© 2006, The Technology FirmWWW.THETECHFIRM.COM 1 WINDOWS XP SUPPORT TOOLS

© 2006, The Technology FirmWWW.THETECHFIRM.COM 2 Overview From Microsoft Website; Article ID Last Review October 30, 2003 Revision 1.0 This article was previously published under Q This article describes how to install Windows Support Tools from the Windows XP CD-ROM. MORE INFORMATION The Windows Support Tools for Windows XP Professional and Windows XP 64-Bit Edition are intended for use by Microsoft support personnel and experienced users to assist in diagnosing and resolving computer problems. For individual tool descriptions, see the Windows Support Tools online tool documentation (Suptools.chm). The Windows Support Tools for Windows XP Professional and Windows XP 64-Bit Edition can be installed only on a computer that is running the Windows XP Professional or Windows XP 64-Bit Edition operating system. The Windows Support Tools for Windows XP Professional and Windows XP 64-Bit Edition cannot be used to upgrade Microsoft Windows NT or Microsoft Windows 2000 Support Tools installed on Windows NT or Windows It is recommended that you remove all previous versions of Support Tools, including beta versions of the Windows Support Tools for Microsoft Windows XP Professional and Windows XP 64-Bit Edition, before you run the Support Tools installation program. Important: These tools have not been localized: they are written and tested only in the English language. Using these tools with a different language version of Microsoft Windows XP Professional or Windows XP 64-Bit Edition may not work.

© 2006, The Technology FirmWWW.THETECHFIRM.COM 3 DHCPLOC.EXE OVERVIEW This command-line tool displays the DHCP DHCPA TCP/IP service protocol that offers dynamic leased configuration of host IP addresses and distributes other configuration parameters to eligible network clients. DHCP provides safe, reliable, and simple TCP/IP network configuration, prevents address conflicts, and helps conserve the use of client IP addresses on the network. DHCP uses a client/server model where the DHCP server maintains centralized management of IP addresses that are used on the network. DHCP-supporting clients can then request and obtain lease of an IP address from a DHCP server as part of their network boot process. servers active on the subnet. If it detects any unauthorized DHCP servers DHCP serversA computer running the Microsoft DHCP service that offers dynamic configuration of IP addresses and related information to DHCP- enabled clients., it beeps and sends out alert messages. It also displays packets that it detects from DHCP servers; you can specify whether to display packets from all DHCP servers or only those from unauthorized servers. You can also use this tool to determine which DHCP servers are available to a DHCP client DHCP clientAny network-enabled device that supports the ability to communicate with a DHCP server for the purpose of obtaining dynamic leased IP configuration and related optional parameters information.and to detect unauthorized DHCP servers on a subnet.

© 2006, The Technology FirmWWW.THETECHFIRM.COM 4 DHCPLOC.EXE USAGE information.and to detect unauthorized DHCP servers on a subnet. DHCPLoc uses the following syntax: dhcploc [/p] [/a:"AlertNameList"] [/i: AlertInterval] ComputerIPAddress [ValidDHCPServerList] Parameters /p –Suppresses display of detected packets from any of the authorized DHCP servers specified in ValidDHCPServerList. /a:"AlertNameList" –Sends alert messages to the names in AlertNameList if any unauthorized DHCP servers are found. /i: AlertInterval –Specifies the alert frequency in seconds. ComputerIPAddress –Specifies the IP address IP addressFor Internet Protocol version 4 (IPv4), a 32- bit address used to identify a node on an IPv4 internetwork. Each node on the IP internetwork must be assigned a unique IPv4 address, which is made up of the network ID, plus a unique host ID. This address is typically represented with the decimal value of each octet separated by a period (for example, ). You can configure the IP address statically or dynamically by using Dynamic Host Configuration Protocol (DHCP). –For Internet Protocol version 6 (IPv6), an identifier that is assigned at the IPv6 layer to an interface or set of interfaces and that can be used as the source or destination of IPv6 packets. –of the computer from which you are running DHCPLoc. If the computer has multiple adapters, you must specify the IP address of the adapter that is connected to the subnet you want to test. ValidDHCPServerList –Specifies the IP addresses of any number of authorized DHCP servers. The tool does not send alerts when it detects packets from the servers in this list; however, it displays those packets unless you use the /p parameter.

© 2006, The Technology FirmWWW.THETECHFIRM.COM 5 NETCAP.EXE OVERVIEW This command-line tool allows a system administrator to monitor packets on a LAN and write the information to a log file. NetCap uses the Network Monitor Driver to sniff packets on local network segments. If you capture from your Wireless card, you will only capture data packets, no beacon, admin, etc.. This utility requires the installation of the Network Monitor driver

© 2006, The Technology FirmWWW.THETECHFIRM.COM 6 NETCAP.EXE USAGE netcap [/b:Number] [/t Type Buffer HexadecimalOffset HexadecimalPattern] [/f: FilterFile] [/c: CapturePath] [/n: Number] [/l: HH:MM:SS] [/tcf: FolderName] [/remove] NetCap uses the following syntax: /b:Number –Specifies the buffer size in megabytes. Number can be from 1 to The default is 1 (MB). /t Type Buffer HexadecimalOffset HexadecimalPattern –Specifies the use of a trigger to determine when to stop capturing. If the trigger is omitted, NetCap captures until the buffer is full, then stops. The /t N option continues to capture until the spacebar is pressed, using the buffer as a queue. If the buffer becomes full Netcap will overwrite the oldest entries. Type –B = Buffer –P = Pattern –BP = Buffer then pattern –PB = Pattern then buffer –N = No trigger Buffer –Percent buffer size. Options are 25, 50, 75, and 100. It is used with B, BP, PB, but not P. HexadecimalOffset –Hexadecimal offset from start of frame. Used with P, BP, PB, but not B. HexadecimalPattern –Hexadecimal pattern to match. Used with P, BP, PB, but not B. The pattern must be an even number of hexadecimal digits. /f: FilterFile –Specifies a filter to use during the capture. A filter file is created using Network Monitor in versions 2.x and after. A filter file has a.cf extension. /c: CapturePath –Specifies a location where Netcap will move the temporary capture files. This can be any valid local or remote path. If /c is not specified, the capture path remains in the default temporary capture folder. /n: Number –Specifies which network adapter to capture from, based on the network adapter index number. Run Netcap with the /? parameter to assign index numbers to the network adapters on the computer. /l: HH:MM:SS –Specifies how long the capture will last in hours, minutes, and seconds (maximum = 99:99:99). –Note This option overrides the default 100 percent trigger, unless /t Type is also specified. /tcf: FolderName –Sets the location where the temporary capture files are stored. The path must be on a fixed local hard drive. Once set, you only need to use the option again to change the directory. /remove –Removes the NetCap instance of the Network Monitor Driver. If you capture from your Wireless card, you will only capture data packets, no beacon, admin, etc..