Win10Pcap - a WinPcap fork

Today Gerald Combs graciously forwarded me an announcement about a new fork to WinPcap called Win10Pcap based on NDIS 6. I immediately tested it with Wireshark and NetScanTools Pro.

Since this fork uses a different kernel mode driver name - ie, NOT npf.sys, Wireshark shows the popup message "The NPF driver isn't running. You may have trouble capturing or listing interfaces.". However, even though this message shows Wireshark will run because Wireshark loads packet.dll and wpcap.dll - these two DLL interfaces are unchanged (the WinPcap SDK interface is supposedly unchanged) so no matter what the driver is called, it starts. So, yes, Wireshark 1.12.5 appears to run with this fork of WinPcap.

That brings me to NetScanTools Pro. Not only does NetScanTools Pro capture packets (like Wireshark), it also sends packets. I tested the ARP, Ping and Traceroute tools that depend on WinPcap for sending packets. They appeared to work OK.

I was just about to release NetScanTools Pro 11.70, so I was able to make my test for active running npf.sys also test for the new service name - so that means NetScanTools Pro will be able to detect either the official WinPcap 4.1.3 and successors or this new fork.

Note that old WinPcap 4.1.3 DOES WORK FINE on later releases of Windows 10 builds based on NDIS 5. So it's your choice as to whether you need to use this new fork.

You may download this new WinPcap fork from http://www.Win10Pcap.org/ however, since they use GPLv2 instead of BSD license as WinPcap has historically done, we will not be including the installer with NetScanTools Pro.

Congrats to the author of Win10Pcap! (but what happens to the name when Win 11 is released?)

Updated: Wireshark and WinPcap 4.1.3 on Windows 10 Enterprise Build 10061

This release of Windows 10 Enterprise Technical Preview Build 10061 seems to run the 'old' WinPcap just fine. Whatever was broken in 10041 was fixed - I wonder: was NDIS backwards compatibility restored? I don't know, but it works. At least for now. With the rumored final Windows 10 release coming in July 2015, things had better start to get finalized soon. That means networking too.

So for now, Windows 10 build 10061, seems to capture packets fine with Wireshark 1.12.4 and old 4.1.3 WinPcap release. WinPcap also sends customized packets correctly from NetScanTools Pro v11. We'll see what the next build does.

Update June 5, 2015: WinPcap 4.1.3 also runs on build 10130.

Kirk

Updated: WinPcap and Wireshark problems on Windows 10 Tech Preview 10041

Update June 5, 2015: WinPcap 4.1.3 works on build 10130.

Update May 13, 2015: WinPcap 4.1.3 began to work again in Windows 10 preview 10061 and continues to operate in 10074. Hopefully, this trend continues - but I wouldn't count on it. But we still need to encourage Riverbed to update WinPcap from NDIS5 to NDIS6. Work has been done on this at NMAP and has been shared, so it would be great if WinPcap.org could expand on that work and release WinPcap fully compatible with NDIS6. Another issue is driver signing: in Windows 10 x64 that really will be changing, so it will be important for WinPcap to be updated before the RTM release - more about this here.

Update 3-27-15: Do you want to use Wireshark on Windows 10? Tweet about this problem! do a post about this issue. Bring it up at Sharkfest in June.

Update 3-26-15: This has been confirmed by others and a thread has been started here:
http://www.winpcap.org/pipermail/winpcap-users/2015-March/004935.html
I will be posting about it on twitter: https://twitter.com/NetScanTools

Up until release 10041 all Windows 10 Tech Preview versions have appeared to run WinPcap 4.1.3 without a problem. Even the last version 9926 worked OK, but now we have a problem - a big problem.

About the test machine: Shuttle xpc, quad core cpu, 8GB RAM. Host OS is Windows 7 x64. Windows 10 x64 Enterprise 10041 is a guest OS running inside VirtualBox 4.3.26 r98988. Network Adapter in the VM is in Bridged mode. Physical network adapter in the Shuttle is Generic Marvell Yukon 88E8056 based Ethernet controller.

Here's what I did...and what happened...
On March 23 I upgraded 9926 to 10041 and then installed Wireshark x64 v1.12.4 from wireshark.org. Everything installed fine and WinPcap installed normally. I fired up Wireshark and got the message "No interface can be used for capturing in this system with the current configuration.". Pressing the Refresh Interfaces button did not fix it.

I know that Wireshark checks the status of the NPF driver before getting that far, so I thought maybe I should verify it manually in a Command Prompt. You can see that the Service Control Manager says it is RUNNING.

NetScanTools Pro. Since I wrote it, I know what checks are done where. I know that it loads wpcap.dll and packet.dll and checks the status of the NPF driver. So far so good. I go to the ARP Scanner (it uses WinPcap to send and receive packets) and pressed Do ARP Scan. I got this message. The arrow is pointing to a message that comes directly from WinPcap itself: "No interfaces found! Make sure libpcap/WinPcap is properly installed on the local machine."

I know exactly which function call returned that message: pcap_findalldevs_ex

pcap_findalldevs_ex is what you call to find all the WinPcap compatible interfaces on the system. If it fails, you're done. I poked through the Wireshark code and they are calling it too most likely on start.

Where do we go from here?
Obviously Microsoft changed something. Did they change NDIS? Or something else?

I've tried all the obvious things - changing compatibility mode, running the programs as administrator - nothing works. A driver expert (which I am not) needs to dive into the WinPcap code and figure this out - and soon!

If nothing is done Wireshark, nmap, NetScanTools Pro and any other apps depending on WinPcap for capturing and sending packets will not operate on Windows 10 if the changes Microsoft made are permanent.

What is your experience? has anyone else tried Wireshark on Windows 10 Enterprise 10041? Win10 has always worked on VirtualBox - has anyone tried Wireshark on Win10 in VMware or native boot?

Solving Serious WinPcap Installation Problems

This post will address some serious WinPcap problems our customers have seen on Windows 8.1. While they are not necessarily unique to that version of Windows, these problems may also occur on other Windows versions as well.

Applicability: This discussion is limited to the current WinPcap 4.1.3 release and is intended for users of Windows 7, 8, 8.1.

Related Blog Post:
WinPcap Installation, Status and other Tips

Common Symptoms:

• WinPcap 4.1.3 official installer hangs at 'extract: Packet.dll' or similar.
• Wireshark gives this message on startup "The NPF driver isn't running. You may have trouble capturing or listing interfaces."
• NetScanTools Pro gives a message that WinPcap is not found or if it is found NetScanTools Pro locks up when you run a tool that uses WinPcap.
• Windows locks up when you run software that uses WinPcap forcing you to do a power cycle reboot.

Where to start:
The first thing to do is find out if any or all of the three major components are installed and their versions.

1. Using File Explorer, find out if this file exists: c:\Windows\system32\drivers\npf.sys. If so, right click on it and make note of the version number. Version 4.1.3 shows up as 4.1.0.2980 (don't ask me why).

2. Search your hard drives (especially drives where programs are installed) for both wpcap.dll and packet.dll.

Right click on EVERY DLL found, do Properties/Details and verify that you see 4.1.0.2980 (4.1.3).

These are the only acceptable locations for 'public' WinPcap DLLs on a 64 bit Windows system:
c:\windows\system32\wpcap.dll (64 bit version of DLL)
c:\windows\SysWOW64\wpcap.dll (32 bit version of DLL)
c:\windows\system32\packet.dll (64 bit version of DLL)
c:\windows\SysWOW64\packet.dll (32 bit version of DLL)

These are the only acceptable locations for 'public' WinPcap DLLs on a 32 bit Windows system:
c:\windows\system32\wpcap.dll (32 bit version of DLL)
c:\windows\system32\packet.dll (32 bit version of DLL)

Did you find any other instances of wpcap.dll and/or packet.dll on your system? if so, that's huge red flag. One of our end-users running Windows 8.1 64 bit experienced all of the Common Symptoms above and he found WinPcap version 4.1.2.1742 which is actually WinPcap Pro AKA WinPcap OEM in a Netgear ReadyNAS Remote program directory.

Here's why it could be a problem: 4.1.2.1742 is WinPcap Pro. When a program loads the WinPcap Pro wpcap.dll and packet.dll, it creates a version of the winpcap driver 'on-the-fly' in system32/drivers and runs it. WinPcap Pro was intended for use on systems where WinPcap is not installed, so at least on Windows 8.1 with ReadyNAS Remote, there is apparently interference between the two types of WinPcap. (other special WinPcap Pro/OEM versions you might find: 4.1.2.2001, 4.1.2.1879, 4.0.2.1340, 4.0.2.1252, 4.0.2.1123, 4.0.2.1040, 4.0.2.901, 4.0.2.755) WinPcap Pro was discontinued by Riverbed before Windows 8 was released.

Our end-user tried to stop WinPcap with 'sc stop npf' and got 'stop-pending' status which meant it was in use. Then if he rebooted and did a 'sc queryex npf', it said npf was stopped, however, if he did 'sc start npf' it said an instance of npf is already running. Very confusing and definitely not what you would expect to see.

Solution that worked for the end-user:
The end-user stopped the ReadyNASRemote.exe process in Task Manager, then renamed ReadyNASRemote.exe to something else, then rebooted. That worked because the program could not start at boot time and therefore did not load it's special WinPcap Pro.

Next, we had to find out where ReadyNASRemote was being started from at boot time. It was not in the registry HKLM or Windows Task Scheduler. It was being launched using a shortcut under c:\ProgramData\Microsoft\Windows\start menu\programs\startup.

Once it was stopped the end-user could remove the official 'public' DLLs from the locations in Step 2 above and force a reinstall of WinPcap 4.1.3 public edition without a problem. We do not know which exact version of ReadyNASRemote this user had installed - he determined that he did not use it, so he uninstalled it before I found out.

Generalized Procedure assuming wpcap.dll and packet.dll are found elsewhere:

1. Find any WinPcap DLLs that are not in their normal places and figure out which executable is using them (check Task Manager for those exes in the same directory as the WinPcap DLLs).
2. Stop the offending executable process from Task Manager and rename the exe to something else (or find out where it is being started from and disable the starting process).
3. Reboot.
4. Remove the official WinPcap DLLs from system32 and SysWOW64 (carefully! do not remove the npf.sys) no matter what version they are.
5. Reinstall the official WinPcap version from winpcap.org
6. Verify WinPcap is running using administrative Command Prompt 'sc queryex npf'.
7. Start Wireshark or NetScanTools Pro and confirm normal operation. (If Wireshark hangs at configuration 100%, review topic 5 here.)
8. Now you have to decide if you really want to keep the offending program that was using it's own private WinPcap - that's up to you.

The next blog post will deal with the situation where you did NOT find any other out-of-place instances of wpcap.dll and packet.dll.

WinPcap Installation, Status and other Tips

WinPcap is an essential packet capturing driver for many programs, especially Wireshark and also our own NetScanTools Pro. I have been working with a few of our customers who have had problems getting it installed and properly running on Windows 8.1. What I've done here is gather together a few important tips that you can use to make sure it is running.

This post is current as of WinPcap 4.1.3 and is written from the perspective of Windows 7, 8.1 and 10.

1. How do you tell if WinPcap is installed?

Quick check: WinPcap will show up in Control Panel/Programs and Features. This is not a guarantee that it is properly installed or running.

Detailed check: WinPcap has three main components. Here is where to find them on a 64 bit Windows operating system:

1. c:\windows\system32\drivers\npf.sys (this is the actual kernel mode driver)
2. c:\windows\system32\packet.dll (64 bit version of DLL) and c:\windows\SysWOW64\packet.dll (32 bit version of DLL)
3. c:\windows\system32\wpcap.dll (64 bit version of DLL) and c:\windows\SysWOW64\wpcap.dll (32 bit version of DLL)

All DLLs and the driver should be showing version 4.1.0.2980 which is really 4.1.3 (go figure).

2.  How do you tell if WinPcap is running?

The WinPcap driver does not show up in the list of services accessible through Control Panel/Administrative Tools/Services - but you can find out another way.

Start up a Command Prompt using Run as administrator and enter the following command that shows the driver configuration:

C:\WINDOWS\system32>sc qc npf

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: npf

        TYPE               : 1  KERNEL_DRIVER

        START_TYPE         : 2   AUTO_START

        ERROR_CONTROL      : 1   NORMAL

        BINARY_PATH_NAME   : system32\drivers\npf.sys

        LOAD_ORDER_GROUP   :

        TAG                : 0

        DISPLAY_NAME       : NetGroup Packet Filter Driver

        DEPENDENCIES       :

        SERVICE_START_NAME :

Make a note of the START_TYPE, we will discuss that later.

This command shows the actual WinPcap driver state, whether running or stopped:

C:\WINDOWS\system32>sc query npf
SERVICE_NAME: npf

        TYPE               : 1  KERNEL_DRIVER

        STATE              : 4  RUNNING

                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)

        WIN32_EXIT_CODE    : 0  (0x0)

        SERVICE_EXIT_CODE  : 0  (0x0)

        CHECKPOINT         : 0x0

        WAIT_HINT          : 0x0

3. How do you start WinPcap?

From an administrator Command Prompt, enter this and look at the STATE to make sure it is running:

C:\WINDOWS\system32>sc start npf
SERVICE_NAME: npf

        TYPE               : 1  KERNEL_DRIVER

        STATE              : 4  RUNNING

                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)

        WIN32_EXIT_CODE    : 0  (0x0)

        SERVICE_EXIT_CODE  : 0  (0x0)

        CHECKPOINT         : 0x0

        WAIT_HINT          : 0x0

        PID                : 0

        FLAGS              :

4. How do you stop WinPcap?

From an administrator Command Prompt, enter this and look at the STATE to make sure it is stopped. If it does not stop, you need to exit any programs using it.

C:\WINDOWS\system32>sc stop npf
SERVICE_NAME: npf

        TYPE               : 1  KERNEL_DRIVER

        STATE              : 1  STOPPED

        WIN32_EXIT_CODE    : 0  (0x0)

        SERVICE_EXIT_CODE  : 0  (0x0)

        CHECKPOINT         : 0x0

        WAIT_HINT          : 0x0

5. Some people have trouble starting Wireshark, it starts to load OK but stops at Configuration 100%. What can be done?

Remember the START_TYPE entry from number 2 above? It needs to change. From an administrator Command Prompt, enter this command then reboot your system, then try Wireshark again. The space after start= is required.

C:\WINDOWS\system32>sc config npf start= delayed-auto

[SC] ChangeServiceConfig SUCCESS

6. How can I tell which program is currently using WinPcap?

That can be a little difficult, but if a program is actively using WinPcap there is a way to find out by using Sysinternal's Process Explorer.

1. Download Process Explorer and run it from here: https://technet.microsoft.com/en-us/sysinternals/bb896653
2. Make sure npf is running.
3. In Process Explorer, click on Find menu/Find Handle or DLL
4. Enter wpcap or packet and press Search. If NetScanTools Pro is running, it shows nstpro.exe, PID, DLL and C:\Windows\SysWOW64\wpcap.dll - in other words, if a program is actively using WinPcap, it will show up there.

I hope these WinPcap tips help you, please let me know if you have any others to share.

Kirk

NetScanTools August 2013 Newsletter

The NetScanTools newsletter was published last week and primarily it talks about the website overhaul of http://www.nwpsw.com using Bootstrap. Bootstrap (http://getbootstrap.com/) is an interesting set of CSS and JavaScript templates that allow your site to be viewed equally well in a desktop, mobile or tablet screen format without any changes to your site pages. Gerald Combs (Wireshark) told me about it - he converted Wireshark.org to use it earlier this year.

http://www.netscantools.com/pressandnewsletters/NST_News_August_2013.pdf

Enjoy!
Kirk

How to install Wireshark on Windows 8

The title of this could also be "How to install WinPcap on Windows 8" or "How to install NetScanTools Pro on Windows 8". WinPcap is the packet capture driver used in both Wireshark and NetScanTools Pro (and LE). If you try to run the Wireshark installer, everything appears to install OK until you get to the WinPcap installer that it launches separately. The WinPcap installer refuses to run and shows an error about an unsupported operating system.

The solution is to run your installer in compability mode. Here's how:

1. from within Windows 8 (32 or 64 bit) get to the desktop and launch Windows Explorer.

2. locate your installer file, example: wireshark-win32-1.6.2.exe and right click on it to bring up the menu.

3. select "Troubleshoot compatibility" and wait a few seconds for it to do it's thing. Then click on "Try recommended settings". It will most likely show Windows Compatibility Mode of Windows XP (service pack 3).

4. Click on "Test the program..." the installer will start - follow the installer directions as you normally would. When you get to actually running the WinPcap installer you may see a message "This program has compatibility issues" - select "Run the program without getting help". WinPcap should now install.

5. When it's all done, click on Cancel instead of Next back on the Program Compatibility Troubleshooter window.

The problem is not Wireshark or NetScanTools Pro. Those installers both launch the WinPcap installer. It is the WinPcap installer that needs to be updated.

The good part about this is that now Wireshark now properly captures packets and NetScanTools Pro can both send and receive packets using WinPcap.

Update Oct 10, 2012: winpcap.org still shows version 4.1.2. With the public release of Windows 8 only a couple weeks away, we still are waiting on an updated WinPcap installer.

Installing Wireshark on a USB flash drive with NetScanTools Pro

You may or may not know it, but Wireshark (www.wireshark.org) also comes as a portable version that you can install on a USB flash drive. I did a tutorial video on how to install it on a USB flash drive. I also show how to link NetScanTools Pro 11 to Wireshark so that you can launch Wireshark from within NetScanTools Pro. Pretty cool. They can both live on the USB and be fully portable, no installation required.

It's on youtube and will be on the videos section of netscantools.com soon.

http://www.youtube.com/watch?v=ZAhnuZiOSR0

Kirk

IPv6 Teredo Problems and Solutions on Windows 7-64 bit

I came back from the Wireshark Sharkfest '11 Conference excited to try some of the things I had learned. Imagine my dismay when I fired up my Windows 7-64 test box only to find that certain parts of NetScanTools Pro 11 that are IPv6 aware ceased working. Immediately I was able to see that it was the parts of the program that depended on the getaddrinfo function call that were failing. How did I know that? I used the other 'home-grown' NetScanTools resolver functions to talk with DNS (they bypass Windows resolver entirely and talk directly to any DNS) and by using Wireshark I could see the AAAA records coming back from DNS. I could see that the getaddrinfo function was not getting and reporting the IPv6 AAAA records. Very strange.

So I looked at a couple of things. First I did a cursory check of the network settings with ipconfig. All appeared normal. Then I spent some time recompiling NetScanTools Pro while playing around with various options in the addrinfo hints structure passed into getaddrinfo. That was not fruitful. Nothing I did could make the getaddrinfo function return the AAAA record. I was seeing the 11004 WSANO_DATA error. So I put that aside and looked more carefully at the IPv6 networking subsystem.

Next I tried to see if it was NetScanTools failing or something deeper. So I tried using command line "ping -6 ipv6.google.com". This failed with a message effectively admitting that it couldn't resolve the hostname to an IPv6. Good - sort of. Next I tried the other way doing a "ping -6 2001:4860:b006::69". That came back with even more ominous wording "Ping transmit failed. General Failure.". But I could use both command line ping and NetScanTools Pro IPv6 Ping to contact Link-Local IPv6 addresses on my local network - as I should be able to do. The IPv6 routing table didn't yield any real clues either.

Using both NetScanTools Pro, ipconfig and various netsh command line things I was able to see that while isatap was active, I was not seeing teredo - I had seen it before when using command line ping and when using NetScanTools Pro. Teredo was what I wanted to try decoding with Wireshark. NetScanTools Pro showed me that Teredo was there but it had an admin status of 'Down'. So I tried various netsh commands to reactivate Teredo. They all appeared to work, but Teredo never reappeared in the list of hidden devices in Device Manager. I tried the solutions floating around on the internet for making sure IPv6 was active and getting Teredo to show up in Device Manager, but still no luck.

A little history might help. I had recently installed VMware Workstation 7.1.4 on that machine because it's a test machine and I needed lots of OS's available. Could it be that? I don't know for sure because I spent time on VMware forums looking for similar problems - but didn't see any. It could have been a Windows Update patch that turned off Teredo, but I just don't know for sure. The two VMware Virtual Ethernet Adapters both had link-local fe80 IPv6 addresses, so IPv6 wasn't entirely dead. AND of all things, I could start Windows Server 2008 in a virtual machine with all of it's IPv6 functions working perfectly including NetScanTools Pro. I did find this page dealing with firewall settings for Teredo and found that everything was OK: http://support.microsoft.com/kb/968510

So today I spent lots of time with the netsh commands. I used "netsh interface IP show config" to see all the interfaces similar to ipconfig. By doing a "netsh interface ipv6 show interface" I could see all the active connections. What was missing was Teredo. I used "netsh interface set interface teredo set state default" to make sure it was there and it answered OK. But still no Teredo. Then I found this interesting command "netsh interface IPv6 show teredo". It said the State was 'offline' and the Error value was "client is in a managed network". Progress. Big progress.

So I put that error string into google and found a reference to this blog: http://blogs.msdn.com/b/p2p/archive/2007/03/22/teredo-and-the-pnrp-global-cloud.aspx
Essentially Teredo detected (incorrectly) that the machine was in a corporate environment - this is probably due to multiple OS's and several switches being active with all their chatter. So the fix was to use "Netsh interface teredo set state enterpriseclient". Once I did that, there was no need for rebooting or anything. "netsh interface IPv6 show teredo" now showed the correct info like Local Mapping and External NAT Mapping. And all of a sudden both command line ping and NetScanTools Pro IPv6 enabled tools began to work again.

I guess the thing that bugs me is this: why is there this huge dependency on Teredo for IPv6 in Windows 7? If I ask for a name resolution using getaddrinfo with a hint of AF_INET6 I EXPECT a response if AAAA records are coming back from the default dhcp assigned system DNS. It shouldn't matter that IPv6 is fully enabled on the system using Teredo or anything else. So my workaround will be to write EXTRA CODE to resend an AAAA or PTR record request from my own private resolver on failure of getaddrinfo because I can't trust it. I hope someone at Microsoft reads this and helps me understand why it was behaving this way.

All I wanted to do was try to decode Teredo traffic with Wireshark...

Kirk Thomas
NetScanTools Developer and Sharkfest '11 attendee

Malformed UDP Packets

Malformed UDP Packets are easily generated with the new changes to the Packet Generator tool in NetScanTools Pro 10.96.1. Normally a UDP packet consists of an IP header followed by a UDP header followed by data. Usually all the parameters of those two headers are calculated at the time the packet is sent by the sockets layer, but with our Packet Generator tool we can create the packet from beginning to end including all parts of the headers.

This view from Wireshark shows a normal UDP packet:

You can see that the packet is complete and correct with all checksums and field lengths normal. The payload is only 4 bytes - it is the word 'test'.

Now look what happens if we put a value of 2 bytes into the UDP length field - remember that the UDP header itself is 8 bytes. The data payload is still the same 4 bytes. Wireshark's 'Expert Info' analyzer tells us that it is malformed and the length value is the culprit. The checksum is not analyzed and the data is not commented on.

See how Wireshark complains that the length value is less than the data and the UDP header? The message it gives is correct, the UDP length field must have a value of 8 or greater because that is the size of the UDP header itself. Can you send a UDP packet without any data? -sure, but it will also be tagged as malformed by Wireshark (exception error).

Next let's try setting the UDP header length field to something greater than the UDP header length + the data payload length. You can see that it notes that the length value (24) is greater than the payload (8 UDP header + 4 data = 12 bytes) and it does not complete the checksum calculation since all the data is not present.


A few words about what the Packet Generator tool can do. It can generate TCP, UDP, ICMP and CDP packets and send them out at a maximum repetition rate of roughly 10,000 packets per second - it is not a traffic generator capable of saturating your connection. It has a simple scripting language that allows you to send packets and even do some minor looping or use infinite looping. This is useful for connection test purposes. It uses WinPcap to generate packets, so it is pretty much limited to wired connections, not wireless connections. But even within these limits it really can show the response of applications or devices to malformed packets.

If you are interested in trying out the demo, you can do that by following this link. Please keep in mind that the demo will limit you to your local subnet but the full version does not have this limitation.

Laura Chappell's new Wireshark Network Analysis Book

Laura has done it again. She's written a huge book about Wireshark. When I develop NetScanTools Pro, I use Wireshark to be sure the packets I'm sending and receiving are correct. And NetScanTools Pro saves packet captures in a format that can be opened by Wireshark. I have only read the snippets of the book on the wiresharkbook website, but I can see that the quality is superb and it will be in depth!

You can pre-order the Wireshark Network Analysis book (www.wiresharkbook.com) at a 35% discount using this code:

998NST35 (this is not case sensitive)
Valid until March 29, 2010
Estimated ship date: March 29, 2010


Wireshark Network Analysis: The Official Wireshark Certified Network Analyst Study Guide
Paperback: 800 pages
Publisher: Protocol Analysis Institute
Website: www.wiresharkbook.com
Language: English
ISBN10: 1-893939-99-8
ISBN13: 978-1-893939-99-8
Dimensions: 7.44 x 9.69 inches
Weight: 3.5 pounds
Contact: info@chappellU.com or +1 408-378-7841
Exam Version: Version 1 (WCNA-100 Exam) (Q2 2010 Release)
Exam Link: www.wiresharkU.com/certification.html

SNMP Snooping, Adding MIBs and other stuff

Those of you who perhaps use Wireshark on a regular basis are aware that SNMP traffic randomly occurs on your network, particularly from printers. On October 7 Laura Chappell posted a short article called "SNMP Snooping". In the article Laura talks about using NetScanTools Pro to have a look at the SNMP information available from a wireless HP printer. She talks about pulling out reams of statistics including Wireless SSIDs and WLAN signal strength. This is all done by simply 'Walking' the .1.3.6.1 OID. Even more interesting are the printer's listening ports - also something reported by the NetScanTools Pro SNMP Tool (he is how: set the IP and community name, select Advanced Queries, press Perform Action, then press Listening Ports Report).

Laura will be talking about SNMP and NetScanTools Pro during her Summit '09 Conference in December. The article is here (at least until Weds, Oct 14):
http://www.chappellseminars.com/index.html

Laura also mentions that she had to add MIBs to the SNMP tool in order to understand the data from the printer. Without the printer MIBs translating the numbers to human readable information, the Walk results are just numbers or strings and don't really look too interesting. Today we added a new video explaining why you need to do this and how to add a MIB to NetScanTools Pro. This even works with the NetScanTools Pro Demo:
http://www.netscantools.com/videos/snmpaddamib/snmpaddamib.html

NetScanTools.com sponsors Wireshark 101 Jumpstart Seminar

Today we had the privilege of sponsoring one of Laura Chappell's free Wireshark 101 for Newbies Jumpstart Seminars. This is a live webinar that runs about 75 minutes. You can read my July 12 review below on the last one I attended. Very good info!

The next one is scheduled for August 18 at 10am PDT/GMT-7. Register at http://www.chappellseminars.com/s-wireshark101.html. Over 2000 people registered for today's seminar and only the first 1000 lucky people actually get to listen in, so be sure to login early on the day of the seminar.

Laura is doing a seminar devoted to NetScanTools Pro on August 12 and 12 noon PDT/GMT-7. Register at http://www.chappellseminars.com/s-nst.html. Cost is $99. Current NetScanTools Pro customers can email our sales department for a 50% off coupon.

Review of Laura Chappell's Wireshark 101 Jumpstart

Last Tuesday I took part in Laura Chappell's live online seminar about Wireshark. It's really for those who are new to Wireshark (which I'm not), but I wanted to see how the seminar was presented and I wanted to see if there was something I could learn about Wireshark that I didn't know. I was pleasantly surprised on both accounts. In case you don't know who Laura is, you should know that she has many years of network training to her credit.

The class was free (always a good price) and Laura had a limit of 1000 attendees. I think over 1700 signed up. I was able to make it in under the cutoff a half an hour ahead of time. The class was conducted using a Citrix viewing program that I had to install. This was required so that we could see slides and Wireshark in action. The quality of the audio was similar to that of a phone call, not super high but very intelligible. I used DSL (1.2 mb) which was fast enough for both the video portion and the audio. Laura also provided the slides as a downloadable PDF so you could follow along (I did).

There was a way to communicate back to the Laura and her assistants using both instant messaging and phone or audio link if you need to ask a question. Many people did ask questions. Yesterday I received the complete list of questions and answers by email.

Laura started the seminar by covering Wireshark on a general level, explaining how it can be integrated into the various packet capturing methods and explaining how it could open 'trace files' offline at a later time. Then she covered the various Wireshark placement options with their advantages and disadvantages. This included both tapping into wired network streams, mirroring them and even using wireless capture devices to see traffic on a wireless network.

Laura then moved directly into using Wireshark live to capture data into the file sets. Filesets allow you to create a large capture in multiple smaller files. Then she showed how to alter the time column so that you could see the relative time between packets rather than the default seconds since the beginning of the capture. Of course there were discussions about defining both capture filters to eliminate unwanted packets from our capture file and post capture filtering of the packets in the file. Since post-capture filtering can be complex in this program, Laura also covered changing the coloration of the rows of captured packets depending on the data in the packet. Laura also touched on following streams of TCP or UDP data. This is helpful when you are following communications between a client and server -- especially if the client is compromised by a trojan or something similar.

Even though Laura talked quicker than I ever can (though still slower than my 19 year old daughter), she ran out of time -- 75 minutes quickly ran into nearly 90 minutes. But she did leave us with a "to-do" list. First and foremost was to get the latest version of Wireshark, version 1.2. This version now includes optional GeoIP locating for IP addresses which is quite helpful (NetScanTools Pro does this too!). They take it one step further and display the IPs on a world map, which is always good (NetScanTools Pro will have this soon).

I learned that Laura puts on a very professional and well thought out seminar. This one was free and since Laura is the training business, she also has others that are not free. The other seminars are reasonably priced. They go into detail on many networking subjects, so please consider them. You can find Laura's seminars at http://www.chappellseminars.com/. You can follow her on Twitter at http://twitter.com/LauraChappell -- she posts usually every day -- not just business posts!

I also learned things about Wireshark that I didn't know -- particularly that GeoIP option and the colorizing methods.

If you are interested in seeing one of Laura's seminars, she will be repeating this same FREE seminar live on July 30 at 12pm Pacific Time. Please consider it. Go and sign up, then have a look at the other seminars Laura offers because with travel and training budgets tight like they are, having a live seminar delivered to your desk should be something your business should strongly consider. You can sign up for the next Wireshark Jumpstart seminar here.

NetScanTools (TM) Pro 10.92 USB Version Patch Ready

The USB upgrade patch is ready for those of you who have NetScanTools Pro USB version. If you have Wireshark Portable version installed on that same USB stick, you can now use the left panel Optional Tools menu to start Wireshark from within NetScanTools Pro. This has always worked for the installed version and now the USB version can do the same thing. When you first launch it, we provide a File Open navigation window where we ask you to locate and select the wiresharkportable.exe file. We then save that relative location for the next time you start Wireshark.

Everything else, including TCP Ping, is also included in the upgrade.

If you have NetScanTools Pro USB, click on Help/Check for New Version and login to get the patch. You must have an active maintenance plan to login.

Free AirPcap Adapters at Sharkfest

Although I haven't decided whether I will be able to attend, I wanted to let you know about Sharkfest. Sharkfest is all about WireShark(r) and it is put on by people who make WinPcap. We use WinPcap in NetScanTools Pro. WinPcap is a packet driver (http://www.wireshark.org/). Wireshark uses it to capture packets and we use it to both capture and generate packets. Wireshark is the best free network packet analysis tool I know of. The packet capture files that NetScanTools Pro saves can be opened by Wireshark for in-depth analysis.

Here are the details about the conference:

Wireshark(r) Developer and User Conference
June 15 - 18, 2009
Stanford University Palo Alto, California

SHARKFEST is an educational event that offers in-depth instruction over the course of 3 days to the benefit of anyone wishing to enhance their skill set with, and optimize the effective use of, the world's most popular network and packet analyzer, Wireshark.

Space is limited and due to a full house last year, early registration is strongly encouraged. Single registration for all 3 days is $695.00 USD. Details including conference hotels, group discounts and the conferenceschedule can be found at http://www.cacetech.com/sharkfest.09/. Every paid registration will receive a FREE AirPcap Classic Adapter (SRP $198USD) and so much more!