Skip to content
Menu
e-lo [IT Engineer life]
  • Home
    • Note
  • Database
    • T-SQL
    • SQL Server quick
    • SQL server docs
    • MySql quick sheet
    • Postgre
    • InfluxDB
  • Programming
    • MS Azure Powershell
    • MS Azure Command-Line Interface (CLI) doc
    • Python Docs
    • Python Logging
    • Python-cheat-sheet
    • Git-guide
  • Azure
    • MS Windows virtual machines in Azure
    • MS ARM Docs
    • MS ARM Template Docs
    • MS ARM Functions
    • MS Bicep+ARM
    • MS ARM Tutorial
    • MS Deployment scripts (intern/extern)
    • MS Virtual Network
  • Az-nutshell
    • ms-technology-choices-compute-decision-tree
    • ms-data-store-decision-tree
    • ms-data-explorer
    • ms-storage-explorer
    • ms-azure-sql
    • ms-common-data-services
    • ms-azure-mysql-daas
    • ms-sla
    • az paas
    • az glossary-quicksheet
    • az-test-vm-script-quickguide
  • Linux
    • Top CMD’s
    • Useful CMD Linux
    • ss64 Linux
    • Ubuntu
    • 30 things Ubuntu 18.04
    • Bootable Ubuntu USB
    • LinuxFilesystemTreeOverview
  • Sys Admin
    • System Administrator
    • Sys News
  • Zen
    • Not thinking about anything is Zen
e-lo [IT Engineer life]

Capture traffic wireshark

Posted on May 28, 2021June 11, 2021 by espenk

Stuck on robocopy with errors like

System error 64 has occurred or 53?

What protocol is your system really running robocopy in?

Smb, smb1, smb2/3

https://docs.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3

Even if Test-NetConnection (pshell) returns true does not mean that everything is ok, especially if you specified paloalto application like xxx-smbv3 when it is actually something else… smb1 or 2…..

Test-NetConnection -Computer ip -Port

Download

https://www.wireshark.org/

Do the following to capture the traffic:

Step1 with pshell (on the vm that runs the robocopy script):

netsh trace start persistent=yes capture=yes tracefile=C:\temp\nettrace_capture1.etl

Step2 (on the vm that runs the robocopy script):
run robocopy file or cmd or what ever

Step3 with pshell (on the vm that runs the robocopy script):

Netsh trace stop

Step4:
View the logs file for information about protocol that robocopy is trying to use, 2 or 3 or?

Make correct format for the files

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/converting-etl-files-to-pcap-files/ba-p/1133297

tool to make output file

Etl2pcapng.exe file.etl newfile.pcapng 

https://github.com/microsoft/etl2pcapng/releases

Open log with wireshark, filter on ip.addr == 8.8.8.8 (remote ip where to files is stored and to be copied from)

https://en.wikiversity.org/wiki/Wireshark/Display_filter

Filter, the first is no filter, the second is only for tcp,third udp, fourth tls, fifth ip.addr and the last is showing all filters that starts with sm, hence smb, sm2 and so on. There is a suggestion if you start to type inside there, great or what…

Scenario;

on-prem win server 2016 robocopy from local to remote az win server 2019 was ok

from az win server 2019 robocopy and fetch data from on-prem winserver 2016 was not ok due to smb3 was defined in paloalto, but wireshark detected smb2 (had a running system with application protocol any and tcp 445 used for trace) and not smb3.

Wireshark User’s Guide

RSS Azure

  • Scale your cloud-native apps and accelerate app modernization with Azure, the best cloud for your apps May 24, 2022

RSS RabbitMQ

  • RabbitMQ 3.8.15 release

RSS Python

  • PEP 691: JSON-based Simple API for Python Package Indexes May 4, 2022

Tags

5 min (26) Ansible (1) ARM (10) azure (40) cmd (3) Django (4) Docker (1) e-lo (2) Flask (2) Github (9) Grafana (2) Information (7) Information Retrieval (13) JAVA (1) kivy (2) Kotlin (6) linux (15) mobile (2) Natural Language Prossesing (NLP) (2) Net.Core (1) Networking and Security (6) OPC (2) PEP8 (1) Philosophy (3) Python (47) Python Networking and Security (5) Reason (2) RMQ (3) Solr (11) Sql (10) Uncategorized (2) VSC (1) Warframe (2) WMVARE (4) Zabbix (7)

Recent Posts

  • 5 min Logic App Storage Table
  • 5 min Logic App PSQL
  • 5 min Logic App
  • 5 MIN Azure Data Explorer
  • TODO Build a Hash Table in Python With TDD Real Python

Archives

Meta

  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org

Photo by Markus Spiske from Pexels "Matrix"

©2022 e-lo [IT Engineer life] | Powered by WordPress & Superb Themes