Microsoft Windows Sysinternals Suite with file, disk, network, process, security utilities

Hi Folks,

Today, i will give an overview of Microsoft Windows Sysinternals Suite.

This suite helps users and admins to troubleshoot the OS and devices.

Sysinternals Suite

The Suite is a bundling of the following selected Sysinternals Utilities: AccessChk, AccessEnum, AdExplorer, AdInsight, AdRestore, Autologon, Autoruns, BgInfo, BlueScreen, CacheSet, ClockRes, Contig, Coreinfo, Ctrl2Cap, DebugView, Desktops, Disk2vhd, DiskExt, DiskMon, DiskView, Disk Usage (DU), EFSDump, FindLinks, Handle, Hex2dec, Junction, LDMDump, ListDLLs, LiveKd, LoadOrder, LogonSessions, MoveFile, NotMyFault, NTFSInfo, PageDefrag, PendMoves, PipeList, PortMon, ProcDump, Process Explorer, Process Monitor, PsExec, PsFile, PsGetSid, PsInfo, PsKill, PsList, PsLoggedOn, PsLogList, PsPasswd, PsPing, PsService, PsShutdown, PsSuspend, PsTools, RAMMap, RegDelNull, RegHide, RegJump, Registry Usage (RU), SDelete, ShareEnum, ShellRunas, Sigcheck, Streams, Strings, Sync, Sysmon, TCPView, VMMap, VolumeID, WhoIs, WinObj, ZoomIt

Individual Utilities

If you want to use or explore individual utilities then please use the below links for navigation

1. File and Disk Utilities
2. Networking Utilities
3. Process Utilities
4. Security Utilities
5. System Information
6. Miscellaneous

My favorites

1. DiskMon - Disk monitor whenever read/write happens to hard disk
2. Disk2vhd - Convert your physical harddisk to Microsoft VHD (Virtual Hard Disk) format
3. TCPView - List the TCP and UDP ports usage with process name
4. Active Director Explorer - Advanced Active Directory (AD) viewer and editor
5. VMMap - Virutal and physical memory analysis utility

Hope, these tools will help you to troubleshoot and/or make use of official Microsoft utilities to explore OS more.

Please send your feedback and comments to psrdotcom@gmail.com

node server address in use error resolution for Windows and Linux machines

Hi friends,

Today, I have come across a situation, where my node server existed unproperly and address has been blocked. Because of which, I am unable to run the node server on the same port.

System configuration

Running my node server on port 3000.

Resolution

Windows Machine

We will first try to find whether the port has been still in listening mode.
> netstat -ano | find "LISTENING" | find "3000"
When the above command returns result then take the last number (Process ID)
We will kill the process with the following command.
> taskkill /f /pid

Linux Machine

> netstat -nlp | grep :3000
> kill -9

Now, you will be able to run the node server on the same port which has been blocked.

Please send your comments and feedback to psrdotcom@gmai.com

Windows: Find which port is getting used/mapped by which process/program with details from task manager

Hi friends,

Today, I have come across with a situation of finding the port-program mapping.

Procedure

• Open command prompt
• Enter the following command
• Syntax: netstat -aon | find ":"
• Example: netstat -aon | find ":80"
• Get the PID (Process Id) from the list

• Execute the following command
• Syntax: tasklist "PID eq "
• Example: tasklist "PID eq 9192"

Please send your queries and feedback to psrdotcom@gmail.com

Capture localhost (127.0.0.1) system packets using RawCap

Hi friends,

Today I am going to share the knowledge of capturing network packets in local system i.e. localhost.

Using RawCap utility, you can capture the loopback adapter packets which are our localhost packets.

Procedure

Download the RawCap.exe from Netresec website url
http://www.netresec.com/?page=RawCap
Once you download it
Open command prompt with administrator privileges
You have the following options while running the RawCap.exe

Syntax

RawCap.exe
-c <-> Stop capturing after the specified packet count reached
-f <-> Flush each packet without buffering
-s <-> Stop capturing after the specified time limit

Example 1:
RawCap.exe 127.0.0.1 dump.pcap
Note: Ctrl + C to stop the capturing

Example 2:
RawCap.exe -c 1000 127.0.0.1 dump.pcap
After 1000 packets, the capturing will stop

Please send your feedback and comments to psrdotcom@gmail.com

UDPCast, udp sender and udp receiver Sharing files over LAN/Wi-Fi

Hi admins,

Have you ever thought of sending files/folders to all your systems which are connected over LAN?
Have you ever thought of copying the entire partitions including OS to all your systems with same configuration which are connected over LAN in your lab?

You might be using some proprietary tools.

Let me share my knowledge of open source tools in Ubuntu to perform the job.

It is UDP Case with following operations

1. udp-sender
2. udp-receiver

Simple usage can be seen in References 2

References

https://www.udpcast.linux.lu/cmd.html
https://www.udpcast.linux.lu/cmdlinedoc.html

Please send your comments and feedback to psrdotcom@gmail.com

Finding IP address to MAC and vice versa on same network (subnet) or different subnet which is reachable by ping

Hi all,

After long time I got a chance to write the blog.

 

This time it is related to networking.

 

Finding out which all the system up on the network

Syntax

cmd> nmap –sP < regex IP >

Example

cmd> nmap –sP 192.168.1.*

 

Finding MAC address of a device which is connected in same network

Syntax

cmd> ping <broadcast address>

cmd> arp –a [ <IP address> ]

 

Example

cmd> ping 192.168.1.255

cmd> arp –a –> Gives all the IP address and MAC address in the same subnet network

cmd> arp –a 192.168.1.25 –> Give the MAC of the specified IP address

 

arp –a : Lists all the IP addresses which are recently got into network with its MAC addresses

 

Finding MAC address of a device which is connected in same network but different subnet

Syntax

nbtstat –A <IP address>

Example

nbtstat –A 192.168.2.45

 

Please send your comments and feedback to psrdotcom@gmail.com

Exploring the Network in Linux

Hi all,

Do you want to connect to your remote system in Linux?

With the root privilege in Linux type these commands to explore remote system.

1. #ssh root@IP
2. Enter the password of remote system.
3. Now you connected to remote system.
4. Explore it and even you can shutdown the remote system by just executing poweroff command in your system.

Source: Prashanth Venugopalan.Y (My M.Tech Classmate)