Skip to content

Commit 1c36a2a

Browse files
padmagit77padmagit77
authored
Fix indentation in PowerShell script example
1 parent 7a1b185 commit 1c36a2a

File tree

1 file changed

+126
-126
lines changed

1 file changed

+126
-126
lines changed

‎ATADocs/validate-port-mirroring.md‎

Lines changed: 126 additions & 126 deletions
Original file line numberDiff line numberDiff line change
@@ -36,149 +36,149 @@ The following steps walk you through the process for validating that port mirror
3636
The script generates ICMP traffic from the ATA Gateway to the domain controller and looks for that traffic on the Capture NIC on the domain controller.
3737
If the ATA Gateway sees ICMP traffic with a destination IP address the same as the DC IP addressed you entered in the ATA Console, it deems port mirroring configured.
3838

39-
Sample for how to run the script:
40-
41-
```powershell
42-
# ATAdiag.ps1 -CaptureIP n.n.n.n -DCIP n.n.n.n -TestCount n
43-
param([parameter(Mandatory=$true)][string]$CaptureIP, [parameter(Mandatory=$true)][string]$DCIP, [int]$PingCount = 10)
44-
45-
# Set variables
46-
$ErrorActionPreference = "stop"
47-
$starttime = get-date
48-
$byteIn = new-object byte[] 4
49-
$byteOut = new-object byte[] 4
50-
$byteData = new-object byte[] 4096 # size of data
51-
52-
$byteIn[0] = 1 # for promiscuous mode
53-
$byteIn[1-3] = 0
54-
$byteOut[0-3] = 0
55-
56-
# Convert network data to host format
57-
function NetworkToHostUInt16 ($value)
58-
{
59-
[Array]::Reverse($value)
60-
[BitConverter]::ToUInt16($value,0)
61-
}
62-
function NetworkToHostUInt32 ($value)
63-
{
64-
[Array]::Reverse($value)
65-
[BitConverter]::ToUInt32($value,0)
66-
}
67-
function ByteToString ($value)
68-
{
69-
$AsciiEncoding = new-object system.text.asciiencoding
70-
$AsciiEncoding.GetString($value)
71-
}
72-
73-
Write-Host "Testing Port Mirroring..." -ForegroundColor Yellow
74-
Write-Host ""
75-
Write-Host "Here is a summary of the connection we will test." -ForegroundColor Yellow
76-
77-
# Initialize a first ping connection
78-
Test-Connection -Count 1 -ComputerName $DCIP -ea SilentlyContinue
79-
Write-Host ""
80-
Write-Host "Press any key to continue..." -ForegroundColor Red
81-
[void][System.Console]::ReadKey($true)
82-
Write-Host ""
83-
Write-Host "Sending ICMP and Capturing data..." -ForegroundColor Yellow
84-
85-
# Open a socket
86-
$socket = new-object system.net.sockets.socket([Net.Sockets.AddressFamily]::InterNetwork,[Net.Sockets.SocketType]::Raw,[Net.Sockets.ProtocolType]::IP)
87-
88-
# Include the IP header
89-
$socket.setsocketoption("IP","HeaderIncluded",$true)
90-
$socket.ReceiveBufferSize = 10000
91-
$ipendpoint = new-object system.net.ipendpoint([net.ipaddress]"$CaptureIP",0)
92-
$socket.bind($ipendpoint)
93-
94-
# Enable promiscuous mode
95-
[void]$socket.iocontrol([net.sockets.iocontrolcode]::ReceiveAll,$byteIn,$byteOut)
96-
97-
# Initialize test variables
98-
$tests = 0
99-
$TestResult = "Noise"
100-
$OneSuccess = 0
101-
102-
while ($tests -le $PingCount)
103-
{
104-
if (!$socket.Available) # see if any packets are in the queue
105-
{
106-
start-sleep -milliseconds 500
107-
continue
108-
}
39+
Sample for how to run the script:
10940

110-
# Capture traffic
111-
$rcv = $socket.receive($byteData,0,$byteData.length,[net.sockets.socketflags]::None)
41+
```powershell
42+
# ATAdiag.ps1 -CaptureIP n.n.n.n -DCIP n.n.n.n -TestCount n
43+
param([parameter(Mandatory=$true)][string]$CaptureIP, [parameter(Mandatory=$true)][string]$DCIP, [int]$PingCount = 10)
11244

113-
# Decode the header so we can read ICMP
114-
$MemoryStream = new-object System.IO.MemoryStream($byteData,0,$rcv)
115-
$BinaryReader = new-object System.IO.BinaryReader($MemoryStream)
45+
# Set variables
46+
$ErrorActionPreference = "stop"
47+
$starttime = get-date
48+
$byteIn = new-object byte[] 4
49+
$byteOut = new-object byte[] 4
50+
$byteData = new-object byte[] 4096 # size of data
11651

117-
# Set IP version & header length
118-
$VersionAndHeaderLength = $BinaryReader.ReadByte()
52+
$byteIn[0] = 1 # for promiscuous mode
53+
$byteIn[1-3] = 0
54+
$byteOut[0-3] = 0
11955

120-
# TOS
121-
$TypeOfService= $BinaryReader.ReadByte()
56+
# Convert network data to host format
57+
function NetworkToHostUInt16 ($value)
58+
{
59+
[Array]::Reverse($value)
60+
[BitConverter]::ToUInt16($value,0)
61+
}
62+
function NetworkToHostUInt32 ($value)
63+
{
64+
[Array]::Reverse($value)
65+
[BitConverter]::ToUInt32($value,0)
66+
}
67+
function ByteToString ($value)
68+
{
69+
$AsciiEncoding = new-object system.text.asciiencoding
70+
$AsciiEncoding.GetString($value)
71+
}
12272

123-
# More values, and the Protocol Number for ICMP traffic
124-
# Convert network format of big-endian to host format of little-endian
125-
$TotalLength = NetworkToHostUInt16 $BinaryReader.ReadBytes(2)
126-
$Identification = NetworkToHostUInt16 $BinaryReader.ReadBytes(2)
127-
$FlagsAndOffset = NetworkToHostUInt16 $BinaryReader.ReadBytes(2)
128-
$TTL = $BinaryReader.ReadByte()
129-
$ProtocolNumber = $BinaryReader.ReadByte()
130-
$Checksum = [Net.IPAddress]::NetworkToHostOrder($BinaryReader.ReadInt16())
73+
Write-Host "Testing Port Mirroring..." -ForegroundColor Yellow
74+
Write-Host ""
75+
Write-Host "Here is a summary of the connection we will test." -ForegroundColor Yellow
13176

132-
# The source and destination IP addresses
133-
$SourceIPAddress = $BinaryReader.ReadUInt32()
134-
$DestinationIPAddress = $BinaryReader.ReadUInt32()
77+
# Initialize a first ping connection
78+
Test-Connection -Count 1 -ComputerName $DCIP -ea SilentlyContinue
79+
Write-Host ""
80+
Write-Host "Press any key to continue..." -ForegroundColor Red
81+
[void][System.Console]::ReadKey($true)
82+
Write-Host ""
83+
Write-Host "Sending ICMP and Capturing data..." -ForegroundColor Yellow
13584

136-
# The source and destimation ports
137-
$sourcePort = [uint16]0
138-
$destPort = [uint16]0
85+
# Open a socket
86+
$socket = new-object system.net.sockets.socket([Net.Sockets.AddressFamily]::InterNetwork,[Net.Sockets.SocketType]::Raw,[Net.Sockets.ProtocolType]::IP)
13987

140-
# Close the stream reader
141-
$BinaryReader.Close()
142-
$memorystream.Close()
88+
# Include the IP header
89+
$socket.setsocketoption("IP","HeaderIncluded",$true)
90+
$socket.ReceiveBufferSize = 10000
91+
$ipendpoint = new-object system.net.ipendpoint([net.ipaddress]"$CaptureIP",0)
92+
$socket.bind($ipendpoint)
14393

144-
# Cast DCIP into an IPaddress type
145-
$DCIPP = [ipaddress] $DCIP
146-
$DestinationIPAddressP = [ipaddress] $DestinationIPAddress
94+
# Enable promiscuous mode
95+
[void]$socket.iocontrol([net.sockets.iocontrolcode]::ReceiveAll,$byteIn,$byteOut)
14796

148-
#Ping the DC at the end after starting the capture
149-
Test-Connection -Count 1 -ComputerName $DCIP -ea SilentlyContinue | Out-Null
97+
# Initialize test variables
98+
$tests = 0
99+
$TestResult = "Noise"
100+
$OneSuccess = 0
150101

151-
# This is the match logic - check to see if Destination IP from the Ping sent matches the DCIP entered by in the ATA Console
152-
# The only way the ATA Gateway should see a destination of the DC is if Port Spanning is configured
102+
while ($tests -le $PingCount)
103+
{
104+
if (!$socket.Available) # see if any packets are in the queue
105+
{
106+
start-sleep -milliseconds 500
107+
continue
108+
}
109+
110+
# Capture traffic
111+
$rcv = $socket.receive($byteData,0,$byteData.length,[net.sockets.socketflags]::None)
112+
113+
# Decode the header so we can read ICMP
114+
$MemoryStream = new-object System.IO.MemoryStream($byteData,0,$rcv)
115+
$BinaryReader = new-object System.IO.BinaryReader($MemoryStream)
116+
117+
# Set IP version & header length
118+
$VersionAndHeaderLength = $BinaryReader.ReadByte()
119+
120+
# TOS
121+
$TypeOfService= $BinaryReader.ReadByte()
122+
123+
# More values, and the Protocol Number for ICMP traffic
124+
# Convert network format of big-endian to host format of little-endian
125+
$TotalLength = NetworkToHostUInt16 $BinaryReader.ReadBytes(2)
126+
$Identification = NetworkToHostUInt16 $BinaryReader.ReadBytes(2)
127+
$FlagsAndOffset = NetworkToHostUInt16 $BinaryReader.ReadBytes(2)
128+
$TTL = $BinaryReader.ReadByte()
129+
$ProtocolNumber = $BinaryReader.ReadByte()
130+
$Checksum = [Net.IPAddress]::NetworkToHostOrder($BinaryReader.ReadInt16())
131+
132+
# The source and destination IP addresses
133+
$SourceIPAddress = $BinaryReader.ReadUInt32()
134+
$DestinationIPAddress = $BinaryReader.ReadUInt32()
135+
136+
# The source and destimation ports
137+
$sourcePort = [uint16]0
138+
$destPort = [uint16]0
139+
140+
# Close the stream reader
141+
$BinaryReader.Close()
142+
$memorystream.Close()
143+
144+
# Cast DCIP into an IPaddress type
145+
$DCIPP = [ipaddress] $DCIP
146+
$DestinationIPAddressP = [ipaddress] $DestinationIPAddress
147+
148+
#Ping the DC at the end after starting the capture
149+
Test-Connection -Count 1 -ComputerName $DCIP -ea SilentlyContinue | Out-Null
150+
151+
# This is the match logic - check to see if Destination IP from the Ping sent matches the DCIP entered by in the ATA Console
152+
# The only way the ATA Gateway should see a destination of the DC is if Port Spanning is configured
153+
154+
if ($DestinationIPAddressP -eq $DCIPP) # is the destination IP eq to the DC IP?
155+
{
156+
$TestResult = "Port Spanning success!"
157+
$OneSuccess = 1
158+
} else {
159+
$TestResult = "Noise"
160+
}
161+
162+
# Put source, destination, test result in Powershell object
163+
new-object psobject | add-member -pass noteproperty CaptureSource $([system.net.ipaddress]$SourceIPAddress) | add-member -pass noteproperty CaptureDestination $([system.net.ipaddress]$DestinationIPAddress) | Add-Member -pass NoteProperty Result $TestResult | Format-List | Out-Host
164+
#Count tests
165+
$tests ++
166+
}
153167

154-
if ($DestinationIPAddressP -eq $DCIPP) # is the destination IP eq to the DC IP?
168+
if ($OneSuccess -eq 1)
155169
{
156-
$TestResult = "Port Spanning success!"
157-
$OneSuccess = 1
170+
Write-Host "Port Spanning Success!" -ForegroundColor Green
171+
Write-Host ""
172+
Write-Host "At least one packet which was addressed to the DC, was picked up by the Gateway." -ForegroundColor Yellow
173+
Write-Host "A little noise is OK, but if you don't see a majority of successes, you might want to re-run." -ForegroundColor Yellow
158174
} else {
159-
$TestResult = "Noise"
175+
Write-Host "No joy, all noise. You may want to re-run, increase the number of Ping Counts, or check your config." -ForegroundColor Red
160176
}
161177

162-
# Put source, destination, test result in Powershell object
163-
new-object psobject | add-member -pass noteproperty CaptureSource $([system.net.ipaddress]$SourceIPAddress) | add-member -pass noteproperty CaptureDestination $([system.net.ipaddress]$DestinationIPAddress) | Add-Member -pass NoteProperty Result $TestResult | Format-List | Out-Host
164-
#Count tests
165-
$tests ++
166-
}
167-
168-
if ($OneSuccess -eq 1)
169-
{
170-
Write-Host "Port Spanning Success!" -ForegroundColor Green
171178
Write-Host ""
172-
Write-Host "At least one packet which was addressed to the DC, was picked up by the Gateway." -ForegroundColor Yellow
173-
Write-Host "A little noise is OK, but if you don't see a majority of successes, you might want to re-run." -ForegroundColor Yellow
174-
} else {
175-
Write-Host "No joy, all noise. You may want to re-run, increase the number of Ping Counts, or check your config." -ForegroundColor Red
176-
}
177-
178-
Write-Host ""
179-
Write-Host "Press any key to continue..." -ForegroundColor Red
180-
[void][System.Console]::ReadKey($true)
181-
```
179+
Write-Host "Press any key to continue..." -ForegroundColor Red
180+
[void][System.Console]::ReadKey($true)
181+
```
182182

183183
## Validate port mirroring using Net Mon
184184
1. Install [Microsoft Network Monitor 3.4](https://www.microsoft.com/download/details.aspx?id=4865) on the ATA Gateway that you want to validate.

0 commit comments

Comments
 (0)