NetScanTools LE on Sale

This sale ended May 31, 2012, but you can now try NetScanTools LE immediately - visit http://www.netscantools.com/download.html


NetScanTools LE, our version of NetScanTools designed with law enforcement in mind, is on sale now through the end of May 2012. Normally $129, it is on sale for $49.

What is NetScanTools LE? please visit http://www.netscantools-le.com/ for more information.

Use this coupon when ordering at the reseller link below. Enter 'May2012LE' without the quotes in the coupon field, then press Recalculate.

https://www.plimus.com/jsp/buynow.jsp?contractId=2630672

IPv6 Network Neighbors in NetScanTools Pro 11.30

We introduced a new tool for IPv6 called Network Neighbors. This tool provides information similar to what the ARP Cache tool does for IPv4: a mapping of IPv6 addresses to physical addresses. Unlike the ARP Cache tool a physical address can be not only a MAC address, but it can also be an IPv4 address associated with a tunneling interface. You can see that in the image below.

Interesting things in this image are the global IPs that start with 2001: - one on those is the local address and the others are target addresses. Note also the large number of permanent multicast entries starting at the top with the ff02::c SSDP, ff02::16 All MLDv2-capable routers, ff02::1:2 All-dhcp-agents and finally the ff02::1:ffxx:xxxx solicited node address (RFC 4291).

You can see the lone fe80:: link local address attached to the only real physical network interface (NIC) in the computer. And you can even see the VMware player interfaces.

What you cannot see in the image is the interface alias, type and ifIndex (Scope ID).

This is new in NetScanTools Pro v11.30.

IPv6 Traceroute in NetScanTools Pro 11.30

NetScanTools Pro Traceroute can now do IPv6 traces. It can do native IPv6 (direct IPv6 connection) and tunneling traces such as through Teredo or 6to4. When you do a native IPv6 traceroute, you will potentially see every hop between you and the target. But with tunneling, it's different: you will see the tunneling server as the first hop even though it may be quite a few hops away. This is shown in the traceroute through a Teredo tunnel to ipv6.google.com shown below.

The hops you are seeing are from the teredo server itself is actually 8 hops from my computer. Since the Teredo server is tunneling IPv6 through UDP, I can trace to the server and find that it is 8 hops away - so in reality, to see all the hops from you to the target, you have to do two traces. But the important thing here is that IPv6 traceroute is now in NetScanTools Pro.

NetScanTools Pro version 11.30 released May 8, 2012

NetScanTools Pro v11.30 was released yesterday, May 8. There is a new tool designed for IPv6 called Network Neighbors. Several existing tools have changes to them: Traceroute now does IPv6 traces even through Teredo. Whois can now do Global IPv6 lookups and many new domain extension servers have been added to the database. Network Interfaces - Wireless now shows the MAC address (BSSID) of available access points even if you are not connected to them. And more - much more.

If you already have NetScanTools Pro v11, click on Help, then on Check for New Version and follow the instructions. If you want a demo, please visit http://www.netscantools.com/nstprodemorequest.html to get a version of the demo based on a slightly older version of 11.

Managed Switch Port Mapping Tool 1.99.9.5 Released

On April 15 we released Managed Switch Port Mapping Tool v1.99.9.5. This release makes an important change to the way VLANs are processed from qBridge Mib data. It will most likely affect the results seen from HP switches. It makes better use of the administratively assigned VLAN names.

Get it today at http://www.SwitchPortMapper.com/

How to install Wireshark on Windows 8

The title of this could also be "How to install WinPcap on Windows 8" or "How to install NetScanTools Pro on Windows 8". WinPcap is the packet capture driver used in both Wireshark and NetScanTools Pro (and LE). If you try to run the Wireshark installer, everything appears to install OK until you get to the WinPcap installer that it launches separately. The WinPcap installer refuses to run and shows an error about an unsupported operating system.

The solution is to run your installer in compability mode. Here's how:

1. from within Windows 8 (32 or 64 bit) get to the desktop and launch Windows Explorer.

2. locate your installer file, example: wireshark-win32-1.6.2.exe and right click on it to bring up the menu.

3. select "Troubleshoot compatibility" and wait a few seconds for it to do it's thing. Then click on "Try recommended settings". It will most likely show Windows Compatibility Mode of Windows XP (service pack 3).

4. Click on "Test the program..." the installer will start - follow the installer directions as you normally would. When you get to actually running the WinPcap installer you may see a message "This program has compatibility issues" - select "Run the program without getting help". WinPcap should now install.

5. When it's all done, click on Cancel instead of Next back on the Program Compatibility Troubleshooter window.

The problem is not Wireshark or NetScanTools Pro. Those installers both launch the WinPcap installer. It is the WinPcap installer that needs to be updated.

The good part about this is that now Wireshark now properly captures packets and NetScanTools Pro can both send and receive packets using WinPcap.

Update Oct 10, 2012: winpcap.org still shows version 4.1.2. With the public release of Windows 8 only a couple weeks away, we still are waiting on an updated WinPcap installer.

First Impressions of Windows 8

My first impressions of Windows 8 Consumer Preview can be summarized in two words: Radical Change.

Why do I say that? because this version of Windows clearly departs from earlier versions. Previous versions always provided backwards compatibility and using it was always obvious to the casual Windows user.

Windows 8 does things like force you to have an active Windows Live/Hotmail account. If that is really true, I know lots of off-the-internet secure labs that won't be happy. After you get past that, you are shown the Metro touchpad interface. While that may be all well and good if you are using a tablet or phone, that doesn't fly for a desktop installation (I put both the 32 and 64 bit versions into VirtualBox VMs). My son says that this looks exactly like the XBox interface.

So playing around with the touchpad interface with a mouse is kind of slow. The icons are huge and anything you install gets put on the right side of the default icons/pads. The two games they installed appear to rely on an internet connection (wonder how that will go over for dialup users - they still exist) and the pinball game was so slow I never even got it to fully load. This is on an 4 core, 8G ram machine...it might be faster natively installed instead of being in VirtualBox.

Going to the desktop that most Windows users are familiar with was pretty easy - there is an icon for that. But wait - the only thing on the desktop is the Recycle Bin and the taskbar only has IE and the Windows Explorer file manager. Where are things like Notepad? calculator? accessories? dare I say COMMAND PROMPT? If I search c:\windows I find the exe's but the casual home user isn't going to find them...trust me on that...I've talked to some home users that didn't know what a file was...

OK - so now I wanted to go back the Metro interface. After a long time I accidentally found that the funny looking Windows button (between ctrl and alt buttons) switches you between the desktop and metro. I never use that button - do you?

I wanted to run regedit just for kicks...guess what, no intuitive way to do that either, so I tried that win button with R. Up popped the run window. So I can do some things....grrrrrrrr

Now to the meat of things. I was able to install NetScanTools Pro/LE/basic on it, but the WinPcap driver install won't let me install. Same goes for Wireshark. The installer works, but WinPcap installer won't work - an unsupported version of Windows. Some people at Riverbed need to get to work on fixing that one soon!

Maybe I'm missing some things, but this version of windows appears to leave desktop and laptop users out in the cold.

Got any hints for me you are willing to share?

More on this topic soon...

Kirk