This newsletter was published last week and it talks about the latest releases of NetScanTools Pro and the Managed Switch Port Mapping Tool.
http://www.netscantools.com/pressandnewsletters/NST_News_May_2013.pdf
Enjoy!
Tuesday, June 4, 2013
Thursday, May 23, 2013
ARP Cache Behavior in Windows 8, 7 and Vista
This post applies to Windows 8, 7, Vista, 2012 and 2008.
If you depend on Ping Scanning to populate your Windows system ARP Cache, you may be in for a surprise. While Pinging a large number of local subnet IPs may populate your ARP cache, you may be surprised find that there are now limits in the size of the cache. In fact the cache size might be much smaller than you think.
When you Ping or send any IP packet for that matter to an IP address, the operating system checks the ARP cache to see if there is a MAC address for that IP. If it cannot find the IP, it sends an ARP request to the target IP whether in it's your subnet or not. If the target IP is in your subnet, the device responds with an ARP reply so that communication can begin on the MAC address level. That ARP reply contains an IP/MAC address pair that gets added to your ARP cache. If the IP is outside your subnet, the ARP reply comes from the default gateway and that IP/MAC pair gets added to the ARP cache.
We recently had a user move his Managed Switch Port Mapping Tool from Windows XP to Windows 7. He emailed to ask why he saw MAC Addresses but very few IP addresses. After much research we found that the ARP cache is no longer managed the way it was in XP and now defaults to a tiny 256 entry cache. And, what's more, the user found that his company had set the ARP cache to 10 IP/MAC addresses.
How to find out what your ARP cache size is now:
1. open a command prompt
2. enter this command and press Enter:
netsh interface ipv4 show global
3. make note of the Neighbor Cache Limit (second from the top). On this system it is 256 entries per interface.
While 256 may be enough for normal users, if you are ping scanning an IP range larger than 256 devices (like in a 10.x.x.x network) and expecting to see more results, you won't see them. In fact, our user was only seeing 10 because his company had set it at 10.
The good news is you can set your ARP cache size limit to a much larger number - here's how:
1. open an administrator command prompt
2. enter this command and press Enter:
netsh interface ipv4 set global neighborcachelimit = 4096
Want to learn more? Please visit http://support.microsoft.com/kb/949589
www.SwitchPortMapper.com
www.NetScanTools.com
If you depend on Ping Scanning to populate your Windows system ARP Cache, you may be in for a surprise. While Pinging a large number of local subnet IPs may populate your ARP cache, you may be surprised find that there are now limits in the size of the cache. In fact the cache size might be much smaller than you think.
When you Ping or send any IP packet for that matter to an IP address, the operating system checks the ARP cache to see if there is a MAC address for that IP. If it cannot find the IP, it sends an ARP request to the target IP whether in it's your subnet or not. If the target IP is in your subnet, the device responds with an ARP reply so that communication can begin on the MAC address level. That ARP reply contains an IP/MAC address pair that gets added to your ARP cache. If the IP is outside your subnet, the ARP reply comes from the default gateway and that IP/MAC pair gets added to the ARP cache.
We recently had a user move his Managed Switch Port Mapping Tool from Windows XP to Windows 7. He emailed to ask why he saw MAC Addresses but very few IP addresses. After much research we found that the ARP cache is no longer managed the way it was in XP and now defaults to a tiny 256 entry cache. And, what's more, the user found that his company had set the ARP cache to 10 IP/MAC addresses.
How to find out what your ARP cache size is now:
1. open a command prompt
2. enter this command and press Enter:
netsh interface ipv4 show global
While 256 may be enough for normal users, if you are ping scanning an IP range larger than 256 devices (like in a 10.x.x.x network) and expecting to see more results, you won't see them. In fact, our user was only seeing 10 because his company had set it at 10.
The good news is you can set your ARP cache size limit to a much larger number - here's how:
1. open an administrator command prompt
2. enter this command and press Enter:
netsh interface ipv4 set global neighborcachelimit = 4096
Want to learn more? Please visit http://support.microsoft.com/kb/949589
www.SwitchPortMapper.com
www.NetScanTools.com
Wednesday, April 24, 2013
SQLite Discussion - Sorting Order: TEXT vs NUMBER
One of our customers noticed a problem with our Switch List Editor in the Managed Switch Port Mapping Tool. The list ordering relies on a column in a table that we'll call ListIndex. The DDL for the table had defined the column as [ListIndex] TEXT. The index being saved in the column was the numbers zero through however many rows there are for that set of entries (this is not the main constraint column, just an indexing column within a set of rows).
If you did:
'SELECT * FROM theTable WHERE mainConstraintCol='rowSet' ORDER BY ListIndex ASC'
we expected to get a set of rows indexed 0, 1, 2, 3, 4 etc. in that order. That worked fine until there were more than 10 entries in a set of rows. Then the sorting would be 0, 1, 10, 11, 12, 13, 14, 2, 3, 4, 5, 6, 7, 8, 9. Obviously it is the creect sorting if the column is of type TEXT, but wrong since we are interested in the numbers themselves.
The solution was to change the DDL to this: [ListIndex] NUMBER (or INTEGER). That way the ORDER BY sorting ends up correctly in numeric order for lists larger than 10: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, etc.
Changing the DDL works OK if you are creating the table every time, but this table is persistent between application sessions. Because SQLite (to my knowledge) has no ALTER TABLE method for changing an existing table DDL Type from TEXT to NUMBER, I had to do the create temp table, copy contents from original, DROP the original table and recreate it correctly, then copy the temp table contents back to the original. A pain, but functional method. I would be interested in any other simpler methods.
Moral of this story is to be sure of your column typing when you define a table in SQLite especially if you are depending on the contents of that column to index something else.
SQLite: www.sqlite.org
Managed Switch Port Mapping Tool: www.SwitchPortMapper.com
If you did:
'SELECT * FROM theTable WHERE mainConstraintCol='rowSet' ORDER BY ListIndex ASC'
we expected to get a set of rows indexed 0, 1, 2, 3, 4 etc. in that order. That worked fine until there were more than 10 entries in a set of rows. Then the sorting would be 0, 1, 10, 11, 12, 13, 14, 2, 3, 4, 5, 6, 7, 8, 9. Obviously it is the creect sorting if the column is of type TEXT, but wrong since we are interested in the numbers themselves.
The solution was to change the DDL to this: [ListIndex] NUMBER (or INTEGER). That way the ORDER BY sorting ends up correctly in numeric order for lists larger than 10: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, etc.
Changing the DDL works OK if you are creating the table every time, but this table is persistent between application sessions. Because SQLite (to my knowledge) has no ALTER TABLE method for changing an existing table DDL Type from TEXT to NUMBER, I had to do the create temp table, copy contents from original, DROP the original table and recreate it correctly, then copy the temp table contents back to the original. A pain, but functional method. I would be interested in any other simpler methods.
Moral of this story is to be sure of your column typing when you define a table in SQLite especially if you are depending on the contents of that column to index something else.
SQLite: www.sqlite.org
Managed Switch Port Mapping Tool: www.SwitchPortMapper.com
Switch Port Mapper 2.07 Released
The latest version 2.07 of the Managed Switch Port Mapping Tool was released on April 22, 2013. The purpose of this release was to correct a problem with Switch Lists, more specifically the Switch List editor and the execution engine. The issue only was apparent when you had more than 9 switches in a list. If you had 10 or more, the sort order of the switches in the editor and the execution engine was like this: 0, 1, 10, 11, 12, 2, 3, 4, 5 etc. instead of 0, 1, 2, 3, 4, 5 etc.
As a result of working with the Switch List Editor, I discovered it was saving to the database fairly inefficiently (slowly), so I made some changes to speed that up and so it is much faster now when you press the OK button to close the editor.
It was suggested by a user that we include a method for copying a whole results grid row to the clipboard and that was added, however, it may not appear quite as you expect because if there are more than one MAC address in a cell, a CR-LF is added to the copied text for each one.
As usual, we keep updating SQLite DLL to match the latest version and the MAC Address to Manufacturer database was also updated.
Get it at www.SwitchPortMapper.com or follow the instructions in Help/Check for Update.
As a result of working with the Switch List Editor, I discovered it was saving to the database fairly inefficiently (slowly), so I made some changes to speed that up and so it is much faster now when you press the OK button to close the editor.
It was suggested by a user that we include a method for copying a whole results grid row to the clipboard and that was added, however, it may not appear quite as you expect because if there are more than one MAC address in a cell, a CR-LF is added to the copied text for each one.
As usual, we keep updating SQLite DLL to match the latest version and the MAC Address to Manufacturer database was also updated.
Get it at www.SwitchPortMapper.com or follow the instructions in Help/Check for Update.
Thursday, April 11, 2013
USB Version of the Managed Switch Port Mapper
We have offered NetScanTools Pro as a fully portable application running from a USB Flash Drive since 2006 and now the Managed Switch Port Mapping Tool has joined it.
The Switch Port Mapper can now run from a USB Flash Drive using a special compiled version. It retains all the same features as the 'installed' version yet now is fully portable so that you can run it on any Windows XP or later machine that offers a USB 2.0 or 3.0 port. Simply plug in the flash drive, navigate to the executable and start it. And it doesn't require 'Run as administrator'!
We are shipping it on a fast USB 3.0 (compatible with USB 2.0) 16 GB flash drive and for those who already have their own fast flash drive, we can supply a fileset that you can put on it yourself with assistance from our tech support.
The advantages of having the Switch Port Mapper on a USB Flash Drive - not requiring installation - are immense. Network Techs can take it to offsite locations and quickly map a switch.
As far as we know, we are the ONLY company offering Switch Port Mapping software both as fully portable USB flash drive software and as installed on a Windows computer.
Interested?
www.SwitchPortMapper.com
The Switch Port Mapper can now run from a USB Flash Drive using a special compiled version. It retains all the same features as the 'installed' version yet now is fully portable so that you can run it on any Windows XP or later machine that offers a USB 2.0 or 3.0 port. Simply plug in the flash drive, navigate to the executable and start it. And it doesn't require 'Run as administrator'!
We are shipping it on a fast USB 3.0 (compatible with USB 2.0) 16 GB flash drive and for those who already have their own fast flash drive, we can supply a fileset that you can put on it yourself with assistance from our tech support.
The advantages of having the Switch Port Mapper on a USB Flash Drive - not requiring installation - are immense. Network Techs can take it to offsite locations and quickly map a switch.
As far as we know, we are the ONLY company offering Switch Port Mapping software both as fully portable USB flash drive software and as installed on a Windows computer.
Interested?
www.SwitchPortMapper.com
Packet Generator Scripting Improvements
NetScanTools Pro v11.42 introduced two major improvements to the Packet Generator scripting:
The first is a 'debugging' window. This new window, located below the main controls on the Packet Generator page serves the primary purpose of showing the command processing during scripting - if you have Enable Script Debugging Messages checked. The other purpose for it is to show certain errors when they occur.
The second improvement is the addition of five new packet reset commands. These commands are intended to be used just prior to modifying packet parameters followed by sending the packets. They reset the TCP, UDP, ICMP, CDP and ARP packet headers to known states - primarily zero. The commands are:
!TCP_RESET_PACKET - resets the TCP header
!UDP_RESET_PACKET - resets the UDP header
!ICMP_RESET_PACKET - resets the ICMP header
!CDP_RESET_PACKET - resets the CDP header and presets some fields to non-zero values
!ARP_RESET_PACKET - resets the ARP header and presets some fields to non-zero values
This is detailed in the Help file (press F1 while viewing the Packet Generator) under the topic Packet Generator - Scripting.
Be sure to use these before defining header parameters and sending packets.
The first is a 'debugging' window. This new window, located below the main controls on the Packet Generator page serves the primary purpose of showing the command processing during scripting - if you have Enable Script Debugging Messages checked. The other purpose for it is to show certain errors when they occur.
The second improvement is the addition of five new packet reset commands. These commands are intended to be used just prior to modifying packet parameters followed by sending the packets. They reset the TCP, UDP, ICMP, CDP and ARP packet headers to known states - primarily zero. The commands are:
!TCP_RESET_PACKET - resets the TCP header
!UDP_RESET_PACKET - resets the UDP header
!ICMP_RESET_PACKET - resets the ICMP header
!CDP_RESET_PACKET - resets the CDP header and presets some fields to non-zero values
!ARP_RESET_PACKET - resets the ARP header and presets some fields to non-zero values
This is detailed in the Help file (press F1 while viewing the Packet Generator) under the topic Packet Generator - Scripting.
Be sure to use these before defining header parameters and sending packets.
WinPcap 4.1.3 for Windows 8
As you may already be aware, the folks at winpcap.org finally did an upgrade to the WinPcap driver. Version 4.1.3 supports Windows 8 - in other words the installer will not balk at Win 8 like the 4.1.2. installer did. And they did a couple of minor bug fixes in the process.
So if you have Wireshark or NetScanTools Pro and want to use them on Windows 8, please visit http://www.winpcap.org/ to get 4.1.3.
So if you have Wireshark or NetScanTools Pro and want to use them on Windows 8, please visit http://www.winpcap.org/ to get 4.1.3.
Subscribe to:
Posts (Atom)