Windows netsh networking - Revision history

Pio2pio: /* Firewall */

2019-01-10T19:46:04Z

Firewall

← Older revision		Revision as of 21:46, 10 January 2019
Line 56:		Line 56:
	;ICMP rules		;ICMP rules
	<syntaxhighlightjs lang=powershell>		<syntaxhighlightjs lang=powershell>
			netsh advfirewall firewall add rule name="ICMP allow ingress ipv4 echo-requests" protocol=icmpv4:8,any dir=in action=allow #or block
			netsh advfirewall firewall delete rule name="ICMP allow ingress ipv4 echo-requests" protocol=icmpv4:8,any dir=in
	netsh firewall set icmpsetting 8 enable #or disable		netsh firewall set icmpsetting 8 enable #or disable
	~~netsh advfirewall firewall add rule name="ICMP Allow ingress ipv4 echo-requests" protocol=icmpv4:8,any dir=in action=allow #or block~~
	~~netsh advfirewall firewall <span style="color: green">delete</span> rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in~~

			netsh advfirewall firewall add rule name="All ICMP V4" protocol=icmpv4:any,any dir=in action=allow
	netsh firewall set icmpsetting type=ALL mode=enable		netsh firewall set icmpsetting type=ALL mode=enable
	~~netsh advfirewall firewall add rule name="All ICMP V4" protocol=icmpv4:any,any dir=in action=allow~~

			netsh advfirewall firewall add rule name="Block Type 13 ICMP V4" protocol=icmpv4:13,any dir=in action=block
	netsh firewall set icmpsetting 13 disable all		netsh firewall set icmpsetting 13 disable all
	~~netsh advfirewall firewall add rule name="Block Type 13 ICMP V4" protocol=icmpv4:13,any dir=in action=block~~
	</syntaxhighlightjs>		</syntaxhighlightjs>

Pio2pio: /* Firewall */

2019-01-10T19:43:52Z

Firewall

← Older revision		Revision as of 21:43, 10 January 2019
Line 33:		Line 33:

	= Firewall =		= Firewall =
	<tt>netsh firewall</tt> command has been deprecated in Windows Server 2012 in favour of a new command <tt>netsh advfirewall firewall</tt>.		<code>netsh firewall</code> command has been deprecated in Windows Server 2012 in favour of a new command <code>netsh advfirewall firewall</code>.
			<syntaxhighlightjs lang=powershell>
			#Add new rule
			netsh advfirewall firewall add rule name="Open port :80" dir=in action=allow protocol=TCP localport=80

	Show all rules		#Show all rules
			netsh advfirewall firewall show rule name=all

	~~<code>~~netsh advfirewall ~~firewall show rule name=all</code>~~		#Enable/disable firewall
			netsh advfirewall set allprofiles state on

	~~Enable/disable~~ firewall		#Reset a firewall to defaults
			netsh advfirewall reset

	~~<code>~~netsh advfirewall set ~~allprofiles state on</code>~~		#Change FW default log file from c:\Windows\system32\LogFiles\Firewall\pfirewall.log to c:\temp directory
			netsh advfirewall set currentprofile logging filename "C:\temp\pfirewall.log"

	~~Reset a firewall to defaults~~		#Export / import FW settings
			netsh advfirewall export "C:\temp\WFconfiguration.wfw"
			</syntaxhighlightjs>

	<~~code~~>netsh advfirewall ~~reset~~</~~code~~>		;ICMP rules
			<syntaxhighlightjs lang=powershell>
			netsh firewall set icmpsetting 8 enable #or disable
			netsh advfirewall firewall add rule name="ICMP Allow ingress ipv4 echo-requests" protocol=icmpv4:8,any dir=in action=allow #or block
			netsh advfirewall firewall <span style="color: green">delete</span> rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in

	~~Set firewall log file from default <tt>\Windows\system32\LogFiles\Firewall\pfirewall.log</tt> to eg. <tt>C:\temp directory</tt>~~		netsh firewall set icmpsetting type=ALL mode=enable
			netsh advfirewall firewall add rule name="All ICMP V4" protocol=icmpv4:any,any dir=in action=allow
	~~<code>netsh advfirewall set currentprofile logging filename "C:\temp\pfirewall.log"</code>~~

	~~Export / import FW settings~~

	~~<code>netsh advfirewall export "C:\temp\WFconfiguration.wfw"</code>~~

	~~== ICMP settings ==~~
	~~netsh firewall set icmpsetting 8 <span style="color: green">enable\|disable</span>~~
	~~netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=<span style="color: green">allow\|block</span>~~
	~~netsh advfirewall firewall <span style="color: green">delete</span> rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in~~

	netsh firewall set icmpsetting type=ALL mode=enable
	netsh advfirewall firewall add rule name="All ICMP V4" protocol=icmpv4:any,any dir=in action=allow

	netsh firewall set icmpsetting 13 disable all		netsh firewall set icmpsetting 13 disable all
	netsh advfirewall firewall add rule name="Block Type 13 ICMP V4" protocol=icmpv4:13,any dir=in action=block		netsh advfirewall firewall add rule name="Block Type 13 ICMP V4" protocol=icmpv4:13,any dir=in action=block
			</syntaxhighlightjs>

	= Tracing =		= Tracing =

Pio2pio: /* Set IPv4 address */

2015-12-13T17:18:27Z

Set IPv4 address

← Older revision		Revision as of 19:18, 13 December 2015
Line 6:		Line 6:

	== Set IPv4 address ==		== Set IPv4 address ==
	netsh interface ip set address "Ethernet" static '''~~hostipaddress~~''' 255.255.255.0 '''hostgatewayaddress'''		netsh interface ip set address "Ethernet" static '''hostipaddre''' 255.255.255.0 '''hostgatewayaddress'''
	netsh interface ip set address "Ethernet" static 10.50.10.41 255.255.255.0 10.50.41.1		netsh interface ip set address "Ethernet" static 10.50.10.41 255.255.255.0 10.50.41.1

Pio2pio: /* Tracing */

2015-12-13T17:16:28Z

Tracing

← Older revision		Revision as of 19:16, 13 December 2015
Line 73:		Line 73:
	IPConfig /FlushDNS #clear DNS name cache		IPConfig /FlushDNS #clear DNS name cache
	NBTStat -R #clear NetBIOS name cache		NBTStat -R #clear NetBIOS name cache
			#Capture all traffic using NetConnection scenario, network connection diagnostics
	Netsh trace start scenario=NetConnection capture=yes report=yes persistent=no maxsize=2024 correlation=yes traceFile=C:\Logs\NetTrace.etl		Netsh trace start scenario=NetConnection capture=yes report=yes persistent=no maxsize=2024 correlation=yes traceFile=C:\Logs\NetTrace.etl
	netsh trace stop		netsh trace stop

Pio2pio: /* Tracing */

2015-12-13T17:09:41Z

Tracing

← Older revision		Revision as of 19:09, 13 December 2015
Line 69:		Line 69:
	OS: Windows 7, Windows Server 2008 and newer		OS: Windows 7, Windows Server 2008 and newer
	netsh trace help		netsh trace help
	netsh trace show capturefilterhelp #~~details and~~ examples		netsh trace show capturefilterhelp #capture filter examples
			netsh trace show status
	IPConfig /FlushDNS #clear DNS name cache		IPConfig /FlushDNS #clear DNS name cache
	NBTStat -R #clear NetBIOS name cache		NBTStat -R #clear NetBIOS name cache
	Netsh trace start scenario=NetConnection capture=yes report=yes persistent=no maxsize=~~1024~~ correlation=yes traceFile=C:\Logs\NetTrace.etl		Netsh trace start scenario=NetConnection capture=yes report=yes persistent=no maxsize=2024 correlation=yes traceFile=C:\Logs\NetTrace.etl
	netsh trace stop		netsh trace stop

			;Capture from a IP interface
			<source lang=bash>
			netsh trace start scenario=NetConnection capture=yes report=yes persistent=no maxsize=2024 correlation=yes traceFile=C:\Logs\NetTrace.etl Ethernet.Type=IPv4 IPv4.Address=192.168.1.142

			netsh trace start capture=yes Ethernet.Type=IPv4 IPv4.Address=192.168.1.142 traceFile=C:\Logs\NetTrace2.etl
			</source>
			Start Powershell script to capture that only contains traffic between the local system and two remote IP addresses (10.0.2.1 and 10.0.3.1). Note the Local IP address is found using Get-NetIPAddress and looking for a NIC named Virtual. Use <tt>route print -4</tt> to list interfaces name.
			<source lang=powershell>
			$filename = "c:\logs\${env:computername}_netsh_trace.etl"
			$IPs = "({0},10.0.2.1,10.0.3.1)" -f (Get-NetIPAddress -AddressFamily IPv4 -InterfaceAlias Virtual).IPAddress
			netsh trace start capture=yes tracefile=$filename maxsize=2048 filemode=circular overwrite=yes report=no correlation=no IPv4.SourceAddress=$IPs IPv4.DestinationAddress=$IPs Ethernet.Type=IPv4
			</source>

	== Analysing ==		== Analysing ==
	Install Microsoft's Message Analyzer app that can read ETL format http://www.microsoft.com/en-us/download/details.aspx?id=44226		Install Microsoft's Message Analyzer app that can read ETL format http://www.microsoft.com/en-us/download/details.aspx?id=44226

	Convert ETL to PCAP using a PowerShell script (not tested) or use save as... in Message ~~Analizer~~		Convert ETL to PCAP using a PowerShell script (not tested) or use save as... in Message Analiser
			<source lang=powershell>
	$s = New-PefTraceSession -Path “C:\output\path\spec\OutFile.Cap” -SaveOnStop		$s = New-PefTraceSession -Path “C:\output\path\spec\OutFile.Cap” -SaveOnStop
	$s \| Add-PefMessageProvider -Provider “C:\input\path\spec\Input.etl”		$s \| Add-PefMessageProvider -Provider “C:\input\path\spec\Input.etl”
	$s \| Start-PefTraceSession		$s \| Start-PefTraceSession
			</source>

	= References =		= References =

Pio2pio: /* Tracing */

2015-12-13T15:42:17Z

Tracing

← Older revision		Revision as of 17:42, 13 December 2015
Line 67:		Line 67:

	= Tracing =		= Tracing =
			OS: Windows 7, Windows Server 2008 and newer
			netsh trace help
			netsh trace show capturefilterhelp #details and examples
			IPConfig /FlushDNS #clear DNS name cache
			NBTStat -R #clear NetBIOS name cache
			Netsh trace start scenario=NetConnection capture=yes report=yes persistent=no maxsize=1024 correlation=yes traceFile=C:\Logs\NetTrace.etl
			netsh trace stop

			== Analysing ==
			Install Microsoft's Message Analyzer app that can read ETL format http://www.microsoft.com/en-us/download/details.aspx?id=44226

			Convert ETL to PCAP using a PowerShell script (not tested) or use save as... in Message Analizer
			$s = New-PefTraceSession -Path “C:\output\path\spec\OutFile.Cap” -SaveOnStop
			$s \| Add-PefMessageProvider -Provider “C:\input\path\spec\Input.etl”
			$s \| Start-PefTraceSession

	= References =		= References =

Pio2pio: /* References */

2015-12-13T14:32:26Z

References

← Older revision		Revision as of 16:32, 13 December 2015
Line 70:		Line 70:

	= References =		= References =
	[https://isc.sans.edu/forums/diary/No+Wireshark+No+TCPDump+No+Problem/19409/ Netsh tracing] isc.sans.edu		*[https://isc.sans.edu/forums/diary/No+Wireshark+No+TCPDump+No+Problem/19409/ Netsh tracing] isc.sans.edu
			*[http://blogs.technet.com/b/yongrhee/archive/2012/12/01/network-tracing-packet-sniffing-built-in-to-windows-server-2008-r2-and-windows-server-2012.aspx Network tracing (packet sniffing)] built-in to Windows Clients (7,8,8.1,10) and Windows Server (2008 R2, 2012, 2012 R2

	[[Category:Windows]]		[[Category:Windows]]

Pio2pio: /* Check wireless card band capability - 2.4Ghz or 5Ghz */

2015-12-13T13:56:26Z

Check wireless card band capability - 2.4Ghz or 5Ghz

@@ Line 31: / Line 31: @@
 *The network adapter supports network modes 802.11n and 802.11g and 802.11b:
 **The computer has 2.4GHz network capability ONLY & IS NOT Dual-Band Capable.
 = Tracing =

Pio2pio: /* References */

2015-12-13T12:46:37Z

References

← Older revision		Revision as of 14:46, 13 December 2015
Line 31:		Line 31:
	*The network adapter supports network modes 802.11n and 802.11g and 802.11b:		*The network adapter supports network modes 802.11n and 802.11g and 802.11b:
	**The computer has 2.4GHz network capability ONLY & IS NOT Dual-Band Capable.		**The computer has 2.4GHz network capability ONLY & IS NOT Dual-Band Capable.

			= Tracing =


	= References =		= References =
			[https://isc.sans.edu/forums/diary/No+Wireshark+No+TCPDump+No+Problem/19409/ Netsh tracing] isc.sans.edu
	[[Category:Windows]]		[[Category:Windows]]

Pio2pio: /* Check wireless card band capability - 2.4Ghz or 5Ghz */

2015-12-13T12:32:08Z

Check wireless card band capability - 2.4Ghz or 5Ghz

← Older revision		Revision as of 14:32, 13 December 2015
Line 22:		Line 22:

	== Check wireless card band capability - 2.4Ghz or 5Ghz ==		== Check wireless card band capability - 2.4Ghz or 5Ghz ==
			OS: Windows 7, not recognized on W2012R2 Data Center
	netsh wlan show drivers		netsh wlan show drivers
	[[File:Netsh-wlan-bands.PNG\|none\|left\|Netsh-wlan-bands]]		[[File:Netsh-wlan-bands.PNG\|none\|left\|Netsh-wlan-bands]]