You can read about us today in the Sequim Gazette:
http://www.sequimgazette.com/business/article.exm/2011-05-18_fortune_500_companies_seek_assistance_in_sequim
Kirk
Wednesday, May 18, 2011
Tuesday, May 10, 2011
ipPulse 1.80 released May 10, 2011
Today I released ipPulse 1.80 in response to a customer request to add the ability to send alert emails through secure email servers. It can now do that. I've tested it with our own servers and also with Yahoo, Gmail, and Hotmail/Live servers. Those last three servers require security, so it was pretty necessary. There were also some other changes - here are the details:
-Added the ability to send notification emails through secure email servers using TLS. This allows you to send notifications through a number of services including Yahoo, Hotmail and Gmail. Examples are in the help file.
-Updated the program icon.
-Renamed Setup to Settings. This is a more commonly understood term for the program settings.
-Added button to select a minimal set of columns in the Settings/Program Control/Edit Column Visibility window.
-Added logic to define a minimal set of columns in case all saved columns are invisible.
-Reformatted and revised help file.
If you have the unlocked version of ipPulse, please download and install over the top. Also, be sure to test sending an email before actually running ipPulse against a list of IPs. Turn on SMTP logging while you do the test so that you can see what's happening.
ipPulse 1.80 is here:
http://www.nwpsw.com/ippulsemain.html
-Added the ability to send notification emails through secure email servers using TLS. This allows you to send notifications through a number of services including Yahoo, Hotmail and Gmail. Examples are in the help file.
-Updated the program icon.
-Renamed Setup to Settings. This is a more commonly understood term for the program settings.
-Added button to select a minimal set of columns in the Settings/Program Control/Edit Column Visibility window.
-Added logic to define a minimal set of columns in case all saved columns are invisible.
-Reformatted and revised help file.
If you have the unlocked version of ipPulse, please download and install over the top. Also, be sure to test sending an email before actually running ipPulse against a list of IPs. Turn on SMTP logging while you do the test so that you can see what's happening.
ipPulse 1.80 is here:
http://www.nwpsw.com/ippulsemain.html
Thursday, April 21, 2011
NetScanTools Pro 11.01 Released April 18
Yes, after only two weeks, out comes another release. During those two weeks work was being done on the USB version. And, of course, our customers did find a few things we needed to fix and those are done. This release addresses the problem of running the program on less than 32 bits per pixel color depth and some other problems with Automated Tools. So now both the installed version and USB version are done. The databases were updated too.
Please be sure to explore the new features like sending RAW ethernet packets. This is cool because you can craft and send anything you want - malformed packets or OK packets. SNMP also now supports version 3, there is a completely rewritten Connection Monitor, a Routing Table tool and more. Don't forget to use the 'Add to Favorites' checkbox on each manual tool. That way you won't be scrolling through tools looking for your favorites.
Kirk
Please be sure to explore the new features like sending RAW ethernet packets. This is cool because you can craft and send anything you want - malformed packets or OK packets. SNMP also now supports version 3, there is a completely rewritten Connection Monitor, a Routing Table tool and more. Don't forget to use the 'Add to Favorites' checkbox on each manual tool. That way you won't be scrolling through tools looking for your favorites.
Kirk
Friday, April 8, 2011
NetScanTools Pro 11 finally released!
After a year+ of work, NetScanTools Pro version 11 was released. There are many new and improved things in this release that I'm sure you will be interested in. This is a true major release.
New Interface - completely update and it is still an 'outlook' style interface, there is a left panel control bar and tools appear on the right side. This new interface gives us the ability to bring back 'Favorites' - something that was present in the old 'tabbed' interface of the earlier versions of NetScanTools Pro. You can see a slideshow of it in the screenshot section of the product grid on http://www.netscantools.com/.
The goal of this release was to enhance yet simplify by clearly showing the intended use of each tool. This meant that some tools were split into two parts, for example the ARP tool became the ARP Cache Tool and the ARP Scan Tool. Some tools and things within tools were renamed to conform to industry standard conventions, for example 'Setup' was a more common term when NetScanTools was first released, but now 'Settings' is more common and better understood.
New Tools - Connection Monitor, MAC Address to Manufacturer, Network Interfaces - Wireless, Routing Table - IPV4, and SNMP Scanner Tool.
Additions to current tools:
DNS Tools - Core now has IPv6 Simple Query lookups, Get Basic DNS Records now retrieves the IPv6 AAAA records, we added Flush Default DNS Cache and Edit DNS HOSTS File.
DNS Tools - Advanced has three new tools, IPv4 or Hostname to ASN, Get VOIP SRV Records and Get Misc SRV Records.
Packet Generator now supports sending ARP/RARP packets and RAW packets. RAW packets means that you craft the whole packet from the destination and source ethernet header MAC addresses all the way to the end. And we've added a new tool to help you do that: a Hex Editor.
Ping now supports IPv6 addresses.
Ping Scanner (AKA NetScanner) has the ability to translate IPv4 addresses using either the Default System DNS or a specific DNS. We also added Scan Delay Time to slow it down if necessary and added a way to import an IPv4 list into it. To simplify results, we made the columns dynamic in other words they appear and disappear according to the additional scan tasks settings.
Port Scanner was completely rewritten and works much better than the v10.x predecessor. It's much faster and more accurate. We've added a section for scanning commonly used ports and there's an editor for that list in case you need to change it.
Promiscuous Mode Scanner adds the Multicast Address 3 test.
Service Lookup replaces the old Database Tests.
SMTP Server Tests now supports STARTTLS and you can select the Protocol (TLS1, SSL2, SSL3), Algorithm (DES, 3 DES, MD5, RC4, SHA) and Minimum Key (40-256 bit) Preferences (not all settings are supported in all operating systems).
SNMP was split in two for clarity, Core and Advanced. It now supports all modes of SNMPv3 (you may need to obtain the OpenSSL libeay32.dll for support the authPriv encrypted mode - we cannot distribute that). We have added WalkBulk, GetNext and GetBulk to the Core tool. The Advanced tool has a launcher for both the Dictionary Attack Tool and the new SNMP Scanner Tool. The Dictionary Attack tool is much faster than before in terms of loading a list of IPs and clearing the display.
Whois now supports IPv6 input queries and if you enter a domain, we attempt to do an IPv6 and IPv4 address resolution on the 'www.' prefixed hostname. History buttons have been added so that you can view previous whois queries made during the current session.
This brings us to overall design considerations. Favorites was a common request during the lifetime of version 10. It was not easily done in version 10, but it was a priority goal in version 11. You can now check a box on each manual tool to add it to the left panel Favorites group. As in NetScanTools LE, we now have a mandatory results database. This is required so that we can bring up historical reports from each tool both manual and automated. Automated Tools was completely rewritten. The Automated Tools use an engine to operate each manual tool given the input and the results are saved to the database. In previous versions, the Automated tools were actually a duplicate of the manual tool that did the same action - not efficient. Running more than one tool at a time is important to some customers, so this new program shell gave us the methods for doing so. As in 10.x, reports are shown in the web browser - the database gives us the method to be able to show old reports from other sessions. The left panel now has tool groupings like DNS Tools, Packet Tools etc. This helps users find tools they need quickly. IPv6 will be a focus of version 11. We have some support in there now, but as version evolves, more IPv6 compatibility will be added - stay tuned!
Please review the video and image gallery on the main netscantools.com page. More information will be posted shortly along with new images and videos.
New Interface - completely update and it is still an 'outlook' style interface, there is a left panel control bar and tools appear on the right side. This new interface gives us the ability to bring back 'Favorites' - something that was present in the old 'tabbed' interface of the earlier versions of NetScanTools Pro. You can see a slideshow of it in the screenshot section of the product grid on http://www.netscantools.com/.
The goal of this release was to enhance yet simplify by clearly showing the intended use of each tool. This meant that some tools were split into two parts, for example the ARP tool became the ARP Cache Tool and the ARP Scan Tool. Some tools and things within tools were renamed to conform to industry standard conventions, for example 'Setup' was a more common term when NetScanTools was first released, but now 'Settings' is more common and better understood.
New Tools - Connection Monitor, MAC Address to Manufacturer, Network Interfaces - Wireless, Routing Table - IPV4, and SNMP Scanner Tool.
Additions to current tools:
DNS Tools - Core now has IPv6 Simple Query lookups, Get Basic DNS Records now retrieves the IPv6 AAAA records, we added Flush Default DNS Cache and Edit DNS HOSTS File.
DNS Tools - Advanced has three new tools, IPv4 or Hostname to ASN, Get VOIP SRV Records and Get Misc SRV Records.
Packet Generator now supports sending ARP/RARP packets and RAW packets. RAW packets means that you craft the whole packet from the destination and source ethernet header MAC addresses all the way to the end. And we've added a new tool to help you do that: a Hex Editor.
Ping now supports IPv6 addresses.
Ping Scanner (AKA NetScanner) has the ability to translate IPv4 addresses using either the Default System DNS or a specific DNS. We also added Scan Delay Time to slow it down if necessary and added a way to import an IPv4 list into it. To simplify results, we made the columns dynamic in other words they appear and disappear according to the additional scan tasks settings.
Port Scanner was completely rewritten and works much better than the v10.x predecessor. It's much faster and more accurate. We've added a section for scanning commonly used ports and there's an editor for that list in case you need to change it.
Promiscuous Mode Scanner adds the Multicast Address 3 test.
Service Lookup replaces the old Database Tests.
SMTP Server Tests now supports STARTTLS and you can select the Protocol (TLS1, SSL2, SSL3), Algorithm (DES, 3 DES, MD5, RC4, SHA) and Minimum Key (40-256 bit) Preferences (not all settings are supported in all operating systems).
SNMP was split in two for clarity, Core and Advanced. It now supports all modes of SNMPv3 (you may need to obtain the OpenSSL libeay32.dll for support the authPriv encrypted mode - we cannot distribute that). We have added WalkBulk, GetNext and GetBulk to the Core tool. The Advanced tool has a launcher for both the Dictionary Attack Tool and the new SNMP Scanner Tool. The Dictionary Attack tool is much faster than before in terms of loading a list of IPs and clearing the display.
Whois now supports IPv6 input queries and if you enter a domain, we attempt to do an IPv6 and IPv4 address resolution on the 'www.' prefixed hostname. History buttons have been added so that you can view previous whois queries made during the current session.
This brings us to overall design considerations. Favorites was a common request during the lifetime of version 10. It was not easily done in version 10, but it was a priority goal in version 11. You can now check a box on each manual tool to add it to the left panel Favorites group. As in NetScanTools LE, we now have a mandatory results database. This is required so that we can bring up historical reports from each tool both manual and automated. Automated Tools was completely rewritten. The Automated Tools use an engine to operate each manual tool given the input and the results are saved to the database. In previous versions, the Automated tools were actually a duplicate of the manual tool that did the same action - not efficient. Running more than one tool at a time is important to some customers, so this new program shell gave us the methods for doing so. As in 10.x, reports are shown in the web browser - the database gives us the method to be able to show old reports from other sessions. The left panel now has tool groupings like DNS Tools, Packet Tools etc. This helps users find tools they need quickly. IPv6 will be a focus of version 11. We have some support in there now, but as version evolves, more IPv6 compatibility will be added - stay tuned!
Please review the video and image gallery on the main netscantools.com page. More information will be posted shortly along with new images and videos.
Tuesday, March 15, 2011
SQLite, AUTO_VACUUM and Windows ACLs
This article applies to Windows 7 32/64 and Windows Vista 32/64 with UAC active.
In January an enduser pointed out to me that every time he tried to use the Real Time BlackList tool in NetScanTools Pro, he got an SQLite error message about the database being 'read-only' - it could not be opened. The software was installed on Windows 7-64 bit and NetScanTools Pro is operating at 'asInvoker' privilege which is normally USER privileges.
After doing the usual tech support routines by checking file properties, I was stumped - until yesterday when I was able to duplicate it on two Windows 7 machines.
The SQLite database is copied into our own directory created at install time under c:\ProgramData which is the common user data area. The thought was that any account using the program would be able to access the database. That was the idea. It's not the only database we put in there and the others were opening fine so I set out to find out why.
The only thing different about this database is that it has the pragma "AUTO_VACUUM" set. It appears that with AUTO_VACUUM SQLite moves freed pages around within the tables. This requires write privileges. SQLite error messages should do more than simply state that the database is read-only by checking the file ACLs given the calling process account privileges then stating the incompatibility with the current AUTO_VACUUM state.
To see the file access privs on an account level, you have to go into our C:\ProgramData\NWPS\NetScanToolsPro common user directory and do an "icacls *.*" on the command line. You will see that indeed user level privileges (BUILTIN\Users) only have (I)(RX) - inherit, read, execute privileges while the other higher level accounts have (F) full privileges. Since AUTO_VACUUM requires write access to the database to make changes, it will not have the proper privs for a user level account. So, yes, opening the database fails (I just don't think the message is good enough).
So now, how to fix it. Recreating the database with AUTO_VACUUM off fixes it. But what if you need to write (as a USER) to the Real Time Blacklist database using the tool we provide to edit the database? You can't because the administrators group are the owner.
The solution is to change the directory and file ACLs. I did this by modifying the installer to call a function of my own design which applied FULL access privs (grfAccessPermissions=GENERIC_ALL) to grfInheritance=SUB_CONTAINERS_AND_OBJECTS_INHERIT at our NWPS\NetScanToolsPro directory level. If that is done and you do the icacls command, all files in that directory show the "Everyone:(I)(F)" which means that every account can fully access the files and that includes our SQLite database that we couldn't open. You have to use AllocateAndInitializeSid, SetEntriesInAcl, and SetNamedSecurityInfo so accomplish this. You have to do this in the installer because it is running at admin privileges.
To summarize, if you have a program running Windows 7 or Vista at USER level that needs to access an SQLite database with write privileges contained in the C:\ProgramData common user directory that was not created by your program - you've got a problem. And that problem is even worse if it has AUTO_VACUUM enabled. You have to modify the file access privileges to FULL control in order to allow SQLite to operate on the database correctly.
In January an enduser pointed out to me that every time he tried to use the Real Time BlackList tool in NetScanTools Pro, he got an SQLite error message about the database being 'read-only' - it could not be opened. The software was installed on Windows 7-64 bit and NetScanTools Pro is operating at 'asInvoker' privilege which is normally USER privileges.
After doing the usual tech support routines by checking file properties, I was stumped - until yesterday when I was able to duplicate it on two Windows 7 machines.
The SQLite database is copied into our own directory created at install time under c:\ProgramData which is the common user data area. The thought was that any account using the program would be able to access the database. That was the idea. It's not the only database we put in there and the others were opening fine so I set out to find out why.
The only thing different about this database is that it has the pragma "AUTO_VACUUM" set. It appears that with AUTO_VACUUM SQLite moves freed pages around within the tables. This requires write privileges. SQLite error messages should do more than simply state that the database is read-only by checking the file ACLs given the calling process account privileges then stating the incompatibility with the current AUTO_VACUUM state.
To see the file access privs on an account level, you have to go into our C:\ProgramData\NWPS\NetScanToolsPro common user directory and do an "icacls *.*" on the command line. You will see that indeed user level privileges (BUILTIN\Users) only have (I)(RX) - inherit, read, execute privileges while the other higher level accounts have (F) full privileges. Since AUTO_VACUUM requires write access to the database to make changes, it will not have the proper privs for a user level account. So, yes, opening the database fails (I just don't think the message is good enough).
So now, how to fix it. Recreating the database with AUTO_VACUUM off fixes it. But what if you need to write (as a USER) to the Real Time Blacklist database using the tool we provide to edit the database? You can't because the administrators group are the owner.
The solution is to change the directory and file ACLs. I did this by modifying the installer to call a function of my own design which applied FULL access privs (grfAccessPermissions=GENERIC_ALL) to grfInheritance=SUB_CONTAINERS_AND_OBJECTS_INHERIT at our NWPS\NetScanToolsPro directory level. If that is done and you do the icacls command, all files in that directory show the "Everyone:(I)(F)" which means that every account can fully access the files and that includes our SQLite database that we couldn't open. You have to use AllocateAndInitializeSid, SetEntriesInAcl, and SetNamedSecurityInfo so accomplish this. You have to do this in the installer because it is running at admin privileges.
To summarize, if you have a program running Windows 7 or Vista at USER level that needs to access an SQLite database with write privileges contained in the C:\ProgramData common user directory that was not created by your program - you've got a problem. And that problem is even worse if it has AUTO_VACUUM enabled. You have to modify the file access privileges to FULL control in order to allow SQLite to operate on the database correctly.
Thursday, March 3, 2011
Tip: Find Root DNS for a Top Level Domain
Have you needed to find the root DNS servers for a particular top level domain?
Applies to: NetScanTools Pro, NetScanTools LE, NetScanTools Basic, NetScanTools Standard (obsolete).
It’s actually pretty easy, but how you enter the top level domain makes all the difference in the world. Examples of a top level domain are: .uk, .com, .nu, .se, .ca etc.
How to do it:
1. Switch to the DNS Tools – Core tool or on older software, the Name Server Lookup tool.
2. Enter the DNS you are going use under Advanced Query.
3. Select the NS record type, you may have to go into AQ Setup or Setup to do this.
4. Enter the top level extension in the IP/host/domain entry area. The correct method is to enter the extension followed by a period: ca. or uk. or com. –if you leave off the period or put the period before the extension, the query will fail.
5. Press NSLOOKUP.
Results will look like these two examples, the first for .ca (Canada) and the second for .se (Sweden):
[Start Query]
NSLOOKUP Starting Timestamp: 02/24/11 14:49:37
Command line equivalent: "nslookup -recurse -type=NS ca."
Looking up [ca.]
DNS Name: 4.2.2.2
IP Address: 4.2.2.2
Non-authoritative answer:
ca NS nameserver = f.ca-servers.ca
ca NS nameserver = e.ca-servers.ca
ca NS nameserver = j.ca-servers.ca
ca NS nameserver = a.ca-servers.ca
ca NS nameserver = c.ca-servers.ca
ca NS nameserver = m.ca-servers.ca
ca NS nameserver = l.ca-servers.ca
ca NS nameserver = z.ca-servers.ca
ca NS nameserver = k.ca-servers.ca
ca NS nameserver = sns-pb.isc.org
Server Response Time = 0.117 seconds
[End Query]
[Start Query]
NSLOOKUP Starting Timestamp: 02/24/11 14:54:34
Command line equivalent: "nslookup -recurse -type=NS se."
Looking up [se.]
DNS Name: 4.2.2.2
IP Address: 4.2.2.2
Non-authoritative answer:
se NS nameserver = d.ns.se
se NS nameserver = e.ns.se
se NS nameserver = c.ns.se
se NS nameserver = a.ns.se
se NS nameserver = b.ns.se
se NS nameserver = g.ns.se
se NS nameserver = h.ns.se
se NS nameserver = i.ns.se
se NS nameserver = f.ns.se
se NS nameserver = j.ns.se
Server Response Time = 0.430 seconds
[End Query]
What you see in the two examples above are the authoritative name servers for the root domains.
Applies to: NetScanTools Pro, NetScanTools LE, NetScanTools Basic, NetScanTools Standard (obsolete).
It’s actually pretty easy, but how you enter the top level domain makes all the difference in the world. Examples of a top level domain are: .uk, .com, .nu, .se, .ca etc.
How to do it:
1. Switch to the DNS Tools – Core tool or on older software, the Name Server Lookup tool.
2. Enter the DNS you are going use under Advanced Query.
3. Select the NS record type, you may have to go into AQ Setup or Setup to do this.
4. Enter the top level extension in the IP/host/domain entry area. The correct method is to enter the extension followed by a period: ca. or uk. or com. –if you leave off the period or put the period before the extension, the query will fail.
5. Press NSLOOKUP.
Results will look like these two examples, the first for .ca (Canada) and the second for .se (Sweden):
[Start Query]
NSLOOKUP Starting Timestamp: 02/24/11 14:49:37
Command line equivalent: "nslookup -recurse -type=NS ca."
Looking up [ca.]
DNS Name: 4.2.2.2
IP Address: 4.2.2.2
Non-authoritative answer:
ca NS nameserver = f.ca-servers.ca
ca NS nameserver = e.ca-servers.ca
ca NS nameserver = j.ca-servers.ca
ca NS nameserver = a.ca-servers.ca
ca NS nameserver = c.ca-servers.ca
ca NS nameserver = m.ca-servers.ca
ca NS nameserver = l.ca-servers.ca
ca NS nameserver = z.ca-servers.ca
ca NS nameserver = k.ca-servers.ca
ca NS nameserver = sns-pb.isc.org
Server Response Time = 0.117 seconds
[End Query]
[Start Query]
NSLOOKUP Starting Timestamp: 02/24/11 14:54:34
Command line equivalent: "nslookup -recurse -type=NS se."
Looking up [se.]
DNS Name: 4.2.2.2
IP Address: 4.2.2.2
Non-authoritative answer:
se NS nameserver = d.ns.se
se NS nameserver = e.ns.se
se NS nameserver = c.ns.se
se NS nameserver = a.ns.se
se NS nameserver = b.ns.se
se NS nameserver = g.ns.se
se NS nameserver = h.ns.se
se NS nameserver = i.ns.se
se NS nameserver = f.ns.se
se NS nameserver = j.ns.se
Server Response Time = 0.430 seconds
[End Query]
What you see in the two examples above are the authoritative name servers for the root domains.
NetScanTools Pro 10.98.2 Released
On February 23, 2011 we released NetScanTools Pro 10.98.2 both installed and USB versions. Many of the changes have to do with privileges and will primarily affect Windows 7 and Vista users.
Here are the release notes.
-Improved messages that show if writing to a registry location fails. They now suggest escalating the privileges by starting the program with 'Run as administrator'.
-All temporary snmp files are now removed on program exit.
-Improved handling of WinPcap interfaces where both IPv4 and IPv6 addresses are bound to the interface. Affects several programs.
-Internal changes to DNS Tools resolver.
-Port Scanner and NetScanner (Ping Scan) now show warning messages if privileges are not sufficient to run UDP scan and Subnet Mask test respectively.
-Updated SQLite to version 3.7.4.
-Updated database files.
Enjoy!
Here are the release notes.
-Improved messages that show if writing to a registry location fails. They now suggest escalating the privileges by starting the program with 'Run as administrator'.
-All temporary snmp files are now removed on program exit.
-Improved handling of WinPcap interfaces where both IPv4 and IPv6 addresses are bound to the interface. Affects several programs.
-Internal changes to DNS Tools resolver.
-Port Scanner and NetScanner (Ping Scan) now show warning messages if privileges are not sufficient to run UDP scan and Subnet Mask test respectively.
-Updated SQLite to version 3.7.4.
-Updated database files.
Enjoy!
Subscribe to:
Posts (Atom)