NetScanTools Pro 11.83 Released September 15, 2017

This release improves the user experience in several areas and the UI is less cluttered.

Back when we started adding tools that depended on WinPcap, a computer typically had one interface that WinPcap could use for receiving or sending packets. That has all changed. VPNs, Virtual Machines and secondary network interfaces can all potentially add WinPcap compatible interfaces and those interfaces all show up in the WinPcap Interface dropdown list. The problem is that prior to v11.83 you had to select the right WinPcap compatible interface or the tool did not work right and you saw a message to select the correct interface. What v11.83 brings is automatic selection of the interface based on the input you give. This applies to a number of tools in NetScanTools Pro like ARP Scanner, Ping, Traceroute and others. You will still have to select the correct interface in many of the separately launched tools like Packet Capture or Passive Discovery because those tools are listening tools rather than 'packet sending/listening' tools.

Over the past few years typical monitor sizes (pixels HxW) has radically increased. We originally designed NetScanTools Pro to accommodate monitors as low as 800x600 but I personally use a pair of 1920x1080 monitors. I reviewed our web traffic on Google Analytics and found that nobody is using 800x600 or even 1024x768 so this new version of NetScanTools Pro expands the layout of the buttons and other controls on the right side and spreads them out as a first step towards reducing clutter.

Another annoyance was the 169.254.x.x popup message that appeared on startup, usually if you had Npcap installed instead of WinPcap. The message is gone and 169.254.x.x interfaces are not included in any tool (except those that show interfaces) since they are auto-assigned IP addresses from the operating system and actually not functional.

Many other changes and they are listed below. If you have an active maintenance plan you can download 11.83 through the Help menu/Check for New Version.

The list of changes.

-Usability improvement: Tools that depend on selecting the right WinPcap compatible interface now automatically select the interface based on the target entered. This includes ARP Ping, ARP Scanner, DHCP Server Discovery, Duplicate IP Detection, OS Fingerprinting, Ping - Enhanced, Port Scanner, Promiscuous Mode Scanner, and Traceroute. 'Launched' monitoring tools still require you to select the interface to monitor.

-Reports now have expanded information regarding the settings used for these tools (most are in the 'Notes' section of the report): Packet Flooder, Ping - Enhanced, Ping Scanner, Port Scanner, and Traceroute.

-DHCP Server Discovery now times out quicker if the local port 68 is in use and any network adapters with the IP starting with 169.254.x.x are not shown in the list because they are inactive.

-Maintenance Plan Expiration and other startup messages that appear before the main window is active are now force to appear as the topmost window. This stops the problem of starting NetScanTools Pro and not seeing anything because a startup message window was behind another window.

-Ping Scanner now includes a right click menu option to use your web browser to connect with the selected IP address.

-Fixed minor memory leak in Network Interfaces and Statistics.

-Removed startup message about 169.254.x.x interfaces which shows up more frequently if Npcap is installed instead of WinPcap.

-Began the first steps of a UI improvement by expanding the area used by the tools in the right hand panel. Our research shows that most displays are now wide enough for us to de-clutter the right hand side by making it wider and moving controls.

-Ping: changed the default header acknowledgment field value to 0.

-Traceroute: added header acknowledgment field as a user defined field in Settings.

-SSL Certificate Scanner: Added parsing of Subject Alternative Name (SAN) fields. Shown in the certificate chain. Previous retrievals of SSL certificates are noted in the grid when you edit or start the software. Right click to access the certificate chain. Added more parsing of signature algorithms so OIDs will be less likely to show up.

-Graphical Traceroute: Added Reset Statistics button.

-SNMP and SNMP Advanced: default bulk reps is now 8. Suggest lowering to 8 if you are using SNMPv2c or SNMPv3.

-USB Version Only: startup on a host running Npcap now works correctly.

-Updated SQLite to version 3.20.1

-Updated MAC address/Manufacturer database.

-Updated IP to Country database.

-Updated dates in all subprograms to 2017.

NetScanTools Pro v11.80 released Aug 4, 2016

NetScanTools Pro 11.80 was released on Aug 4, 2016. This version was completely compiled on Windows 10 and is dual code-signed with both SHA256 and SHA1.

We added a new IPv6 Route Tool that displays the routes and many other properties.

There are many changes and the most obvious change is in the way WinPcap compatible interfaces are shown and selected. Tools that use WinPcap now have a much more verbose description of the interface, not just the IPv4 address shown before. Previously, users would occasionally run into problems where the IPv4 address shown in the dropdown list was not able to be opened even though WinPcap says it was compatible with it. The way the interfaces are opened based on the selection was significantly changed internally so there should be less chance of problems.

The Real Time Blacklist Check tool was changed from a text based single threaded (one after the other) output to a grid based output with multithreading. In other words, in v11.80 many RBL servers are queried simultaneously for the presence of the mail server IPv4 address in their databases.

SNMP tools now support SNMPv3 without the enduser having to go obtain libeay32.dll. We have an Encryption Registration Number and the software is ECCN 5D992.c.

The SNMP Scanner and SNMP Dictionary Attack Tools were worked on extensively to fix problems that happened if you sorted a column with scanning (no longer allowed) and also problems with the XML Excel Schema. Side note - if you are using Excel, don't 'import' the XML file, simply 'open' it just like any other Excel file.

Here are the specific changes:
-Compiled on Windows 10.
-New Tool: IPv6 Routing Table.
-Significant change to the way WinPcap compatible interfaces are listed and chosen. Layout of some tools had to change to support longer selection box.Opening and using a WinPcap network interface no longer depends on matching the IPv4 address.
-We now test to verify that the official WinPcap service or the alternative npcap or Win10Pcap services are running.
-Realtime Black List Check tool completely rewritten with new user interface and it is now multithreaded for increased speed.
-SNMP Core and Advanced tools now have simplified SNMPv3 options. SNMP DLL now has libeay32.dll added and SNMP Library Manager was removed. ECCN 5D992.c
-SNMP Scanner, SNMP Dictionary Attack and Protected Storage Viewer have updated grid controls and are now prevented from sorting by clicking on the column header while the tool is working. Exporting with Microsoft Excel schema has been updated - simply 'open' the XML file from Excel (do not import it). SNMP v1+v2c setting is now properly saved.
-ARP based tools now confirm that the target IPv4 addresses are within the same subnet as the chosen WinPcap interface.
-ARP Scan now automatically sorts by the IP address column when complete.
-Whois changed so that if whois server does not respond, it times out and automatically stops.
-Assigned IPv6 Teredo server is shown in IPv6 Compatible Interfaces.
-Corrected privilege problems with writing to certain parts of the registry during registration process.
-Updated SQLite to version 3.13.0
-Updated MAC address/Manufacturer database.
-Updated IP to Country database.
-Code signing now uses both SHA256 and SHA1 for maximum operating system portability.

Win10Pcap - a WinPcap fork

Today Gerald Combs graciously forwarded me an announcement about a new fork to WinPcap called Win10Pcap based on NDIS 6. I immediately tested it with Wireshark and NetScanTools Pro.

Since this fork uses a different kernel mode driver name - ie, NOT npf.sys, Wireshark shows the popup message "The NPF driver isn't running. You may have trouble capturing or listing interfaces.". However, even though this message shows Wireshark will run because Wireshark loads packet.dll and wpcap.dll - these two DLL interfaces are unchanged (the WinPcap SDK interface is supposedly unchanged) so no matter what the driver is called, it starts. So, yes, Wireshark 1.12.5 appears to run with this fork of WinPcap.

That brings me to NetScanTools Pro. Not only does NetScanTools Pro capture packets (like Wireshark), it also sends packets. I tested the ARP, Ping and Traceroute tools that depend on WinPcap for sending packets. They appeared to work OK.

I was just about to release NetScanTools Pro 11.70, so I was able to make my test for active running npf.sys also test for the new service name - so that means NetScanTools Pro will be able to detect either the official WinPcap 4.1.3 and successors or this new fork.

Note that old WinPcap 4.1.3 DOES WORK FINE on later releases of Windows 10 builds based on NDIS 5. So it's your choice as to whether you need to use this new fork.

You may download this new WinPcap fork from http://www.Win10Pcap.org/ however, since they use GPLv2 instead of BSD license as WinPcap has historically done, we will not be including the installer with NetScanTools Pro.

Congrats to the author of Win10Pcap! (but what happens to the name when Win 11 is released?)

Updated: Wireshark and WinPcap 4.1.3 on Windows 10 Enterprise Build 10061

This release of Windows 10 Enterprise Technical Preview Build 10061 seems to run the 'old' WinPcap just fine. Whatever was broken in 10041 was fixed - I wonder: was NDIS backwards compatibility restored? I don't know, but it works. At least for now. With the rumored final Windows 10 release coming in July 2015, things had better start to get finalized soon. That means networking too.

So for now, Windows 10 build 10061, seems to capture packets fine with Wireshark 1.12.4 and old 4.1.3 WinPcap release. WinPcap also sends customized packets correctly from NetScanTools Pro v11. We'll see what the next build does.

Update June 5, 2015: WinPcap 4.1.3 also runs on build 10130.

Kirk

Updated: WinPcap and Wireshark problems on Windows 10 Tech Preview 10041

Update June 5, 2015: WinPcap 4.1.3 works on build 10130.

Update May 13, 2015: WinPcap 4.1.3 began to work again in Windows 10 preview 10061 and continues to operate in 10074. Hopefully, this trend continues - but I wouldn't count on it. But we still need to encourage Riverbed to update WinPcap from NDIS5 to NDIS6. Work has been done on this at NMAP and has been shared, so it would be great if WinPcap.org could expand on that work and release WinPcap fully compatible with NDIS6. Another issue is driver signing: in Windows 10 x64 that really will be changing, so it will be important for WinPcap to be updated before the RTM release - more about this here.

Update 3-27-15: Do you want to use Wireshark on Windows 10? Tweet about this problem! do a post about this issue. Bring it up at Sharkfest in June.

Update 3-26-15: This has been confirmed by others and a thread has been started here:
http://www.winpcap.org/pipermail/winpcap-users/2015-March/004935.html
I will be posting about it on twitter: https://twitter.com/NetScanTools

Up until release 10041 all Windows 10 Tech Preview versions have appeared to run WinPcap 4.1.3 without a problem. Even the last version 9926 worked OK, but now we have a problem - a big problem.

About the test machine: Shuttle xpc, quad core cpu, 8GB RAM. Host OS is Windows 7 x64. Windows 10 x64 Enterprise 10041 is a guest OS running inside VirtualBox 4.3.26 r98988. Network Adapter in the VM is in Bridged mode. Physical network adapter in the Shuttle is Generic Marvell Yukon 88E8056 based Ethernet controller.

Here's what I did...and what happened...
On March 23 I upgraded 9926 to 10041 and then installed Wireshark x64 v1.12.4 from wireshark.org. Everything installed fine and WinPcap installed normally. I fired up Wireshark and got the message "No interface can be used for capturing in this system with the current configuration.". Pressing the Refresh Interfaces button did not fix it.

I know that Wireshark checks the status of the NPF driver before getting that far, so I thought maybe I should verify it manually in a Command Prompt. You can see that the Service Control Manager says it is RUNNING.

NetScanTools Pro. Since I wrote it, I know what checks are done where. I know that it loads wpcap.dll and packet.dll and checks the status of the NPF driver. So far so good. I go to the ARP Scanner (it uses WinPcap to send and receive packets) and pressed Do ARP Scan. I got this message. The arrow is pointing to a message that comes directly from WinPcap itself: "No interfaces found! Make sure libpcap/WinPcap is properly installed on the local machine."

I know exactly which function call returned that message: pcap_findalldevs_ex

pcap_findalldevs_ex is what you call to find all the WinPcap compatible interfaces on the system. If it fails, you're done. I poked through the Wireshark code and they are calling it too most likely on start.

Where do we go from here?
Obviously Microsoft changed something. Did they change NDIS? Or something else?

I've tried all the obvious things - changing compatibility mode, running the programs as administrator - nothing works. A driver expert (which I am not) needs to dive into the WinPcap code and figure this out - and soon!

If nothing is done Wireshark, nmap, NetScanTools Pro and any other apps depending on WinPcap for capturing and sending packets will not operate on Windows 10 if the changes Microsoft made are permanent.

What is your experience? has anyone else tried Wireshark on Windows 10 Enterprise 10041? Win10 has always worked on VirtualBox - has anyone tried Wireshark on Win10 in VMware or native boot?

Solving Serious WinPcap Installation Problems

This post will address some serious WinPcap problems our customers have seen on Windows 8.1. While they are not necessarily unique to that version of Windows, these problems may also occur on other Windows versions as well.

Applicability: This discussion is limited to the current WinPcap 4.1.3 release and is intended for users of Windows 7, 8, 8.1.

Related Blog Post:
WinPcap Installation, Status and other Tips

Common Symptoms:

• WinPcap 4.1.3 official installer hangs at 'extract: Packet.dll' or similar.
• Wireshark gives this message on startup "The NPF driver isn't running. You may have trouble capturing or listing interfaces."
• NetScanTools Pro gives a message that WinPcap is not found or if it is found NetScanTools Pro locks up when you run a tool that uses WinPcap.
• Windows locks up when you run software that uses WinPcap forcing you to do a power cycle reboot.

Where to start:
The first thing to do is find out if any or all of the three major components are installed and their versions.

1. Using File Explorer, find out if this file exists: c:\Windows\system32\drivers\npf.sys. If so, right click on it and make note of the version number. Version 4.1.3 shows up as 4.1.0.2980 (don't ask me why).

2. Search your hard drives (especially drives where programs are installed) for both wpcap.dll and packet.dll.

Right click on EVERY DLL found, do Properties/Details and verify that you see 4.1.0.2980 (4.1.3).

These are the only acceptable locations for 'public' WinPcap DLLs on a 64 bit Windows system:
c:\windows\system32\wpcap.dll (64 bit version of DLL)
c:\windows\SysWOW64\wpcap.dll (32 bit version of DLL)
c:\windows\system32\packet.dll (64 bit version of DLL)
c:\windows\SysWOW64\packet.dll (32 bit version of DLL)

These are the only acceptable locations for 'public' WinPcap DLLs on a 32 bit Windows system:
c:\windows\system32\wpcap.dll (32 bit version of DLL)
c:\windows\system32\packet.dll (32 bit version of DLL)

Did you find any other instances of wpcap.dll and/or packet.dll on your system? if so, that's huge red flag. One of our end-users running Windows 8.1 64 bit experienced all of the Common Symptoms above and he found WinPcap version 4.1.2.1742 which is actually WinPcap Pro AKA WinPcap OEM in a Netgear ReadyNAS Remote program directory.

Here's why it could be a problem: 4.1.2.1742 is WinPcap Pro. When a program loads the WinPcap Pro wpcap.dll and packet.dll, it creates a version of the winpcap driver 'on-the-fly' in system32/drivers and runs it. WinPcap Pro was intended for use on systems where WinPcap is not installed, so at least on Windows 8.1 with ReadyNAS Remote, there is apparently interference between the two types of WinPcap. (other special WinPcap Pro/OEM versions you might find: 4.1.2.2001, 4.1.2.1879, 4.0.2.1340, 4.0.2.1252, 4.0.2.1123, 4.0.2.1040, 4.0.2.901, 4.0.2.755) WinPcap Pro was discontinued by Riverbed before Windows 8 was released.

Our end-user tried to stop WinPcap with 'sc stop npf' and got 'stop-pending' status which meant it was in use. Then if he rebooted and did a 'sc queryex npf', it said npf was stopped, however, if he did 'sc start npf' it said an instance of npf is already running. Very confusing and definitely not what you would expect to see.

Solution that worked for the end-user:
The end-user stopped the ReadyNASRemote.exe process in Task Manager, then renamed ReadyNASRemote.exe to something else, then rebooted. That worked because the program could not start at boot time and therefore did not load it's special WinPcap Pro.

Next, we had to find out where ReadyNASRemote was being started from at boot time. It was not in the registry HKLM or Windows Task Scheduler. It was being launched using a shortcut under c:\ProgramData\Microsoft\Windows\start menu\programs\startup.

Once it was stopped the end-user could remove the official 'public' DLLs from the locations in Step 2 above and force a reinstall of WinPcap 4.1.3 public edition without a problem. We do not know which exact version of ReadyNASRemote this user had installed - he determined that he did not use it, so he uninstalled it before I found out.

Generalized Procedure assuming wpcap.dll and packet.dll are found elsewhere:

1. Find any WinPcap DLLs that are not in their normal places and figure out which executable is using them (check Task Manager for those exes in the same directory as the WinPcap DLLs).
2. Stop the offending executable process from Task Manager and rename the exe to something else (or find out where it is being started from and disable the starting process).
3. Reboot.
4. Remove the official WinPcap DLLs from system32 and SysWOW64 (carefully! do not remove the npf.sys) no matter what version they are.
5. Reinstall the official WinPcap version from winpcap.org
6. Verify WinPcap is running using administrative Command Prompt 'sc queryex npf'.
7. Start Wireshark or NetScanTools Pro and confirm normal operation. (If Wireshark hangs at configuration 100%, review topic 5 here.)
8. Now you have to decide if you really want to keep the offending program that was using it's own private WinPcap - that's up to you.

The next blog post will deal with the situation where you did NOT find any other out-of-place instances of wpcap.dll and packet.dll.

WinPcap Installation, Status and other Tips

WinPcap is an essential packet capturing driver for many programs, especially Wireshark and also our own NetScanTools Pro. I have been working with a few of our customers who have had problems getting it installed and properly running on Windows 8.1. What I've done here is gather together a few important tips that you can use to make sure it is running.

This post is current as of WinPcap 4.1.3 and is written from the perspective of Windows 7, 8.1 and 10.

1. How do you tell if WinPcap is installed?

Quick check: WinPcap will show up in Control Panel/Programs and Features. This is not a guarantee that it is properly installed or running.

Detailed check: WinPcap has three main components. Here is where to find them on a 64 bit Windows operating system:

1. c:\windows\system32\drivers\npf.sys (this is the actual kernel mode driver)
2. c:\windows\system32\packet.dll (64 bit version of DLL) and c:\windows\SysWOW64\packet.dll (32 bit version of DLL)
3. c:\windows\system32\wpcap.dll (64 bit version of DLL) and c:\windows\SysWOW64\wpcap.dll (32 bit version of DLL)

All DLLs and the driver should be showing version 4.1.0.2980 which is really 4.1.3 (go figure).

2.  How do you tell if WinPcap is running?

The WinPcap driver does not show up in the list of services accessible through Control Panel/Administrative Tools/Services - but you can find out another way.

Start up a Command Prompt using Run as administrator and enter the following command that shows the driver configuration:

C:\WINDOWS\system32>sc qc npf

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: npf

        TYPE               : 1  KERNEL_DRIVER

        START_TYPE         : 2   AUTO_START

        ERROR_CONTROL      : 1   NORMAL

        BINARY_PATH_NAME   : system32\drivers\npf.sys

        LOAD_ORDER_GROUP   :

        TAG                : 0

        DISPLAY_NAME       : NetGroup Packet Filter Driver

        DEPENDENCIES       :

        SERVICE_START_NAME :

Make a note of the START_TYPE, we will discuss that later.

This command shows the actual WinPcap driver state, whether running or stopped:

C:\WINDOWS\system32>sc query npf
SERVICE_NAME: npf

        TYPE               : 1  KERNEL_DRIVER

        STATE              : 4  RUNNING

                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)

        WIN32_EXIT_CODE    : 0  (0x0)

        SERVICE_EXIT_CODE  : 0  (0x0)

        CHECKPOINT         : 0x0

        WAIT_HINT          : 0x0

3. How do you start WinPcap?

From an administrator Command Prompt, enter this and look at the STATE to make sure it is running:

C:\WINDOWS\system32>sc start npf
SERVICE_NAME: npf

        TYPE               : 1  KERNEL_DRIVER

        STATE              : 4  RUNNING

                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)

        WIN32_EXIT_CODE    : 0  (0x0)

        SERVICE_EXIT_CODE  : 0  (0x0)

        CHECKPOINT         : 0x0

        WAIT_HINT          : 0x0

        PID                : 0

        FLAGS              :

4. How do you stop WinPcap?

From an administrator Command Prompt, enter this and look at the STATE to make sure it is stopped. If it does not stop, you need to exit any programs using it.

C:\WINDOWS\system32>sc stop npf
SERVICE_NAME: npf

        TYPE               : 1  KERNEL_DRIVER

        STATE              : 1  STOPPED

        WIN32_EXIT_CODE    : 0  (0x0)

        SERVICE_EXIT_CODE  : 0  (0x0)

        CHECKPOINT         : 0x0

        WAIT_HINT          : 0x0

5. Some people have trouble starting Wireshark, it starts to load OK but stops at Configuration 100%. What can be done?

Remember the START_TYPE entry from number 2 above? It needs to change. From an administrator Command Prompt, enter this command then reboot your system, then try Wireshark again. The space after start= is required.

C:\WINDOWS\system32>sc config npf start= delayed-auto

[SC] ChangeServiceConfig SUCCESS

6. How can I tell which program is currently using WinPcap?

That can be a little difficult, but if a program is actively using WinPcap there is a way to find out by using Sysinternal's Process Explorer.

1. Download Process Explorer and run it from here: https://technet.microsoft.com/en-us/sysinternals/bb896653
2. Make sure npf is running.
3. In Process Explorer, click on Find menu/Find Handle or DLL
4. Enter wpcap or packet and press Search. If NetScanTools Pro is running, it shows nstpro.exe, PID, DLL and C:\Windows\SysWOW64\wpcap.dll - in other words, if a program is actively using WinPcap, it will show up there.

I hope these WinPcap tips help you, please let me know if you have any others to share.

Kirk

NetScanTools LE v1.52 Released on March 6, 2015

The latest release of NetScanTools LE (designed for Law Enforcement) was ready on March 6, 2015.

Version 1.52 makes operational changes to Port Scanner/Scan Common Ports to scan only the current protocol type selected, ie. TCP, UDP or TCP+UDP. Previous versions scanned using the whole list, TCP+UDP regardless of the selection.

Whois has improved support for IPv6 and the ability to get whois information for the new top level domains was greatly expanded.

We tested it on Windows 10 Enterprise version. Everything operated normally as far as we could see.

WinPcap: only one part of NetScanTools LE uses WinPcap - the Packet Capture Tool. Due to recent issues customers have had with WinPcap on Windows 8.1, we decided to add in a test to make sure WinPcap is installed and running. If npf.sys is not running you will not be able to launch the Packet Capture Tool.

We updated SQLite to v3.8.8.3 and also updated the database files.

Please visit http://www.netscantools-le.com/ to get the latest version. You may install it over previous versions.

How to start NetScanTools Pro USB version 11

We are changing our recommendations for starting NetScanTools Pro v11 USB version. These recommendations apply to Windows Vista, 7 and 8.x.

First recommendation:
Located in the root directory above /nstpro is a file called nstprolaunch.exe. We no longer recommend using it to start NetScanTools Pro - do not use it because the privileges you launch it with may not be correctly passed along to NetScanTools Pro.

There are two recommended ways to start NetScanTools Pro v11.x:

1. If you have WinPcap 4.1.3 (or newer) installed on your host computer, please locate and double click on nstpro.exe which is in the /nstpro directory on the USB drive.

2. If WinPcap 4.x is NOT installed on the host computer, please locate and right click on nstpro.exe, then select 'Run as administrator'. nstpro.exe is located in the /nstpro directory on the USB drive. This will use an older version 4.1.2 of WinPcap Pro located on the USB drive. We recommend going to winpcap.org and installing 4.1.3.

Discussion: if you use nstprolaunch.exe, you may see error messages that say "Error: unable to locate a supported network interface. WinPcap may not be operating... PacketGetAdapterNames: Incorrect function. (1)"

We are moving toward requiring installation of WinPcap 4.1.3 on hosts that you intend to use NetScanTools Pro USB Version just like Wireshark requires WinPcap to be installed.

Important NetScanTools Pro v11.53 Release

NetScanTools Pro v11.53 (installed) was released on November 1, 2013. This is a very important release because of the type of fixes that are in it. These fixes affect any of the tools that use WinPcap for capturing or sending packets. The WinPcap fixes are important if you use NetScanTools Pro on a machine where the network interface does not support promiscuous mode (normally WiFi 802.11) or you have more than one network interface on the machine.

If your network interface does not support promiscuous mode, all versions prior to 11.53 will not be able to open the interface resulting in a message similar to this one: "Error: Cannot open interface for packet sending. Please exit and restart NetScanTools Pro".

This means you cannot fully utilize tools that depend on WinPcap - for example the WinPcap ICMP mode of Traceroute will not work. The change in 11.53 allows the interface to be automatically opened in non-promiscuous mode if the open in promiscuous mode fails. If an adapter can be opened in promiscuous mode, all packets passing by it are passed along to the host system, however, if it is opened in 'normal' mode, then only packets intended for the system are passed to the host system. This mostly affects WiFi adapters so now you may find that NetScanTools Pro works much better with your WiFi network interface. Error message reporting has been significantly improved at the same time.

If you have more than one network interface on the system running NetScanTools Pro, all versions prior to 11.53 will only be able to send packets to the local network associated with the secondary interface. In other words if a packet sent out the secondary interface is intended for a destination beyond the default gateway, it will not get there because the default gateway mac address was not being obtained correctly. It now is obtained correctly so packets will go out the secondary interface default gateway as intended.

The WinPcap related changes affected ARP Ping, ARP Scan, Duplicate IP Address Scanner, OS Fingerprinting, Packet Capture Playback, Packet Generator, Ping, Port Scanner, Promiscuous Mode Scanner, Traceroute, Connection Monitor, Packet Capture, Passive Discovery, SNMP Dictionary Attack and SNMP Scanner.

Other changes include:

1. The improvement of administrator privileges detection which affects TimeSync - doing a clock synchronization and DNS Tools Core Edit Hosts File. Some portions of Network Connection Endpoints are also affected.
2. Addition of a column showing the DHCP Server MAC Address to the DHCP Server Discovery Tool.
3. Packet Capture Playback now supports sending .pcap files in addition to .cap files.
4. Ping Enhance/TCP Ping now correctly send the number of packets you designate.
5. SQLite was updated to 3.8.1 and the database files were updated.

Version 11.53 is available to all those will active maintenance plans. Click on Help/Check for New Version to obtain it.

Opening a WinPcap Compatible Network Interface

Sometimes a network interface is WinPcap compatible meaning it can be opened with WinPcap, but opening it with the methods found in the example code for developers can fail. The examples usually show opening the interface using the PCAP_OPENFLAG_PROMISCUOUS. While that normally works fine for wired interfaces, wireless interfaces (WiFi 802.11) may not open - in fact according to a Winpcap-users post from 2008 regarding v4, "most of the wireless cards do not support promiscuous mode. The call to pcap_open with PCAP_OPENFLAG_PROMISCUOUS should fail" - see http://www.winpcap.org/pipermail/winpcap-users/2008-June/002532.html

Here is typical code from the examples:

pcap_t *hDev = pcap_open(deviceName, 65536, PCAP_OPENFLAG_PROMISCUOUS, 1000, NULL, errMsg1);

If it fails to open because the interface cannot support promiscuous mode, hDev is NULL and errMsg1 will contain a string like this: "failed to set hardware filter to promiscuous mode".

A good way of dealing with this is to first try opening the interface, then if hDev is NULL try opening it without the flag:

hDev = pcap_open(deviceName, 65536, 0, 1000, NULL, errMsg2);

Then if hDev is still NULL, report both errMsg1 and errMsg2 to the user. If they both fail you will need to avoid doing any further winpcap function calls except to do pcap_freealldevs because you most likely uses pcap_findalldevs_ex before trying to open an interface and it allocates the device list from which deviceName was found.

Why is opening an interface in promiscuous mode important? When a network interface card (NIC) is opened in promiscuous mode, all packets seen by the interface are captured and passed to the host system, while an interface opened normally only captures packets strictly intended for it alone. So if you are running a utility like NetScanTools Pro Packet Capture or Wireshark, you will most likely want to be running in promiscuous mode so you can see all the packets passing by the interface.

Applicability:
WinPcap v4.1.3 is the most current version as of this discussion. Please visit http://www.winpcap.org/

WinPcap 4.1.3 for Windows 8

As you may already be aware, the folks at winpcap.org finally did an upgrade to the WinPcap driver. Version 4.1.3 supports Windows 8 - in other words the installer will not balk at Win 8 like the 4.1.2. installer did. And they did a couple of minor bug fixes in the process.

So if you have Wireshark or NetScanTools Pro and want to use them on Windows 8, please visit http://www.winpcap.org/ to get 4.1.3.

How to install NetScanTools Pro or WinPcap on Windows 8

WinPcap is the packet capture driver used in both NetScanTools Pro and LE. If you try to run the NetScanTools installer, everything appears to install OK until you get to the WinPcap 4.1.2 installer that we launch separately. The WinPcap installer refuses to run and shows an error about an unsupported operating system.
The solution is to run the installer in compability mode. Here's how:
1. from within Windows 8 (32 or 64 bit) get to the desktop and launch Windows Explorer.

2. locate your installer file, example: nst*.exe or WinPcap_4_1_2.exe (get WinPcap here) and right click on it to bring up the popup menu.

3. select "Troubleshoot compatibility" and wait a few seconds for it to do it's thing. Then click on "Try recommended settings". It will most likely show Windows Compatibility Mode of Windows XP (service pack 3).

4. Click on "Test the program..." the installer will start - follow the installer directions as you normally would. When you get to actually running the WinPcap installer you may see a message "This program has compatibility issues" - select "Run the program without getting help". WinPcap should now install.

5. When it's all done, click on Cancel instead of Next back on the Program Compatibility Troubleshooter window.

The problem is not NetScanTools Pro/LE. Those installers both launch the WinPcap installer. It is the WinPcap installer that needs to be updated.

The good part is WinPcap works fine on Windows 8 once it is installed.

Update Nov 17, 2012: winpcap.org still shows version 4.1.2. We still are waiting on an updated WinPcap installer.

How to install Wireshark on Windows 8

The title of this could also be "How to install WinPcap on Windows 8" or "How to install NetScanTools Pro on Windows 8". WinPcap is the packet capture driver used in both Wireshark and NetScanTools Pro (and LE). If you try to run the Wireshark installer, everything appears to install OK until you get to the WinPcap installer that it launches separately. The WinPcap installer refuses to run and shows an error about an unsupported operating system.

The solution is to run your installer in compability mode. Here's how:

1. from within Windows 8 (32 or 64 bit) get to the desktop and launch Windows Explorer.

2. locate your installer file, example: wireshark-win32-1.6.2.exe and right click on it to bring up the menu.

3. select "Troubleshoot compatibility" and wait a few seconds for it to do it's thing. Then click on "Try recommended settings". It will most likely show Windows Compatibility Mode of Windows XP (service pack 3).

4. Click on "Test the program..." the installer will start - follow the installer directions as you normally would. When you get to actually running the WinPcap installer you may see a message "This program has compatibility issues" - select "Run the program without getting help". WinPcap should now install.

5. When it's all done, click on Cancel instead of Next back on the Program Compatibility Troubleshooter window.

The problem is not Wireshark or NetScanTools Pro. Those installers both launch the WinPcap installer. It is the WinPcap installer that needs to be updated.

The good part about this is that now Wireshark now properly captures packets and NetScanTools Pro can both send and receive packets using WinPcap.

Update Oct 10, 2012: winpcap.org still shows version 4.1.2. With the public release of Windows 8 only a couple weeks away, we still are waiting on an updated WinPcap installer.

First Impressions of Windows 8

My first impressions of Windows 8 Consumer Preview can be summarized in two words: Radical Change.

Why do I say that? because this version of Windows clearly departs from earlier versions. Previous versions always provided backwards compatibility and using it was always obvious to the casual Windows user.

Windows 8 does things like force you to have an active Windows Live/Hotmail account. If that is really true, I know lots of off-the-internet secure labs that won't be happy. After you get past that, you are shown the Metro touchpad interface. While that may be all well and good if you are using a tablet or phone, that doesn't fly for a desktop installation (I put both the 32 and 64 bit versions into VirtualBox VMs). My son says that this looks exactly like the XBox interface.

So playing around with the touchpad interface with a mouse is kind of slow. The icons are huge and anything you install gets put on the right side of the default icons/pads. The two games they installed appear to rely on an internet connection (wonder how that will go over for dialup users - they still exist) and the pinball game was so slow I never even got it to fully load. This is on an 4 core, 8G ram machine...it might be faster natively installed instead of being in VirtualBox.

Going to the desktop that most Windows users are familiar with was pretty easy - there is an icon for that. But wait - the only thing on the desktop is the Recycle Bin and the taskbar only has IE and the Windows Explorer file manager. Where are things like Notepad? calculator? accessories? dare I say COMMAND PROMPT? If I search c:\windows I find the exe's but the casual home user isn't going to find them...trust me on that...I've talked to some home users that didn't know what a file was...

OK - so now I wanted to go back the Metro interface. After a long time I accidentally found that the funny looking Windows button (between ctrl and alt buttons) switches you between the desktop and metro. I never use that button - do you?

I wanted to run regedit just for kicks...guess what, no intuitive way to do that either, so I tried that win button with R. Up popped the run window. So I can do some things....grrrrrrrr

Now to the meat of things. I was able to install NetScanTools Pro/LE/basic on it, but the WinPcap driver install won't let me install. Same goes for Wireshark. The installer works, but WinPcap installer won't work - an unsupported version of Windows. Some people at Riverbed need to get to work on fixing that one soon!

Maybe I'm missing some things, but this version of windows appears to leave desktop and laptop users out in the cold.

Got any hints for me you are willing to share?

More on this topic soon...

Kirk

Free AirPcap Adapters at Sharkfest

Although I haven't decided whether I will be able to attend, I wanted to let you know about Sharkfest. Sharkfest is all about WireShark(r) and it is put on by people who make WinPcap. We use WinPcap in NetScanTools Pro. WinPcap is a packet driver (http://www.wireshark.org/). Wireshark uses it to capture packets and we use it to both capture and generate packets. Wireshark is the best free network packet analysis tool I know of. The packet capture files that NetScanTools Pro saves can be opened by Wireshark for in-depth analysis.

Here are the details about the conference:

Wireshark(r) Developer and User Conference
June 15 - 18, 2009
Stanford University Palo Alto, California

SHARKFEST is an educational event that offers in-depth instruction over the course of 3 days to the benefit of anyone wishing to enhance their skill set with, and optimize the effective use of, the world's most popular network and packet analyzer, Wireshark.

Space is limited and due to a full house last year, early registration is strongly encouraged. Single registration for all 3 days is $695.00 USD. Details including conference hotels, group discounts and the conferenceschedule can be found at http://www.cacetech.com/sharkfest.09/. Every paid registration will receive a FREE AirPcap Classic Adapter (SRP $198USD) and so much more!