NetScanTools (r) Basic Edition 2.1 Released July 8, 2011

On Friday we released NetScanTools Basic 2.1 - our first update to this software since January 2010. This is our freeware version of NetScanTools. It has just a few helpful tools that introduce people to the NetScanTools Product line.

Tools:
DNS Tools - simple query (ipv4 to hostname etc.), Who Am I (shows your IPv4 address, hostname and DNS servers), Test Default DNS (takes IP address or hostname and asks each default DNS server for translation).

Ping - uses standard ICMP ping to contact an IPv4 or hostname.

Graphical Ping - uses standard ICMP ping to contact an IPv4 or hostname and it graphs the response times over time.

Traceroute - uses ICMP packets to show the route between your computer and a target computer.

Ping Scanner - uses ICMP packets to ping every IPv4 address between a start and ending IPv4 address.

Whois - shows basic whois information for around 70 domain extensions and IPv4 addresses.

These tools are simplified in comparison to NetScanTools Pro which means you don't have all the options available and you only get one mode of operation - for example traceroute is ICMP only instead of ICMP, UDP, TCP etc.

Have a look and enjoy!
Kirk

NetScanTools Pro 11 status

Another week has passed. This week included quite a bit of work on version 11 - again in the area of IPv6. NSLOOKUP and Dig both now accept IPv6 address inputs.

Most importantly, whois now accepts IPv6 inputs. Whois' ip to hostname to ip now work with IPv6. So if you enter a domain name, it will check for both IPv4 and IPv6 addresses. Plus, the whois servers for showing ownership or delegation of the IPv6 addresses are now in the database and it will make the correct query based on the input IPv6 address.

A few more new things next week and then wrap up for release.

Kirk

IPv6 Tools in NetScanTools Pro v11

NetScanTools Pro v11 will have the first real IPv6 tools that we have done ever in it. The ability to retrieve DNS AAAA records has always been there, but we've gone beyond that. Here are a sample of the completed tools.

DNS Tools - Basic now includes a Simple Query - IPv6 tool. This tool accepts a hostname like ipv6.google.com or a IPv6 Address like 2001:6b0:1:ea:202:a3ff:fecd:23a7 and attempts to retrieve the IPv6 address or hostname respectively.

DNS Tools - Advanced now includes an IP/Hostname to ASN tool that accepts either a hostname or an IPv4/IPv6 address and returns the ASN.

Ping - Enhanced now includes an ICMPv6 mode.

More IPv6 to come next week. Think about NetScanTools Pro v11 when you need some GUI IPv6 tools. NetScanTools Pro v11 will be released in November. We're getting closer!

IPv6 and DNS Tools

NetScanTools Pro v11 Status as of today.

Working on IPv6 additions to NetScanTools Pro v11. We now have two new IPv6 capable DNS tools. I should have the other DNS tools I'm adding complete in the next day or so. Then I will add one or two more IPv6 tools soon after.

Kirk

NetScanTools (TM) Pro 10.98 Published

On Monday, October 4, we released NetScanTools Pro 10.98 installed version. The USB version patch was released on Tuesday, October 5.

Here are the changes:

• Ping will now allow up to 8192 consecutive pings to sent. Problems occurred in the previous version if you exceeded 256 pings as defined in Setup.
• Certain DNS functions that use the secondary resolver (ex. Get Basic DNS Records) will now properly handle the truncated flag in the UDP response that indicates the query should be retried using TCP.
• DNS Tools - Core: Fixed problem where if a very large response to a single record query was obtained, all the records would be displayed. Example would be a large PTR record response for a single IP address.
• Updated SQLite to version 3.7.2.
• Updated database files. Removed whois prefix files.

You can download the latest version (if your maintenance plan is active) by clicking on Help/check for new version.

Checking Authoritative DNS Serial Numbers

Did you know that Authoritative DNS servers consist of primary and one or more backup or secondary servers? Did you also know that they are supposed to be in sync?

It is important that the servers be in sync. Why? a record in the primary may be very different from the same record in the secondary - especially if it was just changed. A query might get the wrong information (like an IP) if the secondary returns the record instead of the primary. That's why it is important to sync them fairly quickly.

The DNS servers are listed when you do a 'whois' query for a domain. Most domains have only two, a primary and secondary. When changes are made to the primary, then they are migrated to the secondary so that if for some reason the primary does not respond to DNS queries, the secondary may continue to do so.

It is important to know if those primary and secondary servers are in sync. You can look at the SOA serial field to find out. Normally they are identical for all DNS servers. If they are not, then that indicates a problem. You can use NSLOOKUP to retrieve the SOA records from each DNS (primary and secondary). This is a tedious process if there are more than two servers to look at.

We have a tool in NetScanTools Pro that simplifies this process by doing the queries for you very quickly. That way you can see a quick snapshot of the DNS update situation. It is part of the DNS Tools - Advanced and it is called "Auth Serial Check".

Here in this example for our domain showing matching serials. Note that the program looks that them to make sure they are OK:

[Start Query]
Authoritative DNS Serial Check
Starting Timestamp: 04/21/10 17:00:28
Query: netscantools.com

NS: ns2.webnethost.net -- Serial: 2010020400
NS: ns1.webnethost.net -- Serial: 2010020400

Analysis: All serial numbers are identical, no problems detected.

[End Query]

And now here is a query showing microsoft.com's DNS serials. Note that certain DNS servers are out of date with others. "ns1" is the primary and the others are backup.

[Start Query]
Authoritative DNS Serial Check
Starting Timestamp: 04/21/10 16:44:23
Query: microsoft.com

NS: ns3.msft.net -- Serial: 2010042102
NS: ns5.msft.net -- Serial: 2010042101
NS: ns1.msft.net -- Serial: 2010042102
NS: ns4.msft.net -- Serial: 2010042102
NS: ns2.msft.net -- Serial: 2010042101

Analysis: One or more serial numbers are out of sync with the other serial numbers.

[End Query]

I checked again 15 minutes later and found that all DNS serials in the microsoft.com listing were the same. This is probably normal for a domain of this size because it may take awhile to transfer the zone updates from the primary to the secondaries. I checked the SOA record and I could see that the refresh interval is 5 minutes and the retry interval is 10 minutes, so their DNS should not be out of sync for long. It's unusual to see this, so I thought it would make a good example.

A note about the serial field formatting. These both conform to what is now recommended where the serial is human readable. In the case of microsoft.com, you can see that it is April 21 2010, update numbers 1 and 2. In the case of netscantools.com, you can see that the serial has not changed since February 4, 2010. Not all serials conform to this method. Some are just straight incremental numbers.

You can try out the Auth Serial Check tool in the NetScanTools Pro Demo at our website.

New DNS Speed Test Tool in NetScanTools Pro 10.95

Our good friend Phil at Ford asked us if we could provide a tool that accepted a list of DNS IPs, then test each DNS to find out how fast it could resolve a hostname or an IP address. We did it.

You can find the DNS List Speed Test tool on the DNS Tools - Advanced toolset page. Using it is pretty simple, first create a list of DNS IPv4 Addresses (hostnames can also be used but are discouraged) and save it to a text file. The list should be one IP address per line. Notepad works well for this. Then put in a hostname or an IP in the entry area, and press the DNS List Speed Test button. A File Open navigation window will open, locate and open the text file you just created. The tool will take it from there.

The output area tells you the IP of each DNS being tested, the DNS server reply code, whether or not the DNS can do recursion, and the A or PTR record that matched the input (if available). Sometimes you will see other DNS records like NS decoded if the DNS sent them to you. It also tells you the Server Response Time which is really what you are after. You can see just how fast each DNS server is with this tool.

DNS response time (latency) is most interesting part of the results and the purpose of the tool.. The DNS response time is calculated from the moment we send the packet to the moment a response is received. DNS managers like Phil who manage hundreds of DNS's can see which DNS's are having troubles by quickly looking at the response content and the DNS response time.

You can see the results in the image above.

NetScanTools Pro 10.95 Published

NetScanTools Pro 10.95 was released late in the day on Monday February 1, 2010. We've added some new tools and made numerous changes to existing tools.

New Tools
-DNS Tools - Advanced: DNS List Speed Test - this tool accepts a list of DNS IPs (hostnames are allowed, but not recommended), then it sends an identical forward or reverse resolve query to each DNS and shows the response time. It also shows the data that each DNS sends back.
-Whois: Multi-Domain Whois - this tool accepts as input a base domain name, like 'netscantools', then it appends a top level domain or secondary level domain extension like '.ca' or '.co.uk' and queries the appropriate whois server. users can select from a large number of extensions to add. The whois queries are done as a group or batch much like the current batch whois tool.
-Whois: Autonomous System Numbers are now accepted as input. Format is AS##### where # are numbers.

If you have an active maintenance plan, click on Help/Check for New Version to download this new version. If you are interested in renewing your maintenance plan or buy the software, please see our website.

SNMP Scanning

What do we mean by SNMP Scanning? For the purposes of this article, it means scanning a range of IP addresses to see what devices are running SNMP servers. Some people call this SNMP Community Name guessing or bruteforcing.

What is SNMP and what is it used for? SNMP stands for Simple Network Management Protocol. It's used by network devices like routers and switches to report information about the device. Even a Windows computer can be made to divulge information using SNMP! (Windows does not install it by default). This information can be device information like temperature, packet counts or packet statistics or even IP addresses of devices connected to the device. The info is arranged in a heirarchical order somewhat like directories on a hard drive.

SNMP comes in 3 flavors or versions: 1, 2c and 3. Most devices support 1 and 2c, while newer devices will support v3 and usually have backwards compatibility with versions 1 and 2c. Versions 1 and 2c are very similar and report data to a client if the client includes a simple plain text password-like phrase called a 'community name'. We're going to limit our discussion to v1 and v2c.

SNMP usually runs on UDP port 161. Some people like to put it on an alternate UDP port to avoid what we are going to do in this article. Since it's a UDP based protocol, there is no full connection, so when we talk to an SNMP server it won't respond to us unless the question we are asking is correct. There are two essential parts of the question: the MIB item we are asking for and the community name (password) to get it. Both have to be correct to get a good response.

Back to the point of this article. How do you find the devices in your network running SNMP? One way is to do a Port Scan of every device in the IP range on port 161. This might work, but since SNMP is UDP you are depending on the targets returning an ICMP Port Unreachable message to you if the device is NOT running SNMP. This is a lot to ask, especially if the devices have a firewall or are set to not reply with ICMP. You run the risk of lots of false positives with port scanning.

Another way is to use a specialized tool called SNMP Dictionary Attack which is part of NetScanTools Pro. This tool can make an SNMP query to each IP address and it can send known or common community names to the devices. If you are a network administrator, you already know what the community names of your devices are, so here's a shortcut that you may want to try (if not, then skip this). Locate dctnry.txt in your NetScanTools Pro installation directory and open it with notepad. Enter your common community names at the beginning of the list, one per line and save it (we are going to improve this soon).

Using NetScanTools Pro to scan for SNMP servers on devices. Start NetScanTools Pro and locate the SNMP tools under the Tools left panel group. Select Dictionary Attack under the dropdown list labeled Select SNMP Action. Press Perform Action (no other settings are necessary). This opens the tool.

Now press the Target List Editor button on the left panel to open the editor. You can do one of several things here. You can enter IP addresses one at a time or you can define a range of IPs or you can import a list of IPs. The bigger the list, the longer the scan takes - recommend 256 or less IPs. Once you have created your list press OK and then press Setup. In Setup you can define the SNMP version(s) you want to use. If you choose both v1/v2c, it takes twice as long to scan. You can also adjust the time to wait for an SNMP response. Once you are satisfied with the values, press OK and now we are ready. Put the 'Attack Speed' in the middle range and press the 'Attack' button.

The scan proceeds with the results being presented in the grid as they are found. If the device responds to the SNMP queries, you will see 'Community Name Found' along with the community name, version and system name. If not, you will see 'No SNMP on this device' if an ICMP message came back. You may also see a definitive 'No route to device' if you are on the same subnet as the device. If you edited the dictionary list first, this process will go pretty quickly if you are on the same subnet, but it may take awhile if you are scanning devices outside your subnet.

You can watch the scan status on the lower bar. This tool will work best on the same subnet as the devices, but it is not limited to that subnet (the demo version is limited to the local subnet). While you watch it scan, if the device status is blank, it will continue to try community names until it exhausts the list or the device responds.

When you are done or when you feel the scan has gone on long enough, you can review the results. You should be able to see which devices are running SNMP and their community names.

This is a brute force password guessing tool that will show SNMP responses if the device is running SNMP and you have the correct community name. It scans a list of IP addresses and tests them with multiple SNMP queries in an attempt to get a response. It can take awhile and the community name may not be in the dictionary, so you may not be able to find the community name. We have created a fairly comprehensive list and it does cover many common passwords like the default 'public' and 'private'. Try out the tool in our demo or if you have the full version, give it a try. The demo is here: http://www.netscantools.com/nstprodemorequest.html

As with all scanning tools, we must warn you that your actions may be construed as hostile and may violate local laws. So you need to limit your scans to your own systems or have the permission of the IP address range owner before scanning. There will be lots of traffic directed toward the SNMP port, so intrusion detection systems (IDS) will see it. This is not a stealthy scan operation.

NetScanTools (tm) Basic Edition Released May 14, 2009

What? another NetScanTools?

Yes. When we stopped producing NetScanTools Standard 5.1 in August 2004, we left a whole lot of registered users without any alternative. Business users who wanted to move up opted for NetScanTools Pro, but many, many home and small business users could not justify or afford the upgrade, so they either kept using on NetScanTools Standard (yes, we still hear from people who have used it for years) or they found something else.

Two weeks ago we decided to make a new program using the latest Visual C++ 2008 compiler along with an updated interface -- that's right two (2) weeks ago. Now there is a new program created from almost scratch and it is completely finished! And it works fine on Windows 7, Vista 32/64, 2008, 2003, XP and even Windows 2000.

This new tool has simplified versions of six tools: Ping, Traceroute, Ping Scan, Graphical Ping, DNS Tools and Whois. They are very usable versions of more advanced tools found in NetScanTools Pro. There are embedded web pages comparing the NetScanTools Basic versions of the tools with the NetScanTools Pro versions. Plus we show you what other tools are available in NetScanTools Pro -- just in case you are interested.

It is now our entry level program.

And it's freeware. Try it. Enjoy it. And don't forget to give us feedback on the About NetScanTools Basic page.

You can find it here:
http://www.netscantools.com/nstbasicmain.html

New NetScanTools (TM) Pro Version 10.80

The newest release of NetScanTools Pro is finally done. This is the long form (or long-winded) explanation of some of the changes made in 10.80.

Several major changes have been made and they are mostly in the area of DNS Tools because that is where customer interest has been taking us. Current users take note -- the Name Server Lookup manual tool is GONE: but don't worry, it was reworked and renamed DNS Tools - Core. A few of the tools formerly on the Name Server Lookup tool were move to the new DNS Tools - Advanced tool, along with new tools. We have brought back the manual Zone Transfer tool where you specify the authoritative DNS to retrieve the zone from. New DNS Tools have been added including a DNS Version tool that retrieves the software version of the DNS, an Auth Serial Check used to compare the zone serial numbers of primary and secondary DNS, a new SPF/Domain Keys record retrieval tool and both DNS Tools groups have a new Batch Processing function. Batch Processing allows you to run the tools with a list of IPs, domain names or hostnames which is really handy if you have a group of queries to make. Autosave is included in both DNS Tools groups. There will be even more additions to the DNS Tools groups in future releases.

Speaking of Autosave, it has been added SNMP and to Traceroute. What is Autosave? It is a simple method of saving the results of all queries from a tool to a single user-defined text file. That way you can review all the data you have done in SNMP or Traceroute or the DNS Tools. Eventually we would like to put Autosave into every place it makes sense and SNMP and Traceroute were two that needed it the most right away.

SNMP has also had a minor facelift. The annoyingly short width OID entry field was made wider -- alot wider so that you can see what was entered before. The list of SNMP actions has been labeled too. The setup window has been improved.

Traceroute has the autosave function in setup and we also added a main tool quick select of the five kinds of traceroute (ICMP (MS), ICMP WinPcap, UDP variable port, UDP fixed port, and TCP). This means you don't have to go back into setup to change the traceroute mode.

Network Statistics also had a minor facelift mostly in the TCP/UDP connection endpoint list. More columns are visible. We split the Process:PID column into two and also split the IP/Port columns into two. A bit easier to read especially since it is now wider.

That's a few of the major changes, there are lots of other changes. The USB version will be done in a few days and the demo will be updated after Christmas to reflect 10.80 changes.

If you have an active Maintenance Plan, click on the Online left panel group, then click on Check for New Version, login and download the new version. Comments on the new version are appreciated and if you have any feature suggestions, let us know. If you don't have an active maintenance plan, go to our netscantools.com main page and look at the End of 2008 Special.