Managed Switch Port Mapping Tool v1.99.5 Released

This latest release was made available for download today. It adds support for SMC switches. We tested it thoroughly with an SMC6128L2 switch and there are now SMC specific extensions in our software to gather more information about the switch.

There was one fundamental operational change that you should be aware of: ping sweep has been moved up near the start of the switch mapping process. This was done to force the switch to update it's bridge tables with any mac addresses that may have 'aged' out of the tables. That way as many devices as possible will be seen. Be sure to put in all the IPv4 ranges you need to be pinged ahead of time.

Another set of changed dealt with the operation of the IP to hostname resolver. We added a control in Settings to turn use of the caching table on or off. We also added a control in Settings to be sure that it is erased on exit. The reasoning behind this is that in a DHCP environment, IPs change and you should probably be clearing the table more often. The table is used much like a 'hosts' file for quick resolution of IPv4 addresses to hostnames in successive mappings. This will become more necessary in v2.0. In order to minimize DNS queries, we use this table. Now there are more options for erasing it to remove what will become stale information. One other thing we added was a check for duplicate hostnames - what we mean by this is two IPs having the same hostname. If this is found, you get to see the hostname(s) and IPs that are sharing the hostname. You would definitely want to manually erase the IP/hostname Resolver table in Database Maintenance if this occurs. If it repeats after doing that, you have a DNS problem.

Another change was in the area of print margins. A user pointed out that the print margins were rather large. Investigation revealed that the default margins were supposed to be 25mm. But in reality it was more like 250mm or one inch. If you are using a 96 dpi printer, then it is one inch. The File menu now has Print Page Options to allow you to change this.

Finally, in an effort to get away from the ancient Wise installer that we've used for years, this release now uses Inno Setup. Inno Setup reduced the size of the installer by around 1 MB. That doesn't sound like much but it is when you consider many downloads. It's also a modern and fast installer, so it works better on Windows 7.

http://www.switchportmapper.com/
or
http://www.netscantools.com/spmapmain.html

Enjoy!
Kirk

Need to know what's attached to your Nortel switch?

Watch this video to see how to use the Managed Switch Port Mapping tool to find out what's attached to a Nortel® BES110-24T switch.

http://www.youtube.com/watch?v=DhDimMRpO8I

Enjoy!

NetScanTools (r) Basic Edition 2.1 Released July 8, 2011

On Friday we released NetScanTools Basic 2.1 - our first update to this software since January 2010. This is our freeware version of NetScanTools. It has just a few helpful tools that introduce people to the NetScanTools Product line.

Tools:
DNS Tools - simple query (ipv4 to hostname etc.), Who Am I (shows your IPv4 address, hostname and DNS servers), Test Default DNS (takes IP address or hostname and asks each default DNS server for translation).

Ping - uses standard ICMP ping to contact an IPv4 or hostname.

Graphical Ping - uses standard ICMP ping to contact an IPv4 or hostname and it graphs the response times over time.

Traceroute - uses ICMP packets to show the route between your computer and a target computer.

Ping Scanner - uses ICMP packets to ping every IPv4 address between a start and ending IPv4 address.

Whois - shows basic whois information for around 70 domain extensions and IPv4 addresses.

These tools are simplified in comparison to NetScanTools Pro which means you don't have all the options available and you only get one mode of operation - for example traceroute is ICMP only instead of ICMP, UDP, TCP etc.

Have a look and enjoy!
Kirk

IPv6 Teredo Problems and Solutions on Windows 7-64 bit

I came back from the Wireshark Sharkfest '11 Conference excited to try some of the things I had learned. Imagine my dismay when I fired up my Windows 7-64 test box only to find that certain parts of NetScanTools Pro 11 that are IPv6 aware ceased working. Immediately I was able to see that it was the parts of the program that depended on the getaddrinfo function call that were failing. How did I know that? I used the other 'home-grown' NetScanTools resolver functions to talk with DNS (they bypass Windows resolver entirely and talk directly to any DNS) and by using Wireshark I could see the AAAA records coming back from DNS. I could see that the getaddrinfo function was not getting and reporting the IPv6 AAAA records. Very strange.

So I looked at a couple of things. First I did a cursory check of the network settings with ipconfig. All appeared normal. Then I spent some time recompiling NetScanTools Pro while playing around with various options in the addrinfo hints structure passed into getaddrinfo. That was not fruitful. Nothing I did could make the getaddrinfo function return the AAAA record. I was seeing the 11004 WSANO_DATA error. So I put that aside and looked more carefully at the IPv6 networking subsystem.

Next I tried to see if it was NetScanTools failing or something deeper. So I tried using command line "ping -6 ipv6.google.com". This failed with a message effectively admitting that it couldn't resolve the hostname to an IPv6. Good - sort of. Next I tried the other way doing a "ping -6 2001:4860:b006::69". That came back with even more ominous wording "Ping transmit failed. General Failure.". But I could use both command line ping and NetScanTools Pro IPv6 Ping to contact Link-Local IPv6 addresses on my local network - as I should be able to do. The IPv6 routing table didn't yield any real clues either.

Using both NetScanTools Pro, ipconfig and various netsh command line things I was able to see that while isatap was active, I was not seeing teredo - I had seen it before when using command line ping and when using NetScanTools Pro. Teredo was what I wanted to try decoding with Wireshark. NetScanTools Pro showed me that Teredo was there but it had an admin status of 'Down'. So I tried various netsh commands to reactivate Teredo. They all appeared to work, but Teredo never reappeared in the list of hidden devices in Device Manager. I tried the solutions floating around on the internet for making sure IPv6 was active and getting Teredo to show up in Device Manager, but still no luck.

A little history might help. I had recently installed VMware Workstation 7.1.4 on that machine because it's a test machine and I needed lots of OS's available. Could it be that? I don't know for sure because I spent time on VMware forums looking for similar problems - but didn't see any. It could have been a Windows Update patch that turned off Teredo, but I just don't know for sure. The two VMware Virtual Ethernet Adapters both had link-local fe80 IPv6 addresses, so IPv6 wasn't entirely dead. AND of all things, I could start Windows Server 2008 in a virtual machine with all of it's IPv6 functions working perfectly including NetScanTools Pro. I did find this page dealing with firewall settings for Teredo and found that everything was OK: http://support.microsoft.com/kb/968510

So today I spent lots of time with the netsh commands. I used "netsh interface IP show config" to see all the interfaces similar to ipconfig. By doing a "netsh interface ipv6 show interface" I could see all the active connections. What was missing was Teredo. I used "netsh interface set interface teredo set state default" to make sure it was there and it answered OK. But still no Teredo. Then I found this interesting command "netsh interface IPv6 show teredo". It said the State was 'offline' and the Error value was "client is in a managed network". Progress. Big progress.

So I put that error string into google and found a reference to this blog: http://blogs.msdn.com/b/p2p/archive/2007/03/22/teredo-and-the-pnrp-global-cloud.aspx
Essentially Teredo detected (incorrectly) that the machine was in a corporate environment - this is probably due to multiple OS's and several switches being active with all their chatter. So the fix was to use "Netsh interface teredo set state enterpriseclient". Once I did that, there was no need for rebooting or anything. "netsh interface IPv6 show teredo" now showed the correct info like Local Mapping and External NAT Mapping. And all of a sudden both command line ping and NetScanTools Pro IPv6 enabled tools began to work again.

I guess the thing that bugs me is this: why is there this huge dependency on Teredo for IPv6 in Windows 7? If I ask for a name resolution using getaddrinfo with a hint of AF_INET6 I EXPECT a response if AAAA records are coming back from the default dhcp assigned system DNS. It shouldn't matter that IPv6 is fully enabled on the system using Teredo or anything else. So my workaround will be to write EXTRA CODE to resend an AAAA or PTR record request from my own private resolver on failure of getaddrinfo because I can't trust it. I hope someone at Microsoft reads this and helps me understand why it was behaving this way.

All I wanted to do was try to decode Teredo traffic with Wireshark...

Kirk Thomas
NetScanTools Developer and Sharkfest '11 attendee

Managed Switch Port Mapping Tool v1.99.4

On June 9 we released the latest version of the Managed Switch Port Mapping Tool. It addressed an ongoing problem we had been having with Side by Side DLL configurations - we switched to static linking to eliminate this nagging problem. We also fixed a problem that usually only showed up if you were using a low color resolution screen such as when you run the program using Remote Desktop. If you viewed the About information on low color resolution, it would crash - it no longer does that. We also tested the software successfully with HP ProCurve 1810G-8 Switch running their new p2.2 firmware and made a minor change that allows mapping of older Enterasys Cabletron switches. In keeping with current conventions and the changes made in NetScanTools Pro v11, the word Setup was replaced with Settings throughout the program.

Please visit http://www.switchportmapper.com/ to download the free 30 trial. If you need a trial period reset code, please contact our sales dept.

Kirk

ipPulse 1.80 mentioned in the press

On May 16, TMCnet published an article about our recent release of ipPulse 1.80:

http://ipcommunications.tmcnet.com/topics/ip-communications/articles/175157-ippulse-version-180-simplifies-monitoring-ipv4-connected-devices.htm

Thanks to Mini Swamy, a contributing editor for TMCnet.

Kevin Beaver Review of NetScanTools Pro v11

Kevin Beaver, the author of Hacking for Dummies , did a nice review of NetScanTools Pro v11 today. It's here on his blog:

http://securityonwheels.blogspot.com/2011/05/if-you-dont-have-netscantools-pro-v11.html

Thanks Kevin! You can follow Kevin on twitter@kevinbeaver