○ Executing commands remotely

RDP - Remote Desktop Protocol is a great resource to remotely administer a computer, TightVNC or UltraVNC also are great resources, that have their advantages in comparison with RDP, but sometimes we just want a remote command-line solution so that there is no interferance with what users using that remote machine are doing.

There are two solutions for this, the first one is to use the wmic command with the help of the Win32_Process class:

wmic /USER:Domain\user /PASSWORD:pass /NODE:"computer" process call create cmd.exe

If you get "Invalid global switch" error check to see if your computer name is within quotes and USER, PASSWORD and NODE are UPPERCASE letters otherwise it won't work ( it didn't when i tried )

The other solution is to use sysinternals pstools, namely, psexec. This tool is a must for any network administrator, usage would be something like:

c:\> psexec \\machine -u domain\user -p pass command

where machine is the machine name, use quotes if it's something like "Desk-NR-1"

where pass is the password for the domain\user

where command is the command line you would write if you where on the other computer, for total command line freedom use "cmd" as the command to have the remote command line on your computer.

Thank you for reading

○ Updating Panda Client from a migrated Server

If you have migrated your AV Server, in other words your Admin Secure Console to another server, but now your clients are still pointing to the old server, you have to redistribute the client to the several worksations. To do this, you will have to go to:

Tools -> Distribute Agents (or similar) -> Troubleshoot Distribute Agents

Then a wizard pops up guiding you on the method for rearranging these broked clients.

Rearranging clients may take a while so be patient. Beware tough, port 19226 needs to be opened from the server to the client.

To make sure you don't have this port blocked do a telnet to any client on this port using the command line:

telnet client 19226

Where client is the computer name of a Panda client in your network.

If the command line window shows a blinking dash the port is not blocked and you should be Ok.

Taken from http://netprobe.blogspot.com/2009/11/updating-panda-client-from-migrated.html

○ Unauthorized or Illegal IP Public IP Addresses on Private Network

Yes, they are out there on private networks. Luckily, routers do not route these packets outwards because they already know the interfaces to which those Illegal IP's are.

I say illegal but they are only illegal from an RFC point of view.

I remember a while back trying to look for information about these RFC illegal networks but not finding anything relevant.

I have been on a company that had been implemented with this scenario. They had IP from 190.1.X.X to 190.5.X.X . Even worst these were class B IP Addresses for a small to medium sized company with just over 100 employees.

What happened in theses cases was that altough the routers were routing correctly, the DNS Servers were getting their entries for the local domain hosts from the internet. So, depending on which hostname would register with the Internet's cached DNS, this host could not be reached from another by it's DNS name. Fortunely, NETBios was still in tha game and allowed other computers to ping and whatever to those trough their NetBios name. Nevertheless, caotic in my opinion. Useless to say that any computer in this network could not access outsite resources when these resource IP's were within these Class B ranges. What a mess, like it was not enough datacenter's switch wiring was all messed up as well.
Funny example:

A big restructuring for this network topology was issued some time later which i was a part of to deploy VLAN's and reformulate the entire infrastructure, from Class B to Class C and from Illegal to Legal Addresses ( Reserved Addresses for Private Networking ). Big adventure i tell you, but definitely payed off. Much better.

○ SMI2SMIR Information / Purpose

I will assume that if you got here you already understand "computer systems terminology" so i won't get into detailed explanations, but will just write here what i know about this. To make things brief, SMI2SMIR is a WMI partial dependency. There is a script from microsoft, the WMDiag.vbs, that allows you to check if WMI is properly installed on a given computer. If you run WMDiag.vbs on a computer with SMI2SMIR missing you will be given the following lines on the resulting log:

WARNING: WMI System file 'C:\WINDOWS\SYSTEM32\WBEM\SMI2SMIR.EXE' is MISSING or is access DENIED but it is an OPTIONAL component.

So, altought it's part of WMI, as it is not a must, you could still query a remote machine for info.

For more information:

http://technet.microsoft.com/en-us/library/cc180795.aspx

Thank you for reading

Taken from http://netprobe.blogspot.com/2009/06/smi2smir-information-purpose.html

#139 NetBios Network Scan

One of my favorite apps to scan networks for shared resources is this Netbrute application. Free, quick and dirty. There are others but i use this for so long and it's so practical ( with just half a KB) that i have never forget about it. The portscan tab does not allow you to add ports to the port list for full port scans, and the Webbrute tab is usefull to check http server responses but besides that i don't use it for anything else. It's still a very nice application tough.

๑ Simple ideas to help identify devices on a network

I will begin this post by recommending the Solarwinds free tool IP Address Tracker that helps you to scan, track, and consolidate your IP address network information in one easy place.

On a medium sized network, some devices may not present you much information, and when in doubt about a particular ip address you can see if port #139 (netbios-ssn) is opened using a very neat app called NetBrute.

If it is, probably it is a computer and is sharing it's local resources, folders and printers over the network. For further inspection, you can try this address on your windows explorer address bar:

\\ipadress\c$

If you have domain administrator rights and that ip address is on your domain you can check what users are using that computer via C:\documents and settings\ folder.

If that doesn't work probably port 139 is closed, and it may be a printer device. Usually tough, printers configuration page is set trough http service so port #80 should be opened and http:\\idadress should lead you to that configuration page where you can see the printers name.

.Usually large printers however have another way to communicate their info trough the SNMP protocol. There are SNMP explorer apps out there that basically scan your network using a community string to fetch information about the various SNMP devices present on your network. Solarwinds for instance provides such tools.

.SNMP is not present in printers only, Cisco Switches, routers, hubs and bridges also use SNMP protocol to show and manage network information. SNMP is A MUST to obtain immediate states from your devices, for instance, if you want to see if the printer is printing anything in that right instance SNMP is the protocol to communicate to. I'm planning on writing a simple article about SNMP soon, demystifying it, as in general info. about SNMP is somehow mystified, i think.

Another protocol of interest, or maybe i should say service in this case, is the windows management instrumentation (WMI) that computer systems with windows operating systems from Windows NT 4.0 SP4 forward have, is a great tool to send information about computers using WMI Classes.

Thanks for reading

๑ What is the purpose of the port # 5002 ?

Ports are like bridges between the physical network and applications/services on the computer. It's a way for the computer to know what type of data is destined to what service. TCP/IP packets contain information for what port that information is sent. There are several of well known ports out there. The Well Known Ports are those from 0 through 1023. For a list of well known and not well known ports and it's associations check here

As you can see this 5002 port is not even in that wikipedia page so it is definitely a not well known port.

Information about this port and it's purpose is almost unvailable, so i tought i would write something about it as best as i can. The port 5002 is associated with the RFE service, so this is where this discussion will lean.

What's the purpose of the RFE service or what's the RFE for?

RFE stands for Radio Free Ethernet and it was projected on early 90's. It's based on a UDP port meaning that the it isn't connection oriented ( errors have to be managed on the application side ) Here's a quick def:

"Radio Free Ethernet (RFE) is a network audio broadcasting system. It consists of programs and tools that allow packets of audio data to be transmitted around a network. The system is best understood by using the analogy of traditional radio broadcasting"


NETWORK IMPLEMENTATION

Radio Free Ethernet can be configured to broadcast data either in UDP Broadcast packets or using IP Multicasting. These techniques differ in subtle but important ways.

UDP Broadcast packets are broadcast only within the local subnetwork. Network gateway routers do not forward these packets to other networks. When a UDP Broadcast packet is issued, every machine on the subnet receives the packet and discards it, unless a program is specifically registered to listen for that particular packet type. Though the overhead of processing such packets is small, it is normally considered unfriendly to issue many UDP Broadcast packets on a network (RFE normally broadcasts approximately eight packets per second, each containing around 1000 bytes). UDP Broadcast is available for the time being only because older versions of the operating system do not support IP Multicast.

IP Multicasting is an improvement over broadcast techniques. By sending network packets to a particular well-known multicast address, only machines that have registered interest in that address will receive the data (packet filtering is usually performed in the network interface hardware). Some experimental IP routers exist that will forward multicast packets to other networks. Such forwarding is only performed when there is a listener on the destination network, and when the packet itself is identified as forwardable.

In order for Radio Free Ethernet to function properly, the following entry should be present in the NIS hosts map:


RadioFreeEthernet 224.0.3.255 # IP Multicast address


For more information check this hard to find link:

http://docs.sun.com/app/docs/doc/805-3178/6j31hi8kq?a=view