{"id":475,"date":"2008-07-10T06:30:34","date_gmt":"2008-07-10T14:30:34","guid":{"rendered":"http:\/\/www.sapien.com\/blog\/?p=475"},"modified":"2008-07-10T07:03:49","modified_gmt":"2008-07-10T15:03:49","slug":"get-packet","status":"publish","type":"post","link":"https:\/\/dev.sapien.com\/blog\/2008\/07\/10\/get-packet\/","title":{"rendered":"Get-Packet"},"content":{"rendered":"

A few days ago I blogged about packet sniffer PowerShell script<\/a>. Needless to say I was intrigued and spent some time dissecting to better understand it. Don’t worry, no PowerShell scripts were harmed during this operation. This is a nifty piece of PowerShell coding. Of course I’m never one to leave well enough alone so I had to add a few touches which I hope the original author doesn’t mind. You can download my version here<\/a><\/p>\n

First, the original script kept running unless you pressed Ctrl-C.  I made some slight modifications so that the script could end more gracefully.<\/p>\n

$ESCkey  = 27
\nWrite-Host "Press the ESC key to stop sniffing" -foregroundcolor "CYAN"
\n$Running=$true
\nWhile ($Running)
\n {
\n 
\n  if ($host.ui.RawUi.KeyAvailable) {
\n         $key = $host.ui.RawUI.ReadKey("NoEcho,IncludeKeyUp,IncludeKeyDown")
\n            if ($key.VirtualKeyCode -eq $ESCkey) {
\n             $Running=$False
\n            }
\n      }<\/code><\/p>\n

The main packet sniffing code is within the While loop. It will run until the Esc key is pressed. The ReadKey() method detects key strokes and if the VirtualKeyCode property equals the value for the Esc key, $Running is set to $False and the script will end. This makes it much easier to save output to a variable:<\/p>\n

PS C:\\$sniff=c:\\scripts\\get-packet.ps1<\/font><\/p>\n

I also added a timestamp property to the custom object so I could do time-related analysis later.<\/p>\n

$obj | Add-Member noteproperty Time (Get-Date)<\/code><\/p>\n

This property lets me do tasks like this which displays packet information with a timestamp value that includes milliseconds<\/p>\n

PS C:\\>$sniff [0..100] | Select @{Name="timeStamp";Expression={(new-timespan $_.time).ToString() }},Source,Destination,Protocol,*Port<\/font><\/p>\n

timeStamp   : 21:32:18.2082876
\nSource      : 207.46.236.102
\nDestination : 172.16.10.102
\nProtocol    : TCP
\nDestPort    : 50392
\nSourcePort  : 21 <\/font><\/p>\n

timeStamp   : 21:32:18.1892849
\nSource      : 207.46.236.102
\nDestination : 172.16.10.102
\nProtocol    : TCP
\nDestPort    : 50392
\nSourcePort  : 21 <\/font><\/p>\n

timeStamp   : 21:32:18.1642815
\nSource      : 207.46.236.102
\nDestination : 172.16.10.102
\nProtocol    : TCP
\nDestPort    : 50395
\nSourcePort  : 20<\/font><\/p>\n

I also made some slight changes to the original code for creating the custom object which is probably just a personal preference since the original worked just fine. The original was written as one long pipelined expression.  Personally I found it harder to troubleshoot.<\/p>\n

Once I’ve saved my trace to a variable, here are some things I can do with it. Depending on how long your trace ran, this variable could be quite large.<\/p>\n

PS C:\\> $sniff | sort protocol | group protocol | format-table Count,Name -autosize <\/font><\/p>\n

Count Name
\n—– —-
\n   42 ICMP
\n   17 IGMP
\n6496 TCP
\n  163 UDP<\/font><\/p>\n

PS C:\\> $sniff | sort SourcePort | group SourcePort | <\/font>sort count -descending |
\n>> Select -first 5 | format-table Count,Name -autosize
\n>>
\n<\/font>
\nCount Name
\n—- —-
\n5747 80
\n401 143
\n113 23
\n  93 53
\n  59 0<\/font><\/p>\n

If you have suggestions for enhancements or improvements, I’d love to hear them. Stay tuned to the blog as well.  I have an addition to this script that I think you’ll find interesting, at least I hope so.<\/p>\n

 <\/p>\n

While ($Running)
\n    {
\n     if ($host.ui.RawUi.KeyAvailable) {
\n         $key = $host.ui.RawUI.ReadKey("NoEcho,IncludeKeyUp,IncludeKeyDown")
\n            if ($key.VirtualKeyCode -eq $ESCkey) {
\n             $Running=$False
\n            }
\n      }<\/p>\n","protected":false},"excerpt":{"rendered":"

A few days ago I blogged about packet sniffer PowerShell script. Needless to say I was intrigued and spent some time dissecting to better understand it. Don’t worry, no PowerShell scripts were harmed during this operation. This is a nifty piece of PowerShell coding. Of course I’m never one to leave well enough alone so I had to add a few touches which I hope the original author doesn’t mind.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[25],"tags":[223,221,28,57,219],"class_list":["post-475","post","type-post","status-publish","format-standard","hentry","category-windows-powershell","tag-add-member","tag-network","tag-powershell","tag-scripting","tag-trace"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/475","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/comments?post=475"}],"version-history":[{"count":0,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/475\/revisions"}],"wp:attachment":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/media?parent=475"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/categories?post=475"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/tags?post=475"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}