents program startup

2011-10-07T14:28:00.000-07:00

Problem: a NetScanTools Pro v11.10 user emailed with a strange problem. He could not get NetScanTools Pro to start on Windows XP sp3, instead he would get this message: "Entry Point Not Found. The procedure entry point IsThreadDesktopComposited could not be located in the dynamic link library USER32.DLL."

The first thing I did was use Dependency Walker to see if our program called that entry point in user32.dll. It did not. So I searched online and found the answer.

Apparently some misguided installers are putting a Vista file called dwmapi.dll into the Windows XP Windows\System32 directory. Some programs like NetScanTools Pro v11 are affected by this and give the IsThreadDesktopComposited error. Some people have noticed this happening after a Windows Live Messenger or Mail upgrade but I have not independently confirmed this.

Solution:
1. locate dwmapi.dll in the windows\system32 directory
2. rename or remove it
3. reboot to be sure it's unloaded from memory

IPv6 on Windows XP

2011-09-16T10:35:00.000-07:00

Back on June 21 I posted about IPv6 teredo interface not working on Windows 7 and how to correct this using commmand prompt netsh commands.

Just in case anyone is having the same problem on Windows XP, here is the solution for it. The problem is the same, the commands are slightly different.

Command for showing the teredo interface state:
netsh interface ipv6 show teredo

If it says the state is offline with error of none, try this:
netsh interface ipv6 set teredo enterpriseclient

That should do it. The IPv6 network components were incorrectly thinking your computer was in an enterprise situation.

Looking for a Packet Flooder?

2011-09-15T11:03:00.000-07:00

Check out the video on youtube after you read this post.

We have noticed that many people looking at our Packet Generator got there because they were looking for a 'Traffic Generator' or a 'Packet Flooder' - but found that the Packet Generator is really not capable of filling an interface up to the bandwidth they want. They now have their wish. And it works with IPv4 or IPv6.

NetScanTools Pro v11.10 (not released yet) has a new tool called 'Packet Flooder'. It can generate UDP packets at a very fast rate using multithreading. The packet payload can be either random numbers or alphabetical 'abcdefg' etc. The payload length can be random or fixed. The target port can be random or fixed.

Another new thing you may notice is the bandwidth gauge and historical chart. You are going to see more of these in future versions. The gauge shows the real time bandwidth utilization and the historical chart shows it over time.

Enjoy!

Labor Day Sale

2011-09-03T22:00:00.000-07:00

This weekend and through Tuesday Sept 6, 2011 we are having a Labor Day Sale. The biggest discount is NetScanTools LE - 62% off. So instead of $129, it's now $49 this weekend only. We also have a 25% discount on NetScanTools Pro installed or USB, the Managed Switch Port Mapping Tool, ipPulse and the Pro/Switch Port Mapper bundle.

Drop by http://www.netscantools.com/labordaysale.html and check out the savings.

Have a great holiday weekend!

IPv6 Link Local Addressing

2011-09-02T21:33:00.000-07:00

As I've been working to adding IPv6 capabilities to NetScanTools Pro. As I have worked with link local addressing I have learn some interesting things. In the IPv4 world if you want to ping an address or connect to a computer on your local network, the software can easily find out the best interface (if you have more than one) to send packets out of to the other computer - all you had to do was supply the IP address. It does this using routing tables and ARP.

In IPv6, it's not quite so easy. In Windows or any other OS, you will often have two or more interfaces capable of talking IPv6. Since all link local addresses begin with FE80:, there is no method for saying this one address is on this segment and this one is on that segment like there is in IPv4 (by using IP address and subnet mask).

Essentially you have to tell the software you are using which interface to use to get to the link local address. If you have one interface to your switch and all the other devices are on the same VLAN, then it's pretty easy. You do this by appending a %# where # is the IPv6 interface number in Windows - also called the Scope ID. In unix derived operating systems like Ubuntu or OS X Lion, you would use %eth0 for the main interface.

How do you know which interface to use? That's where you have to know your network. In my case, this particular XP machine assigns '6' as the Scope ID - you can see this using ipconfig /all. It could be any number, but it's usually a single digit. So to ping an IPv6 address you would enter smoething lik "ping -6 FE80::3CC0:1%6" on the command line (no quotes). Or if you were using NetScanTools Pro v11 Ping Enhanced you would enter FE80::3CC0:1%6 as the target. If you leave off the %6 or change it to another number the software will not know which interface to send the packets out of. In NetScanTools Pro, you will see an error message. The command line ping will tell you the net is unreachable if you use the wrong Scope ID.

Just a few things I've learned about IPv6 link local addressing.

Installing Wireshark on a USB flash drive with NetScanTools Pro

2011-08-17T08:01:00.000-07:00

You may or may not know it, but Wireshark (www.wireshark.org) also comes as a portable version that you can install on a USB flash drive. I did a tutorial video on how to install it on a USB flash drive. I also show how to link NetScanTools Pro 11 to Wireshark so that you can launch Wireshark from within NetScanTools Pro. Pretty cool. They can both live on the USB and be fully portable, no installation required.

It's on youtube and will be on the videos section of netscantools.com soon.

http://www.youtube.com/watch?v=ZAhnuZiOSR0

Kirk

NetScanTools (r) Basic Edition 2.2 Released August 11, 2011

2011-08-12T10:19:00.000-07:00

This new release of NetScanTools Basic has some user interface cleanup and adds a link to signup to be notified when a new release is ready.

The tools are still the same in this release.

We have some facinating plans for v3 - but I can't talk about them yet.

Windows XP suddenly got real slow

2011-08-09T08:34:00.000-07:00

Last Friday I was trying out GMER, a rootkit detector and remover on our oldest XP machine using IDE ATA/ATAPI disks. It seemed to work fine, but since there were lots of files, I stopped it after a couple hours. Then I noticed something: the cursor was 'jumpy' and the computer seemed a bit slow. GMER (http://www.gmer.net/) didn't find anything bad, but that was the only thing that I had used on the machine that was out of the ordinary. So I shut the computer down until Saturday evening. I started it up to do backups. The Acronis backup software claimed it was going to take 6 hours to do an incremental backup - it usually takes less than half an hour. What was going on?

I noticed that the cursor was still jumpy. Strange. I started Task Manager and saw that most CPU activity was in 'System Idle Process' so there wasn't any specific program hogging CPU time. So I ran a chkdsk from the command line. It was so slow I had to terminate it. More strangeness. I checked the event log and saw no errors - I was looking specifically for disk errors. Just to be safe I did a chkdsk /f and rebooted. Went away for an hour and XP was finally back up when I came back. But still the cursor was jumpy.

Next I used SysInternals (MS) Process Explorer and saw the real problem: Hardware Interrupts. Normally interrupts account for less than 5% of CPU time, but they were going up into the 90%+ range whenever any program touched the hard drive. This meant something was wrong with the hard drive itself or the interface. After a long search on Google I found the answer.

Apparently XP will change the disk controller transfer mode from the DMA transfer modes (Ultra DMA in our case) stepwise all the way down to slow PIO (parallel IO) mode in steps if six or more timeout or CRC errors are seen. By going to Computer Management/Device Manager I could see that the boot drive C: was in PIO mode. Apparently GMER hit the disk hard enough (combined with the age of the machine) that it had enough drive errors to lower it to PIO mode.

How get it back to Ultra DMA mode: from Device Manager right click on the offending IDE channel (drive 0) in my case, then select Uninstall. Now restart. Sounds scary, but it's not because it does actually reboot OK. After it starts, it will ask you to confirm changes and it will restart again. Problem solved.

This process and a full explanation of what is happening can be found at:
http://support.microsoft.com/kb/817472 - don't bother with the hotfixes, they apply to earlier SP's, I had SP3. The section marked 'workaround' is the one I used.

I don't think I'll be using GMER on that particular machine again, but I've used it on other machines - no rootkits.

New Installer for NetScanTools Pro v10 Demo

2011-08-08T20:54:00.000-07:00

Yes, I know your question - where is the v11 demo? not done yet.

For years we've been using the old Wise 9 Standard Edition Installer. As of today there is one less thing using it: the NetScanTools Pro v10 Demo now uses Inno Setup. This is a great installer and it produces an install file that's 7MB smaller than Wise while accomplishing the exact same thing.

I'll be converting the Pro v11 installer to Inno Setup soon. A little more involved than the demo, but not impossible. Once that's done, the only thing using Wise will be the patch for the USB. I don't have a good replacement for that yet. Suggestions?

Changes coming in Packet Generator

2011-08-04T08:19:00.000-07:00

Changes are coming to NetScanTools Pro v11 Packet Generator that will help you do QoS testing. Lots of work has gone into changing the interpacket timing algorithms so that the leading edge (beginning) of a packet is as close as possible to the timing you have entered. For instance, if you have entered a 10ms packet interval (interpacket timing), Packet Generator now puts the packets out at the desired interval with microsecond resolution.

This new algorithm will be applied to all packet types, TCP, UDP, ICMP, CDP and RAW. It is best used for sending UDP packets because if you are thinking VOIP or video that's where things like jitter and packet delay variation are important.

Other changes to Packet Generator include the removal of that floating status window - it caused timing delays due to updating the window. The new packet burst mode is now operational where if you put the packet delay at zero (0), it sends a burst of packets defined by the number of duplicated packets to send out to the target. This burst mode sends the packets as fast as the interface can send them.

Both accurate interpacket timing and burst mode can be helpful in termining the location of bottlenecks and poorly performing devices.

A couple other things are being added to Packet Generator before release - and there was one bug that was fixed which affected users that have more than one outgoing interface.

New NetScanTools LE Video

2011-08-02T09:34:00.000-07:00

I posted a fairly detailed overview of NetScanTools LE (Law Enforcement edition). Please have a look:

http://www.youtube.com/watch?v=7npesBKfMoc

Managed Switch Port Mapping Tool v1.99.5 Released

2011-07-28T11:11:00.000-07:00

This latest release was made available for download today. It adds support for SMC switches. We tested it thoroughly with an SMC6128L2 switch and there are now SMC specific extensions in our software to gather more information about the switch.

There was one fundamental operational change that you should be aware of: ping sweep has been moved up near the start of the switch mapping process. This was done to force the switch to update it's bridge tables with any mac addresses that may have 'aged' out of the tables. That way as many devices as possible will be seen. Be sure to put in all the IPv4 ranges you need to be pinged ahead of time.

Another set of changed dealt with the operation of the IP to hostname resolver. We added a control in Settings to turn use of the caching table on or off. We also added a control in Settings to be sure that it is erased on exit. The reasoning behind this is that in a DHCP environment, IPs change and you should probably be clearing the table more often. The table is used much like a 'hosts' file for quick resolution of IPv4 addresses to hostnames in successive mappings. This will become more necessary in v2.0. In order to minimize DNS queries, we use this table. Now there are more options for erasing it to remove what will become stale information. One other thing we added was a check for duplicate hostnames - what we mean by this is two IPs having the same hostname. If this is found, you get to see the hostname(s) and IPs that are sharing the hostname. You would definitely want to manually erase the IP/hostname Resolver table in Database Maintenance if this occurs. If it repeats after doing that, you have a DNS problem.

Another change was in the area of print margins. A user pointed out that the print margins were rather large. Investigation revealed that the default margins were supposed to be 25mm. But in reality it was more like 250mm or one inch. If you are using a 96 dpi printer, then it is one inch. The File menu now has Print Page Options to allow you to change this.

Finally, in an effort to get away from the ancient Wise installer that we've used for years, this release now uses Inno Setup. Inno Setup reduced the size of the installer by around 1 MB. That doesn't sound like much but it is when you consider many downloads. It's also a modern and fast installer, so it works better on Windows 7.

http://www.switchportmapper.com/
or
http://www.netscantools.com/spmapmain.html

Enjoy!
Kirk

Need to know what's attached to your Nortel switch?

2011-07-20T12:34:00.000-07:00

Watch this video to see how to use the Managed Switch Port Mapping tool to find out what's attached to a Nortel® BES110-24T switch.

http://www.youtube.com/watch?v=DhDimMRpO8I

Enjoy!

NetScanTools (r) Basic Edition 2.1 Released July 8, 2011

2011-07-11T10:52:00.000-07:00

On Friday we released NetScanTools Basic 2.1 - our first update to this software since January 2010. This is our freeware version of NetScanTools. It has just a few helpful tools that introduce people to the NetScanTools Product line.

Tools:
DNS Tools - simple query (ipv4 to hostname etc.), Who Am I (shows your IPv4 address, hostname and DNS servers), Test Default DNS (takes IP address or hostname and asks each default DNS server for translation).

Ping - uses standard ICMP ping to contact an IPv4 or hostname.

Graphical Ping - uses standard ICMP ping to contact an IPv4 or hostname and it graphs the response times over time.

Traceroute - uses ICMP packets to show the route between your computer and a target computer.

Ping Scanner - uses ICMP packets to ping every IPv4 address between a start and ending IPv4 address.

Whois - shows basic whois information for around 70 domain extensions and IPv4 addresses.

These tools are simplified in comparison to NetScanTools Pro which means you don't have all the options available and you only get one mode of operation - for example traceroute is ICMP only instead of ICMP, UDP, TCP etc.

Have a look and enjoy!
Kirk

IPv6 Teredo Problems and Solutions on Windows 7-64 bit

2011-06-21T11:51:00.000-07:00

I came back from the Wireshark Sharkfest '11 Conference excited to try some of the things I had learned. Imagine my dismay when I fired up my Windows 7-64 test box only to find that certain parts of NetScanTools Pro 11 that are IPv6 aware ceased working. Immediately I was able to see that it was the parts of the program that depended on the getaddrinfo function call that were failing. How did I know that? I used the other 'home-grown' NetScanTools resolver functions to talk with DNS (they bypass Windows resolver entirely and talk directly to any DNS) and by using Wireshark I could see the AAAA records coming back from DNS. I could see that the getaddrinfo function was not getting and reporting the IPv6 AAAA records. Very strange.

So I looked at a couple of things. First I did a cursory check of the network settings with ipconfig. All appeared normal. Then I spent some time recompiling NetScanTools Pro while playing around with various options in the addrinfo hints structure passed into getaddrinfo. That was not fruitful. Nothing I did could make the getaddrinfo function return the AAAA record. I was seeing the 11004 WSANO_DATA error. So I put that aside and looked more carefully at the IPv6 networking subsystem.

Next I tried to see if it was NetScanTools failing or something deeper. So I tried using command line "ping -6 ipv6.google.com". This failed with a message effectively admitting that it couldn't resolve the hostname to an IPv6. Good - sort of. Next I tried the other way doing a "ping -6 2001:4860:b006::69". That came back with even more ominous wording "Ping transmit failed. General Failure.". But I could use both command line ping and NetScanTools Pro IPv6 Ping to contact Link-Local IPv6 addresses on my local network - as I should be able to do. The IPv6 routing table didn't yield any real clues either.

Using both NetScanTools Pro, ipconfig and various netsh command line things I was able to see that while isatap was active, I was not seeing teredo - I had seen it before when using command line ping and when using NetScanTools Pro. Teredo was what I wanted to try decoding with Wireshark. NetScanTools Pro showed me that Teredo was there but it had an admin status of 'Down'. So I tried various netsh commands to reactivate Teredo. They all appeared to work, but Teredo never reappeared in the list of hidden devices in Device Manager. I tried the solutions floating around on the internet for making sure IPv6 was active and getting Teredo to show up in Device Manager, but still no luck.

A little history might help. I had recently installed VMware Workstation 7.1.4 on that machine because it's a test machine and I needed lots of OS's available. Could it be that? I don't know for sure because I spent time on VMware forums looking for similar problems - but didn't see any. It could have been a Windows Update patch that turned off Teredo, but I just don't know for sure. The two VMware Virtual Ethernet Adapters both had link-local fe80 IPv6 addresses, so IPv6 wasn't entirely dead. AND of all things, I could start Windows Server 2008 in a virtual machine with all of it's IPv6 functions working perfectly including NetScanTools Pro. I did find this page dealing with firewall settings for Teredo and found that everything was OK: http://support.microsoft.com/kb/968510

So today I spent lots of time with the netsh commands. I used "netsh interface IP show config" to see all the interfaces similar to ipconfig. By doing a "netsh interface ipv6 show interface" I could see all the active connections. What was missing was Teredo. I used "netsh interface set interface teredo set state default" to make sure it was there and it answered OK. But still no Teredo. Then I found this interesting command "netsh interface IPv6 show teredo". It said the State was 'offline' and the Error value was "client is in a managed network". Progress. Big progress.

So I put that error string into google and found a reference to this blog: http://blogs.msdn.com/b/p2p/archive/2007/03/22/teredo-and-the-pnrp-global-cloud.aspx
Essentially Teredo detected (incorrectly) that the machine was in a corporate environment - this is probably due to multiple OS's and several switches being active with all their chatter. So the fix was to use "Netsh interface teredo set state enterpriseclient". Once I did that, there was no need for rebooting or anything. "netsh interface IPv6 show teredo" now showed the correct info like Local Mapping and External NAT Mapping. And all of a sudden both command line ping and NetScanTools Pro IPv6 enabled tools began to work again.

I guess the thing that bugs me is this: why is there this huge dependency on Teredo for IPv6 in Windows 7? If I ask for a name resolution using getaddrinfo with a hint of AF_INET6 I EXPECT a response if AAAA records are coming back from the default dhcp assigned system DNS. It shouldn't matter that IPv6 is fully enabled on the system using Teredo or anything else. So my workaround will be to write EXTRA CODE to resend an AAAA or PTR record request from my own private resolver on failure of getaddrinfo because I can't trust it. I hope someone at Microsoft reads this and helps me understand why it was behaving this way.

All I wanted to do was try to decode Teredo traffic with Wireshark...

Kirk Thomas
NetScanTools Developer and Sharkfest '11 attendee

Managed Switch Port Mapping Tool v1.99.4

2011-06-12T22:41:00.000-07:00

On June 9 we released the latest version of the Managed Switch Port Mapping Tool. It addressed an ongoing problem we had been having with Side by Side DLL configurations - we switched to static linking to eliminate this nagging problem. We also fixed a problem that usually only showed up if you were using a low color resolution screen such as when you run the program using Remote Desktop. If you viewed the About information on low color resolution, it would crash - it no longer does that. We also tested the software successfully with HP ProCurve 1810G-8 Switch running their new p2.2 firmware and made a minor change that allows mapping of older Enterasys Cabletron switches. In keeping with current conventions and the changes made in NetScanTools Pro v11, the word Setup was replaced with Settings throughout the program.

Please visit http://www.switchportmapper.com/ to download the free 30 trial. If you need a trial period reset code, please contact our sales dept.

Kirk

ipPulse 1.80 mentioned in the press

2011-05-25T13:36:00.000-07:00

On May 16, TMCnet published an article about our recent release of ipPulse 1.80:

http://ipcommunications.tmcnet.com/topics/ip-communications/articles/175157-ippulse-version-180-simplifies-monitoring-ipv4-connected-devices.htm

Thanks to Mini Swamy, a contributing editor for TMCnet.

Kevin Beaver Review of NetScanTools Pro v11

2011-05-25T13:24:00.000-07:00

Kevin Beaver, the author of Hacking for Dummies , did a nice review of NetScanTools Pro v11 today. It's here on his blog:

http://securityonwheels.blogspot.com/2011/05/if-you-dont-have-netscantools-pro-v11.html

Thanks Kevin! You can follow Kevin on twitter@kevinbeaver

Newspaper article on our business

2011-05-18T12:46:00.000-07:00

You can read about us today in the Sequim Gazette:

http://www.sequimgazette.com/business/article.exm/2011-05-18_fortune_500_companies_seek_assistance_in_sequim

Kirk

ipPulse 1.80 released May 10, 2011

2011-05-10T16:36:00.000-07:00

Today I released ipPulse 1.80 in response to a customer request to add the ability to send alert emails through secure email servers. It can now do that. I've tested it with our own servers and also with Yahoo, Gmail, and Hotmail/Live servers. Those last three servers require security, so it was pretty necessary. There were also some other changes - here are the details:

-Added the ability to send notification emails through secure email servers using TLS. This allows you to send notifications through a number of services including Yahoo, Hotmail and Gmail. Examples are in the help file.
-Updated the program icon.
-Renamed Setup to Settings. This is a more commonly understood term for the program settings.
-Added button to select a minimal set of columns in the Settings/Program Control/Edit Column Visibility window.
-Added logic to define a minimal set of columns in case all saved columns are invisible.
-Reformatted and revised help file.

If you have the unlocked version of ipPulse, please download and install over the top. Also, be sure to test sending an email before actually running ipPulse against a list of IPs. Turn on SMTP logging while you do the test so that you can see what's happening.

ipPulse 1.80 is here:
http://www.nwpsw.com/ippulsemain.html

NetScanTools Pro 11.01 Released April 18

2011-04-21T20:05:00.000-07:00

Yes, after only two weeks, out comes another release. During those two weeks work was being done on the USB version. And, of course, our customers did find a few things we needed to fix and those are done. This release addresses the problem of running the program on less than 32 bits per pixel color depth and some other problems with Automated Tools. So now both the installed version and USB version are done. The databases were updated too.

Please be sure to explore the new features like sending RAW ethernet packets. This is cool because you can craft and send anything you want - malformed packets or OK packets. SNMP also now supports version 3, there is a completely rewritten Connection Monitor, a Routing Table tool and more. Don't forget to use the 'Add to Favorites' checkbox on each manual tool. That way you won't be scrolling through tools looking for your favorites.

Kirk

NetScanTools Pro 11 finally released!

2011-04-08T08:09:00.000-07:00

After a year+ of work, NetScanTools Pro version 11 was released. There are many new and improved things in this release that I'm sure you will be interested in. This is a true major release.

New Interface - completely update and it is still an 'outlook' style interface, there is a left panel control bar and tools appear on the right side. This new interface gives us the ability to bring back 'Favorites' - something that was present in the old 'tabbed' interface of the earlier versions of NetScanTools Pro. You can see a slideshow of it in the screenshot section of the product grid on http://www.netscantools.com/.

The goal of this release was to enhance yet simplify by clearly showing the intended use of each tool. This meant that some tools were split into two parts, for example the ARP tool became the ARP Cache Tool and the ARP Scan Tool. Some tools and things within tools were renamed to conform to industry standard conventions, for example 'Setup' was a more common term when NetScanTools was first released, but now 'Settings' is more common and better understood.

New Tools - Connection Monitor, MAC Address to Manufacturer, Network Interfaces - Wireless, Routing Table - IPV4, and SNMP Scanner Tool.

Additions to current tools:

DNS Tools - Core now has IPv6 Simple Query lookups, Get Basic DNS Records now retrieves the IPv6 AAAA records, we added Flush Default DNS Cache and Edit DNS HOSTS File.

DNS Tools - Advanced has three new tools, IPv4 or Hostname to ASN, Get VOIP SRV Records and Get Misc SRV Records.

Packet Generator now supports sending ARP/RARP packets and RAW packets. RAW packets means that you craft the whole packet from the destination and source ethernet header MAC addresses all the way to the end. And we've added a new tool to help you do that: a Hex Editor.

Ping now supports IPv6 addresses.

Ping Scanner (AKA NetScanner) has the ability to translate IPv4 addresses using either the Default System DNS or a specific DNS. We also added Scan Delay Time to slow it down if necessary and added a way to import an IPv4 list into it. To simplify results, we made the columns dynamic in other words they appear and disappear according to the additional scan tasks settings.

Port Scanner was completely rewritten and works much better than the v10.x predecessor. It's much faster and more accurate. We've added a section for scanning commonly used ports and there's an editor for that list in case you need to change it.

Promiscuous Mode Scanner adds the Multicast Address 3 test.

Service Lookup replaces the old Database Tests.

SMTP Server Tests now supports STARTTLS and you can select the Protocol (TLS1, SSL2, SSL3), Algorithm (DES, 3 DES, MD5, RC4, SHA) and Minimum Key (40-256 bit) Preferences (not all settings are supported in all operating systems).

SNMP was split in two for clarity, Core and Advanced. It now supports all modes of SNMPv3 (you may need to obtain the OpenSSL libeay32.dll for support the authPriv encrypted mode - we cannot distribute that). We have added WalkBulk, GetNext and GetBulk to the Core tool. The Advanced tool has a launcher for both the Dictionary Attack Tool and the new SNMP Scanner Tool. The Dictionary Attack tool is much faster than before in terms of loading a list of IPs and clearing the display.

Whois now supports IPv6 input queries and if you enter a domain, we attempt to do an IPv6 and IPv4 address resolution on the 'www.' prefixed hostname. History buttons have been added so that you can view previous whois queries made during the current session.

This brings us to overall design considerations. Favorites was a common request during the lifetime of version 10. It was not easily done in version 10, but it was a priority goal in version 11. You can now check a box on each manual tool to add it to the left panel Favorites group. As in NetScanTools LE, we now have a mandatory results database. This is required so that we can bring up historical reports from each tool both manual and automated. Automated Tools was completely rewritten. The Automated Tools use an engine to operate each manual tool given the input and the results are saved to the database. In previous versions, the Automated tools were actually a duplicate of the manual tool that did the same action - not efficient. Running more than one tool at a time is important to some customers, so this new program shell gave us the methods for doing so. As in 10.x, reports are shown in the web browser - the database gives us the method to be able to show old reports from other sessions. The left panel now has tool groupings like DNS Tools, Packet Tools etc. This helps users find tools they need quickly. IPv6 will be a focus of version 11. We have some support in there now, but as version evolves, more IPv6 compatibility will be added - stay tuned!

Please review the video and image gallery on the main netscantools.com page. More information will be posted shortly along with new images and videos.

SQLite, AUTO_VACUUM and Windows ACLs

2011-03-15T12:34:00.000-07:00

This article applies to Windows 7 32/64 and Windows Vista 32/64 with UAC active.

In January an enduser pointed out to me that every time he tried to use the Real Time BlackList tool in NetScanTools Pro, he got an SQLite error message about the database being 'read-only' - it could not be opened. The software was installed on Windows 7-64 bit and NetScanTools Pro is operating at 'asInvoker' privilege which is normally USER privileges.

After doing the usual tech support routines by checking file properties, I was stumped - until yesterday when I was able to duplicate it on two Windows 7 machines.

The SQLite database is copied into our own directory created at install time under c:\ProgramData which is the common user data area. The thought was that any account using the program would be able to access the database. That was the idea. It's not the only database we put in there and the others were opening fine so I set out to find out why.

The only thing different about this database is that it has the pragma "AUTO_VACUUM" set. It appears that with AUTO_VACUUM SQLite moves freed pages around within the tables. This requires write privileges. SQLite error messages should do more than simply state that the database is read-only by checking the file ACLs given the calling process account privileges then stating the incompatibility with the current AUTO_VACUUM state.

To see the file access privs on an account level, you have to go into our C:\ProgramData\NWPS\NetScanToolsPro common user directory and do an "icacls *.*" on the command line. You will see that indeed user level privileges (BUILTIN\Users) only have (I)(RX) - inherit, read, execute privileges while the other higher level accounts have (F) full privileges. Since AUTO_VACUUM requires write access to the database to make changes, it will not have the proper privs for a user level account. So, yes, opening the database fails (I just don't think the message is good enough).

So now, how to fix it. Recreating the database with AUTO_VACUUM off fixes it. But what if you need to write (as a USER) to the Real Time Blacklist database using the tool we provide to edit the database? You can't because the administrators group are the owner.

The solution is to change the directory and file ACLs. I did this by modifying the installer to call a function of my own design which applied FULL access privs (grfAccessPermissions=GENERIC_ALL) to grfInheritance=SUB_CONTAINERS_AND_OBJECTS_INHERIT at our NWPS\NetScanToolsPro directory level. If that is done and you do the icacls command, all files in that directory show the "Everyone:(I)(F)" which means that every account can fully access the files and that includes our SQLite database that we couldn't open. You have to use AllocateAndInitializeSid, SetEntriesInAcl, and SetNamedSecurityInfo so accomplish this. You have to do this in the installer because it is running at admin privileges.

To summarize, if you have a program running Windows 7 or Vista at USER level that needs to access an SQLite database with write privileges contained in the C:\ProgramData common user directory that was not created by your program - you've got a problem. And that problem is even worse if it has AUTO_VACUUM enabled. You have to modify the file access privileges to FULL control in order to allow SQLite to operate on the database correctly.

Tip: Find Root DNS for a Top Level Domain

2011-03-03T08:49:00.000-08:00

Have you needed to find the root DNS servers for a particular top level domain?

Applies to: NetScanTools Pro, NetScanTools LE, NetScanTools Basic, NetScanTools Standard (obsolete).

It’s actually pretty easy, but how you enter the top level domain makes all the difference in the world. Examples of a top level domain are: .uk, .com, .nu, .se, .ca etc.

How to do it:

1. Switch to the DNS Tools – Core tool or on older software, the Name Server Lookup tool.
2. Enter the DNS you are going use under Advanced Query.
3. Select the NS record type, you may have to go into AQ Setup or Setup to do this.
4. Enter the top level extension in the IP/host/domain entry area. The correct method is to enter the extension followed by a period: ca. or uk. or com. –if you leave off the period or put the period before the extension, the query will fail.
5. Press NSLOOKUP.

Results will look like these two examples, the first for .ca (Canada) and the second for .se (Sweden):

[Start Query]
NSLOOKUP Starting Timestamp: 02/24/11 14:49:37
Command line equivalent: "nslookup -recurse -type=NS ca."
Looking up [ca.]

DNS Name: 4.2.2.2
IP Address: 4.2.2.2

Non-authoritative answer:
ca NS nameserver = f.ca-servers.ca
ca NS nameserver = e.ca-servers.ca
ca NS nameserver = j.ca-servers.ca
ca NS nameserver = a.ca-servers.ca
ca NS nameserver = c.ca-servers.ca
ca NS nameserver = m.ca-servers.ca
ca NS nameserver = l.ca-servers.ca
ca NS nameserver = z.ca-servers.ca
ca NS nameserver = k.ca-servers.ca
ca NS nameserver = sns-pb.isc.org
Server Response Time = 0.117 seconds
[End Query]

[Start Query]
NSLOOKUP Starting Timestamp: 02/24/11 14:54:34
Command line equivalent: "nslookup -recurse -type=NS se."
Looking up [se.]

DNS Name: 4.2.2.2
IP Address: 4.2.2.2

Non-authoritative answer:
se NS nameserver = d.ns.se
se NS nameserver = e.ns.se
se NS nameserver = c.ns.se
se NS nameserver = a.ns.se
se NS nameserver = b.ns.se
se NS nameserver = g.ns.se
se NS nameserver = h.ns.se
se NS nameserver = i.ns.se
se NS nameserver = f.ns.se
se NS nameserver = j.ns.se
Server Response Time = 0.430 seconds
[End Query]

What you see in the two examples above are the authoritative name servers for the root domains.

NetScanTools Pro 10.98.2 Released

2011-03-03T08:41:00.000-08:00

On February 23, 2011 we released NetScanTools Pro 10.98.2 both installed and USB versions. Many of the changes have to do with privileges and will primarily affect Windows 7 and Vista users.

Here are the release notes.
-Improved messages that show if writing to a registry location fails. They now suggest escalating the privileges by starting the program with 'Run as administrator'.
-All temporary snmp files are now removed on program exit.
-Improved handling of WinPcap interfaces where both IPv4 and IPv6 addresses are bound to the interface. Affects several programs.
-Internal changes to DNS Tools resolver.
-Port Scanner and NetScanner (Ping Scan) now show warning messages if privileges are not sufficient to run UDP scan and Subnet Mask test respectively.
-Updated SQLite to version 3.7.4.
-Updated database files.

Enjoy!

XP IPv6 Weirdness

2011-02-17T10:07:00.000-08:00

This article is about a computer that has IPv6 installed on Windows XP SP3.

I was using Wireshark today checking on the operation of the NetScanTools Pro v11 port scanner when I noticed something weird. Every 10 seconds a set of regularly spaced AAAA record queries were going to my ISPs DNS (default DNS for this system). The AAAA queries were all for 'mycomputername.domain.actdsltmp' and each time the DNS would respond back with 'no such name'. So I started closing down the browser and all the open programs - no change, the queries continued. Since this amounts to DNS harassment and a waste of bandwidth, I decided to find the cause. The 'domain.actdsltmp' part of the request is there because we have an Actiontec GT701 that provides that to my computer as a default domain name.

I could not find a way to shut it off short of uninstalling IPv6, so I did a nice workaround that works well. I added these two records to my hosts file using NetScanTools Pro - you can use something else if you want, it's just a text file. The first record is for IPv4 and the second for IPv6:

127.0.0.1 mycomputername.domain.actdsltmp
::1 mycomputername.domain.actdsltmp

The purpose of those records is to intercept outgoing DNS queries before they happen. This is because Windows DNS queries start with the hosts file, then failing to find the mapping in there, the actual outgoing DNS query is made to the default system DNSs.

Those two records tell whatever is asking for those hostnames that the loopback addresses (IPv4 and IPv6) are the addresses to use. This makes sense anyway because it's asking for a translation of your own computer name.

NetScanTools Pro v11 Beta

2011-02-15T12:40:00.000-08:00

Just released NetscanTools Pro version 11 beta 3 to select customers. If you are a customer with an active NetScanTools Pro maintenance plan and you want to try the beta, contact support today.

Beta 3 represents many changes based on the input of beta testers. Thanks to all who are helping!

Kirk

NetScanTools Pro NetScanner/Ping Sweep Tips

2011-02-03T09:28:00.000-08:00

These comments apply to NetScanTools Pro 10.98.1 and earlier. NetScanner/Ping Sweep uses ICMP ping packets to find active computers in the IP range or list of IPs.

1. If you are scanning a range of IPs that include Windows computers with active NetBIOS or SMB Windows computer name access - please - -please - please make sure that the checkbox labeled "Delete NetScanner Temporary Files on Exit" is checked. See NetScanner/Ping Sweep Setup.

2. If you see what you know is the wrong hostname for an IP, first press the Edit Hosts File button and see if the IP is in there. If it is, edit it out and make sure the Add Responding IPs to Hosts File box is unchecked. If the hosts file is not the problem, you need to review DNS. NetScanner uses the builtin resolver in Windows to resolve IPs to hostnames using DNS queries, if those fail a node status request is sent directly to the target to try to get the Windows hostname. Switch to the DNS Tools - Core tool and enter the IP that has the wrong hostname. Then press Test Default DNS. This tool does a direct PTR query to all the DNS's used by your computer. Look for two or more PTR records showing different hostnames. If you see it here, then the problem is in DNS. If the IP does not have PTR records in DNS, then go back to NetScanner and double click on the IP in question to view the NetBIOS/SMB information returned during the scan. You may see the incorrect hostname in the NetBIOS response. If so, then make sure #1 above is implemented - if not, exit the program, restart and rescan.

3. Keep Add responding IPs to hosts file unchecked. It is an artifact of an earlier version of NetScanTools and is no longer relevant in today's systems.

4. If you are looking for MAC addresses, please make sure Retry Send ARP is checked and Get NetBIOS Info is checked. The first one uses ARP to get MAC addresses if you are on the same subnet. The second one queries Windows computers throught the NetBIOS/SMB protocol to obtain MAC addresses. Remember MAC addresses in an IPv4 network are not routed.

5. If you want to ping a set of non-contiguous, random IPs, please create a list of IPv4 address, one per line and save it to a text file. There can be no other information in this file, only the IP addresses. On NetScanner/Ping Sweep, press Load Targets, then Load Text File. Navigate to the IP text file and open it. Now press Start NetScan and answer Yes to the question about scanning the list. You may want to go into Setup and uncheck the box labeled Enable Post-Sweep Delete of Nonresponding IPs - it's up to you.

Phishing Fax? or just plain fishy

2011-01-18T19:08:00.000-08:00

This afternoon we got a one page fax from someone in Vancouver WA wanting a quote for some specific printer supplies (we don't sell printer supplies - duh). The letter was well written with a good logo and plentiful contact info including physical address, phone, fax, and an email address.

So the first thing I did was go to their website based on the email address. Oops! just a standard Windows Lives template - STRIKE ONE!

Next I did a whois on the domain, the name matched the name on the fax but - STRIKE TWO!! - the domain was registered just yesterday and domain privacy is enabled. Now I'm curious.

So I went to Google maps and put in the address and did a street view. Turns out it is a residential street with older one story inexpensive small ranch houses - STRIKE THREE!!!

Next I went to the State of Washington business lookup database and found there is no legal business registered by that name - STRIKE FOUR!!!! (anybody from the state of WA listening?)

Just for good measure I did some additional google searches and found out this person has registered 104 domains - STRIKE FIVE!!!!!

The fax wanted availability of items, pricing, method of payment and contact person (name, phone...) - this gives the phisher a name and possibly an email for their database - if they are a phisher. They wanted the quote faxed back, which gives them a verification that the original fax number (mine) was good and possibly a new fax number as part of the fax back of the quote.

What are they doing? good question. Are they looking for additional contact info to build or verify their sucker list of fax numbers, email addresses, names and phone numbers? Who knows?

Phishing or fishy? definitely fishy if nothing else.

me

Fix for Product Registration Problem on Win 7-64

2011-01-14T09:53:00.000-08:00

A recent change in the NetScanTools Pro manifest (v10.98.1) allowing USER accounts to run the program had a negative side effect: there have been more people having trouble completing the registration process. This is due to the fact that we store information in a common area of the registry called HKEY_LOCAL_MACHINE (HKLM). It has been there for many years and is there because it can be accessed from any logged in user, ie. it is not user specific. Recently Windows 7 64 bit has been seen as strongly enforcing the 'read-only' status of this part of the registry causing our product registration process to fail. The workaround is to start the program using right-click 'Run as administrator'. This has worked for most people.

I spent a good deal of time this week looking for a better solution. I looked at storing the registration information in a common area, but that presents it's own problems. I found a suggestion on a forum that made sense and worked: Create the registry key in HKLM with read/write permissions for the EVERYONE group during installation. Why during installation? Because when an installer is run, it is run at higher privileges (administrator) than a normal user has.

So I have now modified the methods used to create the HKLM key during running of the installer so that the key has read/write privileges. This has been tested on all versions of Windows that NetScanTools Pro v10 supports: 7 down through 2000, also on Server 2003 and 2008. Now any privilege level user should be able to complete the registration process without a problem. You still need admin privs to install the software - I can't change that.

Along the way I learned a bit about SID, ACE, ACLs, security descriptors and how to apply them to registry items using SetSecurityDescriptorDacl, RegCreateKeyEx and RegSetKeySecurity. Complicated.

The installer for NetScanTools Pro v10.98.1 was modified to include this change and published on Jan 13, 2011 at 3:53pm Pacific Time.

Managed Switch Port Mapping Tool v1.99.2 Released

2011-01-11T12:04:00.000-08:00

Last night I released a new minor revision to the Managed Switch Port Mapping Tool. "Minor" is in the eye of the beholder. In reality, there were some big internal changes:

The SNMP engine was upgraded to v5.5. The complete effects of this are unknown, but may help out some mappings due to different SNMP implementations. I've been using this version of the SNMP engine for several months in the development of NetScanTools Pro v11.

The SQLite DLL was upgraded to 3.7.4. SQLite is arguably the most widely distributed non-client/server database engine. It's in your iPhone, Firefox and more.

Other changes were also important but less recognizable. We had one user who had problems with the Switch Port Mapper hanging up. Together we found that it was a corrupted snmp.tmp file. This new version deletes that file automatically when you exit the software and also deletes the html report .tmp file.

Another user had a strange problem a couple weeks ago and it was what accelerated this release. Someone at his university had a MAC with a dynamically updated DNS name of "John's MAC" (with the double quotes). First of all DNS names are not to have single quotes or spaces in them - it is a violation of DNS RFCs - why the DNS accepts them I have no idea. When our software tried to execute the SQL command with that extra quote, it failed because single quotes are used to define strings in SQL. So now our software removes single and double quotes returned by DNS.

The final important change was to the way VLANs were handled. The change corrected the VLAN results shown when you map a Cisco Small Business SF 300-08 switch. Previously there were 'extra' VLANs noted like vlan 0 which doesn't exist.

In case you are wondering, the Managed Switch Port Mapping Tool is Windows compatible software used to discover MAC and IPv4 addresses of devices connected to an SNMP managed network switch. If any of this interests you, please visit http://www.switchportmapper.com/ or http://www.netscantools.com/spmapmain.html

Shortened URLs Unmasked

2011-01-06T18:11:00.000-08:00

Twitter users in particular are bombarded daily with a plethora of shortened URLs. Shortened URLs are especially useful on Twitter because really long URLs like http://netscantools.blogspot.com/2011/01/addressing-confusion.html are tough to fit into 140 characters and somehow retain a meaningful message. Those long URLs can be shortened up into something like http://tinyurl.com/37dnopw. While convenient, they do present a security risk. Not only can a URL to an informative article be shortened, but so can a URL to a page full of malware be hidden by the shortened URL. How can you know where that URL goes?

The methodology of shortened URLs is fairly straightforward. When you access the shortened URL, the shortened URL provider's web server sends back a HTTP 301 Moved Permanently message with the new location URL. You can clearly see it in the two examples below - I used NetScanTools Pro's URL Capture to grab the text. Your web browser will not show these hidden headers and it will act on them before you have a chance to think about the final target URL. That's why I used the tool in NetScanTools Pro - it grabs only the text and does not accept anything else like scripts or images.

This first methodology used by tinyurl.com is the simplest. It only sends back the 301 redirect message.

Starting Timestamp: 01/06/11 22:06:18
Input URL: http://tinyurl.com/37dnopw
Web server IPv4 address: 195.66.135.140
***###Received Web Page text begins after this line###***
HTTP/1.0 301 Moved Permanently
Location: http://netscantools.blogspot.com/2011/01/addressing-confusion.html
X-tiny: cache 0.00097513198852539
Content-type: text/html
Content-Length: 0
Connection: close
Date: Fri, 07 Jan 2011 06:05:40 GMT
Server: TinyURL/1.6

The next methodology used by the bit.ly URL shortening service is a bit more involved. Not only does it send back the HTTP 301 moved message, but they also provide a web page with the embedded redirected target link just in case the web browser does not follow the 301 command.

Starting Timestamp: 01/06/11 22:06:40
Input URL: http://bit.ly/i9TxQY
Web server IPv4 address: 128.121.254.205
***###Received Web Page text begins after this line###***
HTTP/1.1 301 Moved
Server: nginx/0.7.67
Date: Fri, 07 Jan 2011 06:06:01 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: _bit=4d26ad49-003c1-00673-b3a08fa8;domain=.bit.ly;expires=Wed Jul 6 02:06:01 2011;path=/; HttpOnly
Cache-control: private; max-age=90
Location: http://www.us-cert.gov/current/index.html#apple_releases_mac_os_x4
MIME-Version: 1.0
Content-Length: 328

...web page omitted...

There are plugins for Firefox and other browsers which do that first step of contacting the URL shortening server, then they present the final target to you - and it's your decision as to whether to continue. I have showed the mechanism and how to use our software to see this. Not only is this text only URL capture tool in NetScanTools Pro, it is also in NetScanTools LE (law enforcement).

Be careful!

NetScanTools LE 1.40 Released Jan 6, 2011

2011-01-06T12:57:00.001-08:00

This release was posted around noon today and it includes the following changes:

-Notes field can now accept much more information than in previous versions.
-Packet Capture now parses spanning tree protocol, hp switch protocol and makes sure WinPcap uses the interface IPv4 address in the event that IPv6 is also enabled on the computer.
-updated left panel control icon images.
-Updated dates to 2011.
-Updated SQLite DLL to version 3.7.4.0.
-Updated database files.

You can find it at http://www.netscantools-le.com/ or if you already have the program, click on Help/check for new version.

Addressing Confusion

2011-01-05T22:13:00.000-08:00

In my December 2010 newletter I talked about NetScanTools Pro 10.98.1 on Windows 7-64 bit. I talked about how the change to the manifest from 'require administrator' (which did not allow unescalated use on a User privileges account) to 'asInvoker' allowed User privileges accounts to run NetScanTools Pro without logging in as an administrator -- some business installations only allow user level privs for their employees. But the biproduct of that change was to disallow writing to HKEY_LOCAL_MACHINE (HKLM) on Windows 7-64 and possibly Vista as well. For security reasons, UAC only allows read-only privileges in HKLM when you are not an administrator process. The process (ie. NetScanTools Pro) must have elevate privs to administrator for UAC to allow writing to that part of the registry.

NetScanTools Pro 10 only writes to one specific portion of HKLM and it only does that when you complete your registration (Validate and Save) or if you change your Maintenance Plan expiration date or Email Address using About/Edit Maintenance Plan. If you try that on Windows 7-64 with normal administrator or user privs, you get an error that it cannot write to the registry. It does not write to HKLM in the normal course of program operation, registry writes are done to HKEY_CURRENT_USER (HKCU).

The next release 10.98.2 will address this by giving a much more descriptive message explaining that in order to complete the task, you have to exit and restart with 'run as administrator'. It will also have some other changes to address some things we recently learned about the SNMP toolset.

We are working on 10.98.2 and should have it done shortly.

Anybody out there?

2010-12-28T09:13:00.000-08:00

It seems to me that not too many people are working during the last two weeks of the year - especially this last week. The east coast was hit with a huge snowstorm, so maybe that has something to do with it.

Happy New Year!

IPv6 eliminating NAT

2010-12-21T09:32:00.000-08:00

I just saw an IPv6 tweet where the guy said he set up IPv6 DNS entries for all his home machines. He can now connect to them directly from his office to any home machine. He was happy to eliminate NAT.

I realize that you don't need NAT when your computers can all have their own IPv6 address - but NAT does provide some safety - think about it:

Now anyone knowing those IPv6s can contact (hack) his machines that are now sitting directly on the internet. Kind of like going back to the mid 1990s. IPv4 NAT was keeping him safe from alot of hazardous traffic that will now hit each PC directly...

Kirk

December News

2010-12-20T10:26:00.001-08:00

I've been pretty busy this month and I haven't updated the blog much - I hope to provide more timely updates in 2011. V11 status: All the tools from NetScanTools Pro v10 have been transferred to v11 and I'm working on finishing tooltips and icons along with general cleanup of things as I run across them.

The latest December newsletter was published last week. You can find it on our website at http://www.netscantools.com/newsletters.html - there is one very important thing in there that I will address here. In version 10.98.1 I changed the manifest so that USER level accounts could run the program without logging in as administrator on Windows 7-64 bit (this does not seem to be an issue on Win 7-32). When you run a 32 application like NetScanTools Pro on Windows 7-64, it uses a portion of the registry called HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Northwest Performance Software, Inc. which contains a redirected part "Wow6432Node". Users do not have privileges to change this key subtree and even if you login under an administrator account, the keys in this tree cannot be changed. So in order to apply registration information or change the maintenance plan expiration date, you have to right click on the NetScanTools Pro icon and select 'Run as administrator' to all the program to have full access to the keys.

Black Friday/Cyber Monday Sale

2010-11-24T15:15:00.000-08:00

Check out this page for savings of up to 50% on our software.

http://www.netscantools.com/blackfridaysale.html

NetScanTools Pro 10.98.1 is Now Available

2010-11-19T13:03:00.000-08:00

Yesterday we released the latest installed version of NetScanTools Pro 10.98.1 and today we released the USB version patch. Both are now ready for you to update to the latest version. That is if you have an active maintenance plan.

Changes in this new version relate to starting NetScanTools Pro on Windows 7 or Vista where the account is running under USER privileges instead of Administrative privileges. When you tried to start previous versions of NetScanTools Pro under USER privileges, you would see a message asking you to supply the administrator account password so you could proceed and run the program. Clearly not optimum, so we identified the issue and corrected it. NetScanTools Pro will now start on USER privileges accounts.

There are two small issues that you may run into: on both the installed and USB versions the TimeSync function will not allow you to change your computer clock. That's because user privs are not enough to do it. The other issue is a little more of a problem on the USB version. Because the portable version of WinPcap requires adminstrative privileges to operate, any NetScanTools Pro tools that depend on WinPcap cannot be used. This does leave you with quite a few tools, but it is clearly not a preferred situation.

How to get the latest version: Click on Help/Check for New Version and login. You must have an active maintenance plan. If your maintenance plan has expired, please see this web page for information on reactivating it:
http://www.netscantools.com/nstpromaintenance.html

Managed Switch Port Mapping Tool - What is it?

2010-11-17T22:32:00.000-08:00

Do you have a network switch? Did you know that you may be able talk with it in ways OTHER than through a web browser?

Before web interfaces on network switches became popular, there was CLI (command line interface) and SNMP for managing the switch. Both of those methods can return a wealth of information about the switch and it's current state. If you have ever looked at a heavily populated network switch you would see that in all probability there are lots of wires going into those jacks on the front. And even more disturbing is that those wires are often the same gray color. How do you tell them apart and how do you know where they go?

That's where the Managed Switch Port Mapping Tool comes in. If you have SNMP enabled on that switch and you know the access credentials and your IP address is allowed to manage the switch (alot of 'ifs', I know), then our tool will most likely be able to 'map' or show the assignment of devices to the physical jacks on the switch.

The Managed Switch Port Mapping Tool is separate from NetScanTools Pro. They both can be purchased separately and both can be used without the other present.

Those are the basics. I'll be talking more about specifics in the near future. If you want to learn more now, please visit http://www.switchportmapper.com and http://www.netscantools.com/spmapmain.html

Try it out for yourself. There is a 30 day free trial available from either of those sites.

Kirk

NetScanTools Pro and User Privileges

2010-11-17T22:26:00.000-08:00

Yesterday an astute user pointed out that if you start NetScanTools Pro 10.98 on Windows 7 in a USER privileges account, the operating system asks that you login with an administrator account password to allow the program to run.

NOT GOOD! You should at least be able to run the program from that type of account without jumping through hoops. So I quickly traced the issue to the MANIFEST. You programmers out there know about this. In it were commands asking for higher privileges than we really need, so I think we are going to have a new minor, minor revision on Thursday. Beside fixing that little problem, the databases will all be updated with current information.

I assume this would affect anyone still using Windows Vista as well as Windows 7. The rest of you have little to concern yourselves with regarding this problem.

Kirk

November Newsletter Published

2010-11-17T22:20:00.000-08:00

Yesterday I posted our November Newsletter. Key topics center around NetScanTools Pro version 11.

In case you missed it, our first IPv6 capable tools are making their appearance in this new release of NetScanTools Pro and there is even a new WIFI/WLAN/wireless tool.

Something else we talk about is using NetScanTools Pro on an Apple Mac - find out how.

http://www.netscantools.com/newsletters.html

looking at top level domains

2010-11-15T22:32:00.001-08:00

Here is a cool thing you can do with NetScanTools Pro. Have you ever needed to look at a top level domain to see name servers or SOA records? It's actually pretty simple and can have some pretty spectacular results.

The other day I wanted to look at the 'bs' domain - really, no kidding. I went to DNS Tools - Core, then entered 'bs.' (the trailing period is REQUIRED), set the name server and set the record type to ANY and pressed NSLOOKUP. Here is what I got back:

[Start Query]
NSLOOKUP Starting Timestamp: 11/15/10 22:35:06
Command line equivalent: "nslookup -recurse -vc -type=ANY bs."
Looking up [bs.]

DNS Name: 4.2.2.2
IP Address: 4.2.2.2

Non-authoritative answer:
bs SOA
SOA origin = DNS.NIC.bs
mail addr = BSADMIN.COB.EDU.bs
serial = 2010111200
refresh = 7200 (2 hours)
retry = 3600 (1 hour)
expire = 3600000 (41 days 16 hours)
min ttl = 86400 (1 day)
bs RRSIG
TTL = 42797 (11 hours 53 mins 17 secs)
NSEC (Next Secure)
Labels = 1
Original TTL = 86400 (1 day)
Signature Expiration = Sun Nov 21 16:00:00 2010
Time Signed = Sun Nov 14 15:00:00 2010
Key Tag = 40288
Signer's Name:
Signature Length: 128 bytes
Signature:
54 0D 4E 76 3B B5 59 45 74 15 AF B1 6F 9A D1 5B
ED FD 19 8A 78 6A D7 70 D5 C9 91 8B 2D 70 B1 E3
21 6D CA 08 A0 28 CF CC 93 63 91 92 FA EC 57 E3
2C 3C DB F9 DD F9 43 2B 90 C6 65 64 7F A0 D3 CA
6B 26 4C 7C 7D 24 1E FE D1 2B 5A F4 17 62 39 C6
C4 AD 2E 37 DD D0 AC 3C E8 53 43 89 AF F3 6D 14
98 F8 DC 1C EC DC 4E 24 B9 8A 2E 06 6E 92 75 F8
18 6E DD 12 63 0E 9D 2D 0A B7 94 3E AF 1D CF 96
bs NSEC
TTL = 42797 (11 hours 53 mins 17 secs)
Next Domain Name: bt
RR Types in Bitmap: NS RRSIG NSEC
bs NS nameserver = DNS.NIC.bs
bs NS nameserver = ANYNS.PCH.NET
bs NS nameserver = UPR1.UPR.CLU.EDU
Server Response Time = 0.233 seconds
[End Query]

As you can see I got back the SOA record, the list of authoritative name servers and the security signature records. Notice how for a top level domain, the authoritative server has mirrors around the world, not just in Bahamas. In fact, there are only three mirrors showing - most top level domains have a lot more than that - the UK has 11. Notice also the domain security record - since last May most top level domains have those records in order to ensure the accuracy of the root data.

You can use the NSLOOKUP tool to inspect the records for any top level domain by following the procedure I outlined above.

NetScanTools Pro 11 status

2010-11-05T14:53:00.000-07:00

Another week has passed. This week included quite a bit of work on version 11 - again in the area of IPv6. NSLOOKUP and Dig both now accept IPv6 address inputs.

Most importantly, whois now accepts IPv6 inputs. Whois' ip to hostname to ip now work with IPv6. So if you enter a domain name, it will check for both IPv4 and IPv6 addresses. Plus, the whois servers for showing ownership or delegation of the IPv6 addresses are now in the database and it will make the correct query based on the input IPv6 address.

A few more new things next week and then wrap up for release.

Kirk

IPv6 Tools in NetScanTools Pro v11

2010-10-29T15:48:00.001-07:00

NetScanTools Pro v11 will have the first real IPv6 tools that we have done ever in it. The ability to retrieve DNS AAAA records has always been there, but we've gone beyond that. Here are a sample of the completed tools.

DNS Tools - Basic now includes a Simple Query - IPv6 tool. This tool accepts a hostname like ipv6.google.com or a IPv6 Address like 2001:6b0:1:ea:202:a3ff:fecd:23a7 and attempts to retrieve the IPv6 address or hostname respectively.

DNS Tools - Advanced now includes an IP/Hostname to ASN tool that accepts either a hostname or an IPv4/IPv6 address and returns the ASN.

Ping - Enhanced now includes an ICMPv6 mode.

More IPv6 to come next week. Think about NetScanTools Pro v11 when you need some GUI IPv6 tools. NetScanTools Pro v11 will be released in November. We're getting closer!

NetScanTools LE Finalist in 2010 Innovation Awards

2010-10-27T11:57:00.000-07:00

NetScanTools LE was named a Finalist in the software category for the Officer.com 2010 Innovation Awards. Our thanks go to Cygnus Business Media's Law Enforcement Group for the honor.

Please read this news story on Officer.com detailing the Awards.

About NetScanTools LE.
NetScanTools® LE (Law Enforcement) is an Internet Information collection software tool for Windows that gives you information and reports about an IP Address, Hostname, Domain Name, Email Address or URL (web address). It was designed especially for Law Enforcement.

Current NetScanTools LE version is 1.31.

Read more about NetScanTools LE and download a free 30 day trial.

IPv6 and DNS Tools

2010-10-26T20:14:00.001-07:00

NetScanTools Pro v11 Status as of today.

Working on IPv6 additions to NetScanTools Pro v11. We now have two new IPv6 capable DNS tools. I should have the other DNS tools I'm adding complete in the next day or so. Then I will add one or two more IPv6 tools soon after.

Kirk

October Newsletter Published

2010-10-20T15:19:00.000-07:00

Unlike last month's newsletter, this one is on time. There are quite a few new topics including a mention of that Cisco Small Business Switch review. Status updates on NetScanTools Pro v11 are in it too.

The October NetScanTools Newsletter can be read here:
http://www.netscantools.com/newsletters.html

New NetScanTools Pro v11 Screenshots Posted

2010-10-20T10:48:00.000-07:00

Today I posted quite a few new screenshots of NetScanTools Pro v11. They are on Facebook:

http://www.facebook.com/album.php?aid=35226&l=be83320aaf&id=117859474900452

Back to work...
Kirk

Week Recap

2010-10-15T19:15:00.000-07:00

It's been another busy week. Here is what was accomplished.

SNMP tools are all complete - new things in SNMP: SNMPv3, getnext, more bulk tools. SNMP has been split into basic tools and advanced or specialized tools. This was the last tool to be transferred from the old v10 interface to the new v11 interface.

Ping Scan (or Ping Sweep AKA NetScanner) has been 98% completed. This has several improvements such as columns that appear or disappear based on whether the scan option is active. The last 2% to complete has to do with automatic transfer of IP/MAC address pairs to the IP/MAC database - forgot this part until this evening.

Port Scan was rewritten completely for NetScanTools LE, so that is the basis of the Pro version port scanner. I still have to put the TCP stealth scanning modes into it. Those were being worked on today.

After those things are complete, it's time for folding in a few new tools. Then on to cleanup, documentation changes and release. It's getting close!

Kirk

ps. don't forget to follow us on twitter @netscantools or on Facebook (link is on the netscantools.com main page)

NetScanTools LE 1.31 Released October 7, 2010

2010-10-07T17:01:00.000-07:00

Yes, we've been busy this week. Some of the same changes made to NetScanTools Pro were rolled into NetScanTools LE. They relate to the DNS issues. We also updated the whois and ip to country databases. If you already have NetScanTools LE, download the install file and install over the top of the older version.

Back to NetScanTools Pro version 11...

NetScanTools (TM) Pro 10.98 Published

2010-10-06T16:13:00.000-07:00

On Monday, October 4, we released NetScanTools Pro 10.98 installed version. The USB version patch was released on Tuesday, October 5.

Here are the changes:

Ping will now allow up to 8192 consecutive pings to sent. Problems occurred in the previous version if you exceeded 256 pings as defined in Setup.
Certain DNS functions that use the secondary resolver (ex. Get Basic DNS Records) will now properly handle the truncated flag in the UDP response that indicates the query should be retried using TCP.
DNS Tools - Core: Fixed problem where if a very large response to a single record query was obtained, all the records would be displayed. Example would be a large PTR record response for a single IP address.
Updated SQLite to version 3.7.2.
Updated database files. Removed whois prefix files.

You can download the latest version (if your maintenance plan is active) by clicking on Help/check for new version.

Review of the Cisco SF 300-08 Small Business Switch

2010-09-29T14:42:00.000-07:00

Yesterday I received the first new switch for our stable of test switches in a couple years. It's on of a brand new series from Cisco that was just announced last week called the Cisco Small Business 300 Series Managed Switches, and I'll have to say - I'm impressed.

I opened the box and found all the hardware I needed to either rack mount it, mount it on a wall or table and a 'wall wart' style AC adapter power supply. The first thing I noticed about the AC adapter was that it was narrow and had the AC prongs turned 90 degrees from usual - this allowed me to drop it right into a standard power strip without wasting two or more places in the power strip. I did thumb through the Quick Start Guide to get the login info and learn about the configuration.

So after powering down most of the computers, I put the new SF 300-08 8 port switch into our network. I'm replacing (sort-of) a workhorse HP Procurve 2524 with this Cisco switch because it uses less power and is less noisy - no fans - I really only use 7 ports on a daily basis. The older switch is still there for testing and expansion when needed.

As soon as I put it in, the switch used DHCP to get a network address from our server. This was handy, but I will be changing it to a static IP later. The fact that it can use DHCP is a very nice feature because this means you don't have to connect the included serial port cable or take a laptop and change the laptop IP/mask to match the factory defaults.

The next thing I need to do was test it with our Managed Switch Port Mapping Tool. A quick check with the tool determined that SNMP is not active out of the box. So using IE8, I logged in with the default credentials that I found in the Quick Start Guide and the first thing it asked me to do was change the password. Right away I was presented with a change password window complete with a Password Strength meter that shows the strength in red-yellow-green. After getting past that point, the web based interface was clean and well organized, in fact much better organized than I expected. The web interface can best be described as 'outlook' style with a control panel on the left and user interaction windows on the right.

I also found it easy to set the switch time clock by having it get the time from the computer from the Administration controls. I could have also selected SNTP options.

Since the Managed Switch Port Mapping Tool uses SNMPv1 or v2c (v3 coming soon), I had to enable SNMP. I found that to do this, I had to change settings in two places. The first was to enable SNMP, this is done on the Security - TCP/UDP Services window. Next I had to create access to the OID data by creating an SNMPv1/v2c 'community' associated with a 'view'. The default 'View' gives you access to the whole .1 OID structure, so that's the one I chose. There are many other options for excluding portions of the OID tree depending on the 'view'. Essentially what I chose amounts to allowing full read access via SNMP v1/v2c for my computer's specific IP address (SNMP Management Station). once those settings were in place, I was able to run the Managed Switch Port Mapping Tool.

Right away I had the results I expected to see. The list of 8 ethernet ports with MAC addressess and IP addresses. The duplex mode info showed up (always an issue since standardization eludes switch manufacturers) and the Spanning Tree Protocol info was there and appeared correct. There are two things I need to look into: First, every port that had a MAC address had a VLAN 1 entry as I would expect, but what I didn't expect to see was a second VLAN '0' not associated with any MAC address below it. I'll have to find out where that is coming from. It does not seem to affect quality of the results. The second issue is that the physical ports are called e1-e8 and there are a second set of ports ch1-ch8 that are also labeled as ethernet. They are disabled and have an ifIndex beginning with 1000. The e1-8 ports are ifIndex 1 through 8. I also noted that BRIDGE-MIB::dot1dBaseNumPorts.0 = 16 which means the software probably supports the 16 port version even though this is an 8 port device. Just an interesting observation.

It appears that the SNMP implementation of this device is a departure from other Cisco switches in that 'community name indexing' is not supported. This has been historically used in Cisco switches to obtain the Bridge Mib information on a per VLAN basis. This does not affect our results since the device appears to fully support Q-Bridge Mib and that gives us access to VLAN specific port assignments.

Here is a screenshot of the Switch Port Mapping Tool results for this switch.

This is our web analysis report of the Switch Port Mapping Tool results.

Bottom Line: This is a very powerful switch for the money. I've barely scratched the surface with its capabilities. There is direct support for IPv6, QOS settings, access lists by IP or MAC address, logging and actually far more than I expected for under $200. I used the help system and found that it was very readable and clear unlike much online help you find today. I highly recommend this switch series based on what I've seen so far.

Reviewed with switch firmware version 1.0.0.27.

Managed Switch Port Mapping Tool

Kirk Thomas

September Newsletter Published

2010-09-28T12:07:00.000-07:00

Yes, I know it's October on Friday, but I've been busy. The September NetScanTools Newsletter can be read here:
http://www.netscantools.com/newsletters.html

Follow the progress of NetScanTools Pro v11 on Twitter or on Facebook.

Week Recap

2010-09-24T09:58:00.000-07:00

It's been a busy week. I spent alot of time dealing with CRT issues moving the SNMP tool set into NetScanTools Pro 11. The final set of SNMP tools will be put in there today, then I have to finish up a few tools that were left unfinished.

Yesterday I ordered a new Cisco 300 Series Managed Switch from Newegg to see how it performs with the Managed Switch Port Mapping Tool. This is a new series of switch that Cisco announced on Wednesday. The documentation says that it supports SNMP v1, 2c and 3, so I want to see if it can be mapped from the switch port mapper. I should be getting it on Tuesday, so I'll replace an old Linksys Etherfast 4116 with it, then we'll see what happens. I'm curious to know if the SNMP implementation follows the Cisco codebase or is a continuation of the old Linksys code. I guess I'll find out.

I'm also looking for boxshot software - I don't know which is the best, so I'll take any comments.

Managed Switch Port Mapping Tool v1.99.1 Released

2010-09-21T14:21:00.001-07:00

I have not said much about this tool in this blog. Here is a brief synopsis. Network Switches come in generally two flavors: managed and unmanaged. Managed Switches have an IP address and can have all kinds of internal parameters monitored and changed, as opposed to unmanaged switches that simply they do what they do without any user control.

Managed Switches usually have more than one way to manage them, the most common being a web interface, followed by SNMP v1, v2c and sometimes v3, CLI through telnet and finally a console connector on the front or back. Our tool uses SNMP v1 or v2c to communicate with the switch (or switches). [we will be adding support for SNMP v3 in the next major release of the program]

What it does: The Managed Switch Port Mapping Tools talks with the switch and 'maps' or analyzes the information to remotely find out the mac addresses of devices attached to the physical ports. It also attempts to find the IPv4 addresses that match the mac addresses and shows you many other parameters from the switch.

This tool is very useful to network technicians who must figure out what devices are attached to switch ports.

This new release fixes a few problems and enhances the speed and ability to map switches. You can read about it two places:
http://www.switchportmapper.com/
or
http://www.netscantools.com/spmapmain.html

Download a 30 day trial copy today from either site.

XBox 360 Slim Wireless MAC Address Problem?

2010-09-14T07:58:00.000-07:00

Last night at midnight my son bought Halo Reach and the new XBox 360 Slim. When I got up he told me he couldn't connect to the wireless router. The first thing I did was check his XBox wireless settings which looked OK. Then I had him note down the XBox wireless MAC address from advanced settings - while he did that I noticed that the 'Wired MAC address' was significantly different.

Then we went to the router and checked the MAC he had entered in the list of authorized MACs in the MAC Filtering list. Fine - he typed it in right. Then I had him view the router logs. I saw right away that the MAC address that the XBox was trying to connect with was not the 'wireless' MAC address - it was the Wired MAC address. He change the router filter MAC list to match the Wired MAC address - problem solved.

Seems like an OOPS! Hope this helps someone.

Kirk

Podcast with Keith Parsons wirelesslanprofessionals.com

2010-09-09T11:38:00.000-07:00

On September 7th, Keith Parsons of wirelesslanprofessionals.com interviewed Kirk Thomas about NetScanTools Pro and how it can be used by wireless LAN professionals. We covered a wide range of topics including using the Managed Switch Port Mapping tool and we even touched on NetScanTools LE. Keith operates almost entirely in a free roaming wireless world and focusses on the Wireless Lan aspects of life. He teaches classes, is a consultant and is an authority on wireless networking.

Now that I have your interest, please check out: wirelesslanprofessionals.com

If you blink, you might miss the 40% discounts for NetScanTools Pro and the Managed Switch Port Mapping tool that are talked about on that page. Go listen to the podcast today!

Kirk

NetScanTools LE Reviewed Aug 31, 2010

2010-09-02T10:57:00.000-07:00

Kevin Beaver of 'Hacking for Dummies' and other 'for Dummies' books fame wrote an excellent review of NetScanTools LE on August 31. Please check it out here on his blog:

http://securityonwheels.blogspot.com/2010/08/netscan-tools-le-must-have-for.html

Thanks Kevin!

NetScanTools LE 1.30 Released Sept 1, 2010

2010-09-02T09:47:00.000-07:00

Yesterday we released NetScanTools LE 1.30. This new release has many minor fixes and at least one fairly major bug fix: if you were using Automated tools and entered a long domain name AND had 'IP to Country' checked, it would shut down when it got to the IP/Country section. This problem has been fixed. We also did a lot of minor user interface fixes. We also updated WinPcap to 4.1.2 and SQLite to 3.7.2. As usual we updated the whois server and IP to Country databases.

If you already have NetScanTools LE 1.2 or earlier, simply start it, look for the notice that a new version is available and follow the instructions. If you have a purchased copy, it will find your keys. If you have a trial copy, you will get a new 30 day trial.

New Packet Generator Features

2010-08-31T08:15:00.001-07:00

NetScanTools Pro v11 will have a new ARP packet generator that gives you full control over all the contents of the fields in an IPv4 ARP packet. We've also added a new hex editor tool so that you can create or change the content of payload files that you add to TCP or UDP packets.

Version 11 is not released yet, but that's a quick preview of some of the new things in the upcoming release.

FireFox slowed my old computer one too many times

2010-08-03T15:57:00.000-07:00

Yesterday I had a meeting with a client and I was late because one of my old computers (XP Pro) had slowed down way too much. All I was running was an email client (not outlook) and Firefox 3.6.8. Firefox had a been running for a few hours as I visited some websites. I couldn't bring up Task Manager or get the windows to repaint. I had to wait and wait while I tried to kill Firefox. Once I got it killed everything worked normally. This has happened several times lately - usually after visiting Facebook, then moving on elsewhere. FYI, NetScanTools is on Facebook you know.

So I did a bit of searching and found an article that explained about a new feature called plugin-container.exe. If you disable it, things appear to work better.

It's pretty simple to disable the plugin container.
Start Firefox.
Enter about:config into the browser and press Enter.
Press the scary warning button.
Look for the items beginning with dom.ipc - six will be listed, you want the middle four.
Double click on each of those four to change them from TRUE to FALSE.
Restart Firefox.

At least for me the problems of memory usage and processor time disappeared. Hopefully permanently and I hope that the Firefox developers know about this and can fix it.

If you want to see the article I found, go here:
http://www.technogadge.com/how-to-stop-firefox-plugin-container-exe-process/

PHPList problem solved - send message page blank

2010-07-29T13:53:00.000-07:00

Well I wasted over 2 hours fixing PHPList - again. A couple of days ago I upgraded from 2.10.10 to 2.10.12. Today I was in a hurry to get a newsletter out before the end of the 'east coast' day. I wrote it, then went to phplist and tried to 'send a message'. I got there and found all the tabs like content etc visible, but NO editor. Apparently there was a problem with the FCKEditor. I spent a long time going through the support forums - a long time. I looked at the .tgz backup and discovered that when I first installed PHPList I had to modify config.php and send_core.php - it had to be in those. I tried several things including switching editors in the config, but none worked.

I finally ran across a forum topic called "Send a message screen: nothing under the tabs" that gave me the solution and the real cause of the problem: "If you are running v2.10.11 or v2.10.12, one possible cause for this issue is that your PHP installation doesn't include the iconv module. You can check this by looking at your system details: lists/admin/?page=community"

I was missing the iconv module in the list of loaded php modules.

So apparently the solution is to comment out the calls that access iconv in send_core.php. I had messed with this file in 2.10.10 but I couldn't remember the changes I made. So I commented out the lines (using #) beginning at 1032 as follows:
# $utf8_subject = $subject;
# $utf8_from = $from;
# if (strcasecmp($GLOBALS['strCharSet'], 'utf-8') <> 0) {
# $utf8_subject = iconv($GLOBALS['strCharSet'],'UTF-8',$utf8_subject);
# $utf8_from = iconv($GLOBALS['strCharSet'],'UTF-8',$utf8_from);
# }

Problem solved. Now I've put this in the blog so the next time I upgrade PHPList, I'll remember. And this might also help someone else too.

NetScanTools® Pro 10.97 USB Patch Published

2010-06-29T21:00:00.000-07:00

Today we finished and posted the USB version patch. If your maintenance plan is active you can login through Help/Check for New Version and get the patch. The changes are the same as in the installed version.

What is NetScanTools?

2010-06-28T19:55:00.000-07:00

Let's start with a little history. Back in 1995 - the dawn of the public's awareness of the internet when the World Wide Web was still in it's infancy, there were very few network enabled applications for Windows 95 or Windows NT 3.5. Many of those tools that were out there were simple one function tools. A couple that I specifically remember were WS_PING and WS_FTP written by John A. Junod. I still have a very old functioning copy of WS_FTP. Those tools were eventually marketed by Ipswitch.

Junod's tools, along with others inspired me to combine several tools together in a convenient package rather than having multiple programs each doing a single task. Because I thought networking, specifically the internet, was the direction things were going, I decided to put together a simple DNS lookup tool (IP address to hostname and vice versa) called Get Host Name, Finger and Socket Info and make it work in Windows. (Remember that in 1995 Unix, BSD, Solaris etc, completely ruled the networking roost. Windows and networking were mutually exclusive ideas to Unix experts - they chuckled at the thought of even seeing a Windows machine on a network.) NetScanTools was compiled using Visual C++ 1(?) - a 16 bit version. I quickly wrote the program simply to boost sales of a long since dead duplicate file location utility called SystemScanTools. Since my new tool worked on a network, I called it NetScanTools. Here is a picture of the v1.10. Believe it or not it still works - I took this picture today.

See the tabbed interface? It's something I think I used before anyone else as the basis of this type of multifunction tool application. This type of interface is still popular with some of long time customers because you can run more than one tool simultaneously. Unfortunately our current 'Outlook' style interface didn't allow more than one tool at a time. But in NetScanTools Pro version 11 we are bringing back the ability to run more than one tool simultaneously.

One thing lead to another and NetScanTools got popular. Really popular. So popular that we were doing 3 GB transfer of downloads a day - we had to have multiple download sites. In 1998, we decided it was time for a more advanced 'Pro' version. So in July 1999 NetScanTools Pro 1.0 was released. We continued on with NetScanTools Standard as it was now known until August 2004.

Fast forward to now. I'm working hard on NetScanTools Pro version 11. It will have an updated 'Outlook' style interface with a Favorites left panel group and it supports simultaneous tool operation. Plus it has the ability to automatically save all results to a database. Just like NetScanTools LE (Law Enforcement) version. The program is being refocussed to make it very clear what each tool does and to separate the tools into more logical functions.

What is NetScanTools? Quite simply, NetScanTools brings together a wide variety of networking tools into one easy to use package on a Windows 7/Vista/XP/2008/2003/2000 environment. The tools range from simple tools like NTP Time Sync to complex ARP tools and even more complex DNS tools.

So who needs NetScanTools Pro? Lots of people. It's primarily useful to network engineers or network technicians because it puts many tools they need in one place. The tools range from specialized DNS tools to ping sweep, arp sweep, packet generation, packet capture and a fairly complicated whois tool. Much of what is in there was added as a result of customer feedback. Although it has been historically IPv4, I am going to be putting more IPv6 functions in it because that's where the future is.

Why should you pay for something that you can get for free? Good question. I've looked at quite a few of those free Windows based network tool apps. The ease of use is often not there. The freeware ones simply don't always function as advertised, and some that are advertised as free are not really free - many of the coolest functions on that not-really-free popular app stop working after X days. And as is the case with most freeware, development goes along for a few years then suddenly stops. I've seen it happen to several apps. But we are still here. If you need to call and ask a question, I'll talk to you. If you need to email, I'll email back (please whitelist netscantools.com or you may not get a response - personal rant against those blasted overzealous spam filters). So thanks to all those who have supported us over all these years. We hope to continue providing this tool for a few more years.

NetScanTools® Pro 10.97 Published

2010-06-28T19:48:00.000-07:00

Today we posted NetScanTools Pro 10.97. This is the 'installed' version, the USB version will be ready on Tuesday if all goes well. It has a few fixes like changes to the NetBIOS Basic tool (it's not really using NetBIOS anymore, it really uses SMB/CIFS) and a fix to the TCP connection stopping function in Network Stats. There are the usual database updates.

Work on version 11 is going well.

June Newsletter Published

2010-06-23T12:19:00.000-07:00

You can see our latest June NetScanTools newsletter here.

Renaming tools for NetScanTools Pro 11

2010-06-08T09:16:00.000-07:00

We have renamed some tools in NetScanTools Pro 11:
NetScanner is now Ping Sweep
ARP has been split into Arp Cache and Arp Scan
NetBios Info - Shares/System Basics is now Network Shares
Packet Viewer is now Packet Capture

This will make it more clear to people what the tools are for and what they actually do.

NetScanTools Pro USB Version Sale

2010-06-02T09:50:00.000-07:00

Get NetScanTools Pro 10.96.1 on a portable USB flash drive for $50 off through Friday, June 4, 2010. This version of NetScanTools Pro does not need to be installed on the computer you are using it on. The flash drive is a very fast Ready Boost compatible 4GB drive with plenty of extra space for other things you might want to install on it like the portable version of Wireshark.

Details:
http://www.netscantools.com/may31sale.html

ipPulse 1.70 released May 20, 2010

2010-05-20T21:06:00.000-07:00

I bet you don't know what ipPulse is. So this release announcement may be a shock too. It's the first release in five (5) years and a fairly big one at that.

First of all, what is ipPulse? it is a program designed to cycle through a list of network connected devices and test them one at a time. It can have one or two tests per machine. The first test called the primary test can be either a Ping to see if it responds or a TCP connect to a port of your choice to see if a service is alive on the target. The second optional test can be either a TCP port test (different port) or an SNMP v1/v2c walk of the active interfaces. Failures can be logged and someone can be notified that a failure occurred. Notification can be audible or by email to a computer to a cell phone. That's it. A pretty simple, but effective program. There are programs out there that cost over 10x as much that do pretty much the same thing with more bells and whistles.

So what did we change from the last version of five years ago? For starters it was compiled by the newer Visual Studio 2008 (next time maybe VS2010). Two things were removed: 1. ping using 'raw sockets'. This was redundant because it had another Ping setting. 2. Support for pagers. I haven't seen anyone with a pager in a long time. Cell phones can be emailed from the program (ie. phoneNumber@vtext.com), so unless anyone has a real heart attack over it, pager support is gone. The next thing was Windows 7 (and Vista) support. Previous versions of Windows 'looked the other way' when we wrote our log files and list of targets in the program installation directory. Windows 7 and Vista don't like that at all. So now those writable files go in the user data directory where they belong. The final change was converting from the ancient Wise installer to the latest version of Inno Setup. So now it should run fine on Windows 7, Vista, XP, 2008, 2003 and 2000. Older Windows are not supported - oh well, time to move on.

If you are interested, you can find it at http://www.nwpsw.com/ippulsemain.html

I forgot to mention that it costs $69 for an unlock code. We used to compile a separate CDROM version, but like 45's, CDROMs are vanishing, so now it's just an unlock code. If you have an older version from CDROM and you want to upgrade, contact us for the unlock code. Give us your name, email and CDKEY or invoice number and we'll give you the unlock code for 1.70.

MSVCR90.DLL problem on XP

2010-05-20T20:45:00.000-07:00

File this under something I learned about Visual C++ programming even though I've been programming it for 15+ years.

OK, so today I'm testing ipPulse 1.70 on different operating systems, Windows 7 (32 & 64), 2008, XP etc. On one completely up to date, fully patched Windows XP system I get the fateful message "cannot find MSVCR90.DLL" blah, blah. I've seen this before. It's the sign of missing side by side DLLs from the SXS directory. But wait! I didn't compile this to use the SXS DLLs - it's all supposed to be static. What's going on?

I started by using the better version of Dependency Walker to check each exe and dll. I find that one dll has the linkage to the SXS directoried (is that a word?) MSVCR90.DLL. So I look at the release flags and for static it is what it should be: /MT. BUGGGER! So next I go to MSDN help pages and carefully review the /MT and /MD flags. I don't see anything obvious, so I remove msvcr90.lib from the linker. Bad idea. Errors galore. I put it back and go back to the docs. I see a reference to libcmt.lib in the same context as /MT. I wonder. I go and remove msvcr90.lib and put libcmt.lib in there instead. The linker loves it. I review the output dll and see the offending SXS linkage is gone. Great! After rebuilding the ipPulse fileset I see that it now runs properly on that other XP system. I never knew that about libcmt.lib and /MT symbiotic relationship. The docs are not clear. So I learned something new today.

I developed ipPulse 1.70 on MS Visual Studio C++ 2008 with static linkage for all files. The DLL in question was pure C. MSVCR90.DLL is the Visual C runtime DLL.

Don't ask me why I didn't use the 2010 compiler.

NetScanTools Basic one of 15 recommended tools

2010-04-26T08:43:00.000-07:00

NetScanTools Basic was mentioned as number 5 of 15 recommended freeware network tools in the article "Most Wanted Network Tools 100% Freeware". See this blog:
http://www.sialnity.com/2010/04/most-wanted-network-tools-100-freeware/

Have a great week!
Kirk

This application has failed to start...

2010-04-22T15:47:00.000-07:00

Have you ever seen that message? You know, the one that says "This application has failed to start because the application configuration is incorrect. Reinstalling the application may fix this problem." (that's what it says on Windows XP - Vista and 7 have a more informative message). The message should read: Windows is missing important files that should have been downloaded through automatic updates -- oops!

What this usually means is that the Visual C++ redistributable fileset is wrong, either too old or missing one or more pieces. These are the Side by Side DLLs we are talking about. They reside in the C:\Windows\WinSxS directory and the have rediculously long names. Those names include the version of MFC, runtime, etc of the DLL. This problem happens most often when the compiler has a new revision, like last July 2009's revision of Visual C++ 2005.

Fortunately the fix is pretty simple. You have to find the Visual C++ redistributable installer that is missing and run it. It's installer takes care of the rest and it is a pretty fast fix. But you have to know which one to use. Our software installers look for signs that the SxS DLLs are there, then run the redist installer if they are not found. You may have to contact the software vendor to find out which one to use. Kind of a pain.

I'm posting this because one of our customers had this happen today. Fortunately he emailed and I was able to give him the link to the proper redistributable installer. It fixed his problem.

Checking Authoritative DNS Serial Numbers

2010-04-21T16:45:00.001-07:00

Did you know that Authoritative DNS servers consist of primary and one or more backup or secondary servers? Did you also know that they are supposed to be in sync?

It is important that the servers be in sync. Why? a record in the primary may be very different from the same record in the secondary - especially if it was just changed. A query might get the wrong information (like an IP) if the secondary returns the record instead of the primary. That's why it is important to sync them fairly quickly.

The DNS servers are listed when you do a 'whois' query for a domain. Most domains have only two, a primary and secondary. When changes are made to the primary, then they are migrated to the secondary so that if for some reason the primary does not respond to DNS queries, the secondary may continue to do so.

It is important to know if those primary and secondary servers are in sync. You can look at the SOA serial field to find out. Normally they are identical for all DNS servers. If they are not, then that indicates a problem. You can use NSLOOKUP to retrieve the SOA records from each DNS (primary and secondary). This is a tedious process if there are more than two servers to look at.

We have a tool in NetScanTools Pro that simplifies this process by doing the queries for you very quickly. That way you can see a quick snapshot of the DNS update situation. It is part of the DNS Tools - Advanced and it is called "Auth Serial Check".

Here in this example for our domain showing matching serials. Note that the program looks that them to make sure they are OK:

[Start Query]
Authoritative DNS Serial Check
Starting Timestamp: 04/21/10 17:00:28
Query: netscantools.com

NS: ns2.webnethost.net -- Serial: 2010020400
NS: ns1.webnethost.net -- Serial: 2010020400

Analysis: All serial numbers are identical, no problems detected.

[End Query]

And now here is a query showing microsoft.com's DNS serials. Note that certain DNS servers are out of date with others. "ns1" is the primary and the others are backup.

[Start Query]
Authoritative DNS Serial Check
Starting Timestamp: 04/21/10 16:44:23
Query: microsoft.com

NS: ns3.msft.net -- Serial: 2010042102
NS: ns5.msft.net -- Serial: 2010042101
NS: ns1.msft.net -- Serial: 2010042102
NS: ns4.msft.net -- Serial: 2010042102
NS: ns2.msft.net -- Serial: 2010042101

Analysis: One or more serial numbers are out of sync with the other serial numbers.

[End Query]

I checked again 15 minutes later and found that all DNS serials in the microsoft.com listing were the same. This is probably normal for a domain of this size because it may take awhile to transfer the zone updates from the primary to the secondaries. I checked the SOA record and I could see that the refresh interval is 5 minutes and the retry interval is 10 minutes, so their DNS should not be out of sync for long. It's unusual to see this, so I thought it would make a good example.

A note about the serial field formatting. These both conform to what is now recommended where the serial is human readable. In the case of microsoft.com, you can see that it is April 21 2010, update numbers 1 and 2. In the case of netscantools.com, you can see that the serial has not changed since February 4, 2010. Not all serials conform to this method. Some are just straight incremental numbers.

You can try out the Auth Serial Check tool in the NetScanTools Pro Demo at our website.

Malformed UDP Packets

2010-04-13T14:51:00.000-07:00

Malformed UDP Packets are easily generated with the new changes to the Packet Generator tool in NetScanTools Pro 10.96.1. Normally a UDP packet consists of an IP header followed by a UDP header followed by data. Usually all the parameters of those two headers are calculated at the time the packet is sent by the sockets layer, but with our Packet Generator tool we can create the packet from beginning to end including all parts of the headers.

This view from Wireshark shows a normal UDP packet:

You can see that the packet is complete and correct with all checksums and field lengths normal. The payload is only 4 bytes - it is the word 'test'.

Now look what happens if we put a value of 2 bytes into the UDP length field - remember that the UDP header itself is 8 bytes. The data payload is still the same 4 bytes. Wireshark's 'Expert Info' analyzer tells us that it is malformed and the length value is the culprit. The checksum is not analyzed and the data is not commented on.

See how Wireshark complains that the length value is less than the data and the UDP header? The message it gives is correct, the UDP length field must have a value of 8 or greater because that is the size of the UDP header itself. Can you send a UDP packet without any data? -sure, but it will also be tagged as malformed by Wireshark (exception error).

Next let's try setting the UDP header length field to something greater than the UDP header length + the data payload length. You can see that it notes that the length value (24) is greater than the payload (8 UDP header + 4 data = 12 bytes) and it does not complete the checksum calculation since all the data is not present.

A few words about what the Packet Generator tool can do. It can generate TCP, UDP, ICMP and CDP packets and send them out at a maximum repetition rate of roughly 10,000 packets per second - it is not a traffic generator capable of saturating your connection. It has a simple scripting language that allows you to send packets and even do some minor looping or use infinite looping. This is useful for connection test purposes. It uses WinPcap to generate packets, so it is pretty much limited to wired connections, not wireless connections. But even within these limits it really can show the response of applications or devices to malformed packets.

If you are interested in trying out the demo, you can do that by following this link. Please keep in mind that the demo will limit you to your local subnet but the full version does not have this limitation.

NetScanTools Pro 10.96.1 Published

2010-04-13T10:03:00.000-07:00

Yes, this is a new release: 10.96.1.

It's only been a few days since 10.96 was released, but last week a customer came to us with an important suggestion that we had to implement. The new change is in the UDP section of Packet Generator. At the customer's suggestion we added the ability to override and change the length field in the UDP header. A byproduct of this change is that the text or file data you add to the UDP packet payload is sent in it's entirety (up to the limit of your network MTU) independent of what the IP header length or UDP header length values are. Try this out using Wireshark to look at the UDP packets - Wireshark points out the packet errors you create quite well - lots of red highlighting. There were also other changes to Packet Generator in 10.96 in case you missed them. I'll be writing about this in the blog later today - click on Welcome group, then on the Blog icon.

What does this mean? it means that you now can easily create malformed UDP packets (Laura Chappell loves these).

There is also another change to the automatic checking for a new software version that you can review in the help file under General Information/Revision History.

Because these changes interrupted our normal release sequence we never did release a USB version 10.96 patch. That version was skipped for the USB version so we will be getting the 10.96.1 USB patch out shortly.

To get this new version:
From within NetScanTools Pro, please click on the left panel Welcome or Online group and then click on the Check for New Version icon. Login to obtain the updates. This upgrade is only available to persons with active maintenance plans.

NetScanTools Pro 10.96 Published

2010-04-08T13:07:00.000-07:00

On April 6, 2010, we put the finishing touches on NetScanTools Pro 10.96. This is a minor release that does add one new feature plus several improvements to existing tools.

That new feature is the ability to save optional MD5 hash signature (checksum) files when you save text results, databases or packet capture files to disk. The MD5 file is a text file with the MD5 signature in it. This feature is particularly useful to those in law enforcement.

Improvements are in several areas, particularly Packet Generation and Capture. In the Packet Generator we have improved the scripting so that you can now do simple looping X number of times or you can do an infinite loop making it easy to send repeating sets of packets to a target. Packet Generator also now tells you if WinPcap fails to send a packet. By altering the display update of the floating packet send info window, we have been able to drastically speed up the sending of packets in continuous packet send mode.

In Packet Viewer (to be renamed Packet Capture in version 11), there were considerable improvements made to the parsing of IGMP packets and also the program now recognizes HP Switch LLC packets and Spanning Tree Protocol packets.

There are other minor things like NetBIOS Basic now reporting Windows 7 machines instead of "Windows 6.1". Clear buttons were added to the Whois and Real Time Blacklist (RBL) check tools next to the DNS IP address entry boxes.

One more interesting issue came from a tech support call I had a couple months ago. The user told me that he had a multihomed (more than one active network interface) machine and he was trying to either capture or send packets - I can't exactly remember. Anyway, it appears that the first option in the dropdown WinPcap Interface selection box was "169.254.7.179" - he said that he got an error message when trying to use that interface. After some discussion, we found there was a second IP in the dropdown box - he selected that one and everything worked.

As you may know, the 169.254.x.x IPs are what Windows assigns when it fails to get a new IP from DHCP - this is Automatic Private IP Addressing. So what was added to NetScanTools Pro was this: as the program starts, we go through the list of available interfaces. If a 169.254.x.x interface is found, the user is asked if they want to include it in the list of available WinPcap capable interfaces. Rather than just excluding those from the list, we ask you because someone may actually have set up a network with IPs in that range.

To get this new release you must have an active maintenance plan. If you do, then click on Help/Check for New Version. Login using the credentials shown in the program and download the installer. You will need your CDKEY/Serial Number to install, it is found on Help/About NetScanTools Pro. Please install over the top of your old installation and registering again should not be required.

Laura Chappell's new Wireshark Network Analysis Book

2010-03-18T10:01:00.000-07:00

Laura has done it again. She's written a huge book about Wireshark. When I develop NetScanTools Pro, I use Wireshark to be sure the packets I'm sending and receiving are correct. And NetScanTools Pro saves packet captures in a format that can be opened by Wireshark. I have only read the snippets of the book on the wiresharkbook website, but I can see that the quality is superb and it will be in depth!

You can pre-order the Wireshark Network Analysis book (www.wiresharkbook.com) at a 35% discount using this code:

998NST35 (this is not case sensitive)
Valid until March 29, 2010
Estimated ship date: March 29, 2010

Wireshark Network Analysis: The Official Wireshark Certified Network Analyst Study Guide
Paperback: 800 pages
Publisher: Protocol Analysis Institute
Website: www.wiresharkbook.com
Language: English
ISBN10: 1-893939-99-8
ISBN13: 978-1-893939-99-8
Dimensions: 7.44 x 9.69 inches
Weight: 3.5 pounds
Contact: info@chappellU.com or +1 408-378-7841
Exam Version: Version 1 (WCNA-100 Exam) (Q2 2010 Release)
Exam Link: www.wiresharkU.com/certification.html

NetScanTools LE 1.20 Released 3-15-2010

2010-03-16T08:33:00.000-07:00

Release 1.20 adds essential hash signature functionality to a program designed for use by Law Enforcement. It now creates a companion MD5 hash signature file for exported text files and for exported packet capture ".cap" files. Hash signatures are now included in the database tables to help assure that the table data has not be changed. The purpose of these signatures is to help assure that data you save has not been altered later. You can use any MD5 hash signature utility to verify the original file signature against the saved hash signature file.

There are also some minor fixes in this release. Email Validate now correctly shows the full details of the validation process. DNS Tools now makes better use of the progress bar. We added Select All and Clear All buttons to the Automated Test selection list.

As usual, all the database files were updated and the SQLite DLL was updated to the latest version.

NetScanTools LE is available at http://www.netscantools.com/nst_le_main.html

Multi-Domain Whois - what is it?

2010-02-05T09:28:00.000-08:00

We introduced a new tool in NetScanTools Pro 10.95 called Multi-Domain Whois. It's actually something that we first put in NetScanTools LE 1.00 last month.

First, a little background: one of our longtime law enforcement customers asked for a tool that could take a base domain name like 'netscantools' and do a whois query on netscantools.com, netscantools.net, netscantools.co.uk, etc. He knew that there were online tools for finding out if the domains were registered or not, but he wanted to know the details of each registration without having to manually do a whois query on each one.

Enter Multi-Domain Whois Query. As you can see in the image above you enter the base domain name like 'netscantools' or 'netscantools-le', then you select the extensions you want to query and press Do Multi-Domain Whois. In both NetScanTools Pro and NetScanTools LE it then queries each of those you selected by appending the domain name and querying the right whois server. The results are shown in the display in NetScanTools Pro and saved in the current Case Database in NetScanTools LE. In NetScanTools Pro 10.95, you can review the results by by scrolling the results window on the whois tool page (a query separator is added for clarity). In NetScanTools LE, you click on reports and select the reports you are interested in.

To summarize, Multi-Domain Whois gives you the ability to do a bulk whois query on a number of different common domain extensions using a single input base domain name.

As with all bulk whois queries, be careful how much you use this because whois servers often have query number limits on them. Some are as low as 10 queries per 24 hours - be careful.

New DNS Speed Test Tool in NetScanTools Pro 10.95

2010-02-03T18:20:00.000-08:00

Our good friend Phil at Ford asked us if we could provide a tool that accepted a list of DNS IPs, then test each DNS to find out how fast it could resolve a hostname or an IP address. We did it.

You can find the DNS List Speed Test tool on the DNS Tools - Advanced toolset page. Using it is pretty simple, first create a list of DNS IPv4 Addresses (hostnames can also be used but are discouraged) and save it to a text file. The list should be one IP address per line. Notepad works well for this. Then put in a hostname or an IP in the entry area, and press the DNS List Speed Test button. A File Open navigation window will open, locate and open the text file you just created. The tool will take it from there.

The output area tells you the IP of each DNS being tested, the DNS server reply code, whether or not the DNS can do recursion, and the A or PTR record that matched the input (if available). Sometimes you will see other DNS records like NS decoded if the DNS sent them to you. It also tells you the Server Response Time which is really what you are after. You can see just how fast each DNS server is with this tool.

DNS response time (latency) is most interesting part of the results and the purpose of the tool.. The DNS response time is calculated from the moment we send the packet to the moment a response is received. DNS managers like Phil who manage hundreds of DNS's can see which DNS's are having troubles by quickly looking at the response content and the DNS response time.

You can see the results in the image above.

NetScanTools Pro 10.95 USB Version Patch Ready

2010-02-03T18:18:00.000-08:00

The USB version patch is ready. It will upgrade your NetScanTools Pro USB to 10.95. To obtain the patch, login through Help/Check for New Version. You need an active maintenance plan to have access to the upgrade.

NetScanTools Pro 10.95 Published

2010-02-03T11:21:00.000-08:00

NetScanTools Pro 10.95 was released late in the day on Monday February 1, 2010. We've added some new tools and made numerous changes to existing tools.

New Tools
-DNS Tools - Advanced: DNS List Speed Test - this tool accepts a list of DNS IPs (hostnames are allowed, but not recommended), then it sends an identical forward or reverse resolve query to each DNS and shows the response time. It also shows the data that each DNS sends back.
-Whois: Multi-Domain Whois - this tool accepts as input a base domain name, like 'netscantools', then it appends a top level domain or secondary level domain extension like '.ca' or '.co.uk' and queries the appropriate whois server. users can select from a large number of extensions to add. The whois queries are done as a group or batch much like the current batch whois tool.
-Whois: Autonomous System Numbers are now accepted as input. Format is AS##### where # are numbers.

If you have an active maintenance plan, click on Help/Check for New Version to download this new version. If you are interested in renewing your maintenance plan or buy the software, please see our website.

Is the economy getting better? part 2

2010-02-03T08:42:00.000-08:00

uh...maybe not.

We sent out an announcement yesterday about the release of NetScanTools Pro 10.95 and got back 13 bounced emails. I resent the announcement from an different domain just to be sure it was a real bounce and sure enough, 13 people are no longer employed since the last announcement at the beginning of November 2009.

Is the economy getting better?

2010-01-31T07:07:00.000-08:00

Maybe. We send out a newsletter once a month and for the end of 2008 and all of 2009, we've had between 10-20 or more email bounce backs each month. While some of those could be bounced back for other reasons, our assumption is that the person is no longer at their job. Keep in mind that most of the email addresses in our list are business addresses and not personal home email addresses.

So a few days ago I sent out the January 2010 newsletter and I only had 3 'user unknown' email bounces. December 2009 was under 10, but only a little. A definite improvement.

Here is the January 2010 newsletter if you are interested:
http://www.netscantools.com/pressandnewsletters/NST_Pro_January_2010_News.pdf

I guess I could call this the "Email Bounce Economic Index".

NetScanTools (tm) Basic Edition 2.0 Released Jan 14, 2010

2010-01-16T08:57:00.000-08:00

This update to the Freeware Basic Edition changes the layout of the left control panel to make it less confusing. I also added the registered trademark notice for NetScanTools. The SQLite DLL to the latest version as was the whois database it works with. The biggest change was a switch to Inno Setup away from the old Wise installer. This reduced the size of the final installation .exe nearly 1 MB and it gives full compatibility with Windows 7. Speaking of Windows 7, NetScanTools Basic is fully Windows 7 compatible.

You can get NetScanTools Basic 2.0 here.

NetScanTools LE 1.10 Released 1-12-2010

2010-01-15T14:13:00.000-08:00

We released NetScanTools Law Enforcement (LE) v1.00 on Jan 1 and we quickly heard from our friends at a government training center that they would really like to have a basic packet capture tool in it.

We had planned on putting in Packet Capture for the purpose of showing that the evidence in the reports could be substantiated and validated if required. The Packet Capture tool is currently independently run from the main program, so in order to validate your work, you would need to start it before you work on a task. That way you would collect the same packet information and save it. The Packet Capture trace file MUST be saved separately when you are done with your tasks, this is not automatic at the moment.

Packet Capture files are 100% Wireshark compatible, so if you need to show a chain of communication in the process of retrieving information from external network sources, you can do so using that free packet analysis tool. Our Packet Capture tool has a basic packet viewer so you can see the contents of the packets and search for something within a packet.

At some point the Packet Capture tool will be better integrated. Maybe in the next version.

You can read about NetScanTools LE and download a 30 day trial here:
http://www.netscantools-le.com/

NetScanTools LE v1.10 was released on Jan 14, 2010.

SNMP Scanning

2010-01-11T18:34:00.000-08:00

What do we mean by SNMP Scanning? For the purposes of this article, it means scanning a range of IP addresses to see what devices are running SNMP servers. Some people call this SNMP Community Name guessing or bruteforcing.

What is SNMP and what is it used for? SNMP stands for Simple Network Management Protocol. It's used by network devices like routers and switches to report information about the device. Even a Windows computer can be made to divulge information using SNMP! (Windows does not install it by default). This information can be device information like temperature, packet counts or packet statistics or even IP addresses of devices connected to the device. The info is arranged in a heirarchical order somewhat like directories on a hard drive.

SNMP comes in 3 flavors or versions: 1, 2c and 3. Most devices support 1 and 2c, while newer devices will support v3 and usually have backwards compatibility with versions 1 and 2c. Versions 1 and 2c are very similar and report data to a client if the client includes a simple plain text password-like phrase called a 'community name'. We're going to limit our discussion to v1 and v2c.

SNMP usually runs on UDP port 161. Some people like to put it on an alternate UDP port to avoid what we are going to do in this article. Since it's a UDP based protocol, there is no full connection, so when we talk to an SNMP server it won't respond to us unless the question we are asking is correct. There are two essential parts of the question: the MIB item we are asking for and the community name (password) to get it. Both have to be correct to get a good response.

Back to the point of this article. How do you find the devices in your network running SNMP? One way is to do a Port Scan of every device in the IP range on port 161. This might work, but since SNMP is UDP you are depending on the targets returning an ICMP Port Unreachable message to you if the device is NOT running SNMP. This is a lot to ask, especially if the devices have a firewall or are set to not reply with ICMP. You run the risk of lots of false positives with port scanning.

Another way is to use a specialized tool called SNMP Dictionary Attack which is part of NetScanTools Pro. This tool can make an SNMP query to each IP address and it can send known or common community names to the devices. If you are a network administrator, you already know what the community names of your devices are, so here's a shortcut that you may want to try (if not, then skip this). Locate dctnry.txt in your NetScanTools Pro installation directory and open it with notepad. Enter your common community names at the beginning of the list, one per line and save it (we are going to improve this soon).

Using NetScanTools Pro to scan for SNMP servers on devices. Start NetScanTools Pro and locate the SNMP tools under the Tools left panel group. Select Dictionary Attack under the dropdown list labeled Select SNMP Action. Press Perform Action (no other settings are necessary). This opens the tool.

Now press the Target List Editor button on the left panel to open the editor. You can do one of several things here. You can enter IP addresses one at a time or you can define a range of IPs or you can import a list of IPs. The bigger the list, the longer the scan takes - recommend 256 or less IPs. Once you have created your list press OK and then press Setup. In Setup you can define the SNMP version(s) you want to use. If you choose both v1/v2c, it takes twice as long to scan. You can also adjust the time to wait for an SNMP response. Once you are satisfied with the values, press OK and now we are ready. Put the 'Attack Speed' in the middle range and press the 'Attack' button.

The scan proceeds with the results being presented in the grid as they are found. If the device responds to the SNMP queries, you will see 'Community Name Found' along with the community name, version and system name. If not, you will see 'No SNMP on this device' if an ICMP message came back. You may also see a definitive 'No route to device' if you are on the same subnet as the device. If you edited the dictionary list first, this process will go pretty quickly if you are on the same subnet, but it may take awhile if you are scanning devices outside your subnet.

You can watch the scan status on the lower bar. This tool will work best on the same subnet as the devices, but it is not limited to that subnet (the demo version is limited to the local subnet). While you watch it scan, if the device status is blank, it will continue to try community names until it exhausts the list or the device responds.

When you are done or when you feel the scan has gone on long enough, you can review the results. You should be able to see which devices are running SNMP and their community names.

This is a brute force password guessing tool that will show SNMP responses if the device is running SNMP and you have the correct community name. It scans a list of IP addresses and tests them with multiple SNMP queries in an attempt to get a response. It can take awhile and the community name may not be in the dictionary, so you may not be able to find the community name. We have created a fairly comprehensive list and it does cover many common passwords like the default 'public' and 'private'. Try out the tool in our demo or if you have the full version, give it a try. The demo is here: http://www.netscantools.com/nstprodemorequest.html

As with all scanning tools, we must warn you that your actions may be construed as hostile and may violate local laws. So you need to limit your scans to your own systems or have the permission of the IP address range owner before scanning. There will be lots of traffic directed toward the SNMP port, so intrusion detection systems (IDS) will see it. This is not a stealthy scan operation.

NetScanTools LE Released!

2010-01-01T13:12:00.001-08:00

January 1, 2010

Northwest Performance Software, Inc. announces the release of NetScanTools LE 1.00. LE = Law Enforcement.

NetScanTools LE is an Internet Information Collection tool that gives you reports about an IP Address, Hostname, Domain Name, Email Address or URL (web address). This is NetScanTools designed especially for Law Enforcement. We asked our Law Enforcement NetScanTools Pro users what tools they really needed. We took their favorite tools, streamlined them into a new interface and made the program 'case' oriented. And 'case' oriented means that all your queries are documented, time stamped and saved automatically. Reports are direct and to the point. There are no distractions in the reports - you get the results you need, not fancy logos.

For more information and to request a 30 day trial, please visit: http://www.netscantools-le.com/

Kirk Thomas

Happy New Year!

2010-01-01T11:43:00.001-08:00

Wishing you a good and prosperous 2010!

Merry Christmas

2009-12-24T13:00:00.000-08:00

To those of you who celebrate Christmas: Merry Christmas!

Our office will be close on Dec 25, 2009. Any orders placed online will be processed on Saturday, Dec 26.

NetScanTools LE Status

2009-12-24T12:38:00.000-08:00

Well it won't be out before Christmas. Much as I wanted to get it done, it's not quite done. The post-purchase registration system is just about done and is being tested today. The next step is finalizing the fileset and building the installer. Then release. Watch this space for news.

NetScanTools LE is the "Law Enforcement" version: see http://www.netscantools-le.com/

NetScanTools Pro Maintenance Plan Renewal Sale

2009-12-24T12:26:00.000-08:00

Did you forget to renew your NetScanTools Pro v10 Maintenance Plan? -maybe by a lot? -maybe even by a year or more?

Here is your chance to be back on the plan and get the Windows 7 friendly 10.94 version! Special price reduction on the "Over 180 days Late" v10 Maintenance Plan renewal - instead of $150, the renewal price is $135 through December 31, 2009. Call us (360) 683-9888 or go to the maintenance plan page below for a link to order online:
http://www.netscantools.com/nstpromaintenance.html

Boeing 787 Dreamliner' First Flight over Sequim WA

2009-12-15T11:45:00.000-08:00

I took this video about 10 minutes after the 787 first took off. It was headed out the Strait of Juan de Fuca towards the relatively unpopulated areas of the Washington coast--like Forks. Sorry about the quality, it was high up and there were clouds which made it tough for the camera to focus. You can see the 787 and the chase plane. There were two chase planes when it took off, but only one stayed with it. Notice how quiet it is. You can see the landing gear still out if you look carefully.

Kirk Thomas

Weekend Sale Dec 11-14

2009-12-11T13:23:00.000-08:00

The Managed Switch Port Mapping Tool is 35% off this weekend - Black Friday continues! See this page:
http://www.netscantools.com/blackfridaysale.html