Nothing Worse Than a Stale Tool

There is nothing more frustrating than picking up a tool only to find that you cant use it, or its not working as expected.

In this day and age, network tools have evolved to basic computers, running an operating system, memory, processor and software.

AirCheck™ SSID AP Troubleshooting

 

it is quite common to have several physical access points support the same SSID. Every vendor has its own way of handling handoffs and in most cases, it works pretty well. But what do you do when you suspect one access point is causing an issue?

I don’t care which operating system you are using; it is very difficult to select one physical access point to connect to. I should know, I tried for hours with Android and several Windows applications with no luck.

Nirsoft's WhoisConnected Review

 

Thought I would try out this nirsoft.net “who is connected utility” from www.nirsoft.net. I am a big fan of nirsoft because their utilities are specific, small, portable, no ads and support is responsive.

From the readme file

“WhoIsConnectedSniffer (https://www.nirsoft.net/utils/who_is_connected_sniffer.html) is a network discovery tool that listens to network packets on your network adapter using a capture driver (WinpCap or MS network monitor) and accumulates a list of computer and devices currently connected to your network. WhoIsConnectedSniffer uses various protocols to detect the computers connected to your network, including ARP, UDP, DHCP, mDNS, and BROWSER.

For every detected computer or device, the following information is displayed: (Some of the fields might be empty if the information cannot be found inside the packets) IP Address, MAC Address, name of the device/computer, description, Operating System, Network Adapter Company, IPv6 Address.

After collecting the connected computers/devices information, you can easily export the list to tab-delimited/comma-delimited/xml/html file.”

I wanted to see if the software truly listens or if it queries devices to determine more information. So I configured Wireshark with an IP address of a random device – a wireless router acting as an access point and was surprised to see that it send out a Browser Announcement and SMB Domain Enumeration. Why would it do this when I have no storage installed and no protocols configured?

A Black Box for Everything (Paul W. Smith)

 

In the aftermath of a plane crash, one of the first things the accident investigators look for is the flight recorder. Inaptly named the “black box”, it is neither a box, nor is it black – a very bright shade of red is much easier to locate. Recording on a virtual continuous loop, it presumably will have a record of events for the last critical moments of the flight.

Performance Testing; Network vs Storage

 I’m sure we’ll all been there; you are working on a ‘performance issue’ and another technician tells you, “I don’t know what the problem is, ping response time is fast and ping didn’t report any dropped packets.”

I’ve written and spoke about this before, but want to briefly cover my concerns surrounding ping. I will start with a simple statement that I am not ‘anti-ping’ and actually use it quite often. My concern is that I see it used in the wrong scenarios and its operation is widely misunderstood.

Things you should know about Microsoft’s ping command include that they are sent at a 1 second interval, uses ICMP as its protocol and neither option are configurable. Other default settings you can change are default payload size (-l), TTL (-i), disabling resolve to address (-a), setting do not fragment (-f) and forcing to just use IPv4 (-4).

I personally prefer to use hrping (https://www.cfos.de/en/ping/ping.htm) as an alternative to Microsoft’s ping since it has many more options and still a command line tool, even though hrping also provides a GUI interface as well. This utility can send UDP packets, send a ping size ‘sweep’ of various sizes, send ICMP timestamp requests, interval between packets as well as the same options as the Microsoft ping command.

In summary, I use ping to validate or verify if the network and hosts are responding and if there is general packet loss. If the ping test results in no packet loss and response time is acceptable, I test the client or server performance.

If you want to test network performance, nothing beats iperf3 (https://iperf.fr/) but if you want to test the file system, copying a file is the easiest test. I know, this isn’t the same as sending hundreds of transactions, etc. but it’s a great start. In this video I show you how I used a simple Powershell command (Measure-Command) to time how long it took to copy files to/from my server.

In this video, I show you how I used iperf and a power shell command to copy a file (both read/write) on two different shares to identify if the issue is file system or network related.

Microsoft Command line and Wireshark utilities

 

I get quite a few emails expressing frustration and confusion when people try some of the Windows Wireshark command line utilities like tshark, dumpcap and editcap to mention a few.

The main issue is that many times the Wireshark application folder is not in your path. There are many ways to get around it like

- Change drive and directory to the Wireshark application folder from within the command prompt

- The use full application path for the wireshark utility you are trying to run (ie c:\program files\Wireshark\tshark -D)

- Add the Wireshark application fold to your path – which is the one I will cover in the video

I prefer adding Wireshark to the path so I can type the command from any folder, anytime without having to worry about which folder I’m in as well as typing the fill path with the command.