Wireshark

[blackbelt3677]

Logging into an NAE3520 this morning and could not get in like I usually do. So a coworker introduced me to wireshark. Worked great. Lots of info(too much) but caught the ip address. You can use on specific protocals like Bacnet or Modbus. Anythoughts on wireshark??

[digo]

Logging into an NAE3520 this morning and could not get in like I usually do. So a coworker introduced me to wireshark. Worked great. Lots of info(too much) but caught the ip address. You can use on specific protocals like Bacnet or Modbus. Anythoughts on wireshark??

very powerful network analyzer. known as ethereal prior to 2006 when the name was changed.
http://en.wikipedia.org/wiki/Wireshark

online wiki:
http://wiki.wireshark.org/

look for tutorials on youtube too

[berg2666]

I have found a network analyzer called "lookatlan".
It is not as detailed as wireshark but it looks at the IP network you are on and gives all the IP address' on that network.
Good for finding just the IP address and not all the other stuff you see with wireshark.

It has saved me a lot especially when the IT people do not know what a static IP address is and give you a IP address in there DHCP server scheme, not paying attetention.

Or when you have one of those NCE's that will not stay at a static IP and reverting to DHCP when you have a power failure with the Ethernet cable still hooked up.

Google it and the best route to get it is the download.com site.

Lookatlan.com is Italian
It has an english language version but not from the italian site.
Download.com lookatlan....

[blackbelt3677]

Cool I think Ill check it out. I am starting an NCE and NAE next week.

[willf650]

There is also a free tool called IP scan that one of the other techs found. You can set it for a range of IP address and it pings them to see if anything is out there. Sound similar to lookatlan .

[steves4]

Logging into an NAE3520 this morning and could not get in like I usually do. So a coworker introduced me to wireshark. Worked great. Lots of info(too much) but caught the ip address. You can use on specific protocals like Bacnet or Modbus. Anythoughts on wireshark??

We use it all the time. It's a very powerful tool.

[berg2666]

There is also a free tool called IP scan that one of the other techs found. You can set it for a range of IP address and it pings them to see if anything is out there. Sound similar to lookatlan .

It is very familiar to lookatlan and they do basically the same things, but remember when you are pinging an address and do not find anything, you must remember that there may be a device such a backup server, on that IP and it is not active when you do your ping/scan but comes online in the middle of the night.

[berg2666]

Cool I think Ill check it out. I am starting an NCE and NAE next week.

The issue with the NCE and reverting to DHCP is noted in FSC, not sure if it applies to NAE's

[digo]

There is also a free tool called IP scan that one of the other techs found. You can set it for a range of IP address and it pings them to see if anything is out there. Sound similar to lookatlan .

Angry IP Scanner
http://www.angryziber.com/w/Download

[smokeout]

I have also used Wireshark, very powerful and FREE!

[picnik]

I plugged my usb memory stick into a PC the other day and it kindly deleted my IPSCAN.EXE as it classed it as malware.

[osiyo]

I plugged my usb memory stick into a PC the other day and it kindly deleted my IPSCAN.EXE as it classed it as malware.

That is a problem one has to deal with these days.

Altho, I've never had a PC delete the file on a USB stick. It only stopped any effort to copy said file to the PC itself, or to launch it.

It can be a pain. Especially given that many virus scanners ID something as a virus or malware, which really is no such thing.

The problem often is that it is something that HAS been known to be used by a hacker in the past. Or it is an app that contains a DLL, or some included function(s) that have been used in a Virus or malware in the past.

Of course, this presents a problem in that many program functions, DLLs, resources, and such are used not only by hackers but also by legitimate programmers for legitimate apps.

Sometimes yah have no alternative except to switch which app you're using and go with one the anti-virus/anti-malware scanner on the PC does not object to. That is, unless you're in a position, with the authority and permissions necessary, to instruct the scanner to make an exception of that particular app.

But just because some particular anti-virus or anti-malware declared something to be a virus or malware, doesn't mean it really is.

I've had to call the Norton Anti-virus people before and tell em that their program was erroneously identifying something as a virus ... and it wasn't. Took a few days, but finally they adjusted their database to take that app off their banned list.