Advanced Subnet Calculator from SolarWind is a simple but powerful easy to use Subnet Calculator for Windows.

Advanced Subnet Calculator can perform

whois lookups for hostnames and Domain Names

IPWhois Lookup for the provided IP Address

Classful Subnet Calculator

Claseless Inter-Domain Routing (CIDR) Calculator

Address Generator for a given IP Address and Subnet Mask

The tool can calculate both claseful Subnets and CIDRs and generate subnets. Also, can generate a list of IP Addresses for a given IP address and Subnet mask.

A quick and efficient tool for Network Administrators and designers and is completely free.

Advanced Subnet Calculator runs on Windows. To download advanced Subnet Calculator, click here

Dr.TCP is a simple but powerful utility that can let you fine tune the TCP/IP parameters for your Network Interface Card (NIC). It works on Windows XP, 2003,2000.

Dr.TCP takes the hassle out of editing the Windows Registry and modifying keys to fine tune the TCP/IP Parameters at

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\<AdapterID>] 

Although, this is easy to use, it takes a bit of understanding of TCP/IP protocol stack to know what each of the parameters do.

The utility can set or modify the following on a per interface basis

Set MTU (Maximum Transmission Unit)
TCP Receive window

Enable/Disable Path MTU Discovery

Enable/Disable Blackhole router detection

Enable/Disable Window Scaling

Enable/Disable Time Stamp

Enable/Disable SACK (Select ACK)

Set Maximum Duplicate ACKs

Set TTL (Time To Live)

To download the tool, click here 

Yersinia is a free Network Penetration testing tool used to test and analyse some of the most commonly used protocols on your network. Penetration testing tools of this kind will provide deep insight on network security issues. Yersinia is a UNIX based tool that works on Linux, Solaris 8, FreeBSD.

NOTE: The tool is described as a tool to perform network tests and exercise responsible actions when performing tests which includes obtaining the permission from responsible authorities. DO NOT USE THIS TOOL FOR ANY UNAUTHROSIED HACKING PURPOSES

The attacks for testing can be performed on the following protocols:

Inter-Switch Link Protocol (ISL)

Cisco Discovery Protocol (CDP)

Sending RAW CDP packet
DoS flooding CDP neighbors table
Setting up a virtual device

Spanning Tree Protocol (STP)

Sending RAW Configuration BPDU
Sending RAW TCN BPDU
DoS sending RAW Configuration BPDU
DoS sending RAW TCN BPDU
Claiming Root Role
Claiming Other Role
Claiming Root Role dual home (MITM)

Dynamic Trunking Protocol (DTP)

Sending RAW DTP packet
Enabling trunking

Dynamic Host Configuration Protocol (DHCP)

Sending RAW DHCP packet
DoS sending DISCOVER packet (exhausting ip pool)
Setting up rogue DHCP server
DoS sending RELEASE packet (releasing assigned ip)

Hot Standby Router Protocol (HSRP)

Sending RAW HSRP packet
Becoming active router
Becoming active router (MITM)

IEEE 802.1Q

Sending RAW 802.1Q packet
Sending double encapsulated 802.1Q packet
Sending 802.1Q ARP Poisoning

IEEE 802.1X

Sending RAW 802.1X packet
Mitm 802.1X with 2 interfaces

VLAN Trunking Protocol (VTP)

Sending RAW VTP packet
Deleting ALL VLANs
Deleting selected VLAN
Adding one VLAN
Catalyst crash

Yersinia has precompiled builds for Ubuntu, Debian & FreeBSD but also has the source from which we can build and install Yersinia.

To build and install from source,

Download the latest versio (0.7.1) from here

Untar, Compile, Build and install as follows

pentest# tar -zxvf yersinia-0.7.1.tar.gz

pentest# cd yersinia-0.7.1

pentest# ./configure

pentest# make

pentest# make install

For more information and some very useful writeups click here

One of the most important thing that is ignored most of the time while troubleshooting a network problem to a host or a network is checking the MTU related issue. This makes more sense in situations like troubleshooting VPN related issues.

MTUROUTE is a small but smart utility that uses ICMP pings of various sizes in order to determine the MTU values (Maximum Transmission Unit) on the path between itself and the target system. MTUROUTE can operate in normal mode where it sends multiple ICMP packets to each hop on the path to identify the smallest MTU between the host and hop or in a Traceroute mode where it will attempt to determine the lowest MTU between the local host and each hop in the communication.

It is important to note that care has to be taken as it generates muti fold ICMP traffic as it tries to determine the MTU Values.

Mturoute sends a non-fragmentable icmp probe to the target IP address with a given payload size. Since the DF (Don't Fragment) bit is set, any network equipment that has an MTU setting which is smaller than the packet size will drop the packet. Based on the presence or absence of a response, mturoute adjusts the payload size of its next probe. Subsequent probes are sent with a packet size midway between the highest value for which a response was received and the lowest value for which a response was not received. (For the initial conditions, the low value is 0 and the high value is whatever you set with -m, defaulting to 10000 bytes).

This process is repeated, narrowing the search space by approx 50% with each cycle, terminating once the highest possible probe size has been converged upon. It then adds the 28 bits of ICMP protocol overhead before reporting results.

For example,

C:\mturoute\Release>mturoute.exe 192.168.0.1
* ICMP Fragmentation is not permitted. *
* Maximum payload is 10000 bytes. *
– ICMP payload of 5046 bytes failed..
– ICMP payload of 2569 bytes failed..
+ ICMP payload of 1330 bytes succeeded.
– ICMP payload of 1949 bytes failed..
– ICMP payload of 1639 bytes failed..
– ICMP payload of 1484 bytes failed..
+ ICMP payload of 1407 bytes succeeded.
+ ICMP payload of 1445 bytes succeeded.
+ ICMP payload of 1464 bytes succeeded.
– ICMP payload of 1474 bytes failed..
+ ICMP payload of 1469 bytes succeeded.
+ ICMP payload of 1471 bytes succeeded.
+ ICMP payload of 1472 bytes succeeded.
– ICMP payload of 1473 bytes failed..
+ ICMP payload of 1472 bytes succeeded.
+ ICMP payload of 1472 bytes succeeded.
Path MTU: 1500 bytes.

In TraceRoute mode

C:\mturoute\Release>mturoute.exe -t 192.168.0.1
mturoute to 192.168.0.1, 30 hops max, variable sized packets
* ICMP Fragmentation is not permitted. *
* Maximum payload is 10000 bytes. *
 1  –+—+++-+++-++  host: 192.168.0.1  max: 1500 bytes

For help, simply type the command with no arguements

C:\mturoute\Release>mturoute.exe
********************************************************
* mturoute.exe – written by Eli Fulkerson, June 2005   *
*                fixes by Ivan Pepelnjak, October 2007 *
* Please visit http://www.elifulkerson.com for updates.*
*       http://ioshints.blogspot.com/search?q=mturoute *
********************************************************

Usage: mturoute [-t] [-f] [-m MAX_PAYLOAD_SIZE] host
Flags:
   -t : Toggles 'traceroute' mode.  (Default is off)
   -f : Allow fragmentation.  This will return the max ping size that the
        target host will respond to, but not necessarily the MTU.
   -w : Sets the time to wait for a response to an Echo Request.
   -r : Sets the maximum number of probe retries on timeout (default = 3).
   -i : Sets the interval between two echo requests.
   -d : Increases the debugging level. Reports ICMP status/failures.
   -m : Sets a maximum payload size to test. (Default is 10000)
   -v : Prints version info and exits

Warning:  This utility generates a lot of ICMP traffic.

For more information and download, click here

Packet Trap pt360 Tool suite is a Windows based free Network Diagnostic tools suite and a Network Monitoring tool. Packet Trap has a nice Dashboard with drag and drop dashboard components.

At the first look, Packet Trap is very impressive, simple, easy to use, easy to understand, simple and easy navigation and menu options. All the diagnostic tools are graphic and provides a great advantage as a one stop shop for most of the Network troubleshooting. What is even more impressive is that the monitoring system being integrated into a Network Diagnostic suite which allows an admin to monitor and troubleshoot all from one place and they all can export the results in nice HTML format.

The network diagnostic tools available in Packet Trap are

Ping Scan – To scan networks using ICMP

Enhanced Ping – Detailed reporting on Ping Time, Reponse time, Average response time, status and packet loss details.

Graphical Ping – Pings persistently and Graphs the response time in milliseconds over a period of time

DNS Audit – DNS Lookup for a host with simple lookup details

Whois Lookup

Port Scan for a given IP or a range of IPs

MAC Address Scan for a given IP or a range of IPs

SNMP Scan – Supports SNMPv1/2&3 thereby any platform that supports SNMP are supported

WMI Scan – Windows WMI support

Wake On LAN – Wake on LAN list of Hosts (hosts that support the option at the hardware level. For example, in BIOS for x86 systems)

TraceRoute – with response times and Packet Loss info

Traffic Jam – Traffic Generator on TCP and UDP ports with customisation options on the packet size, bandwidth

TFTP server

All the diagnostic tools are also available as individual downloads, if you do not want a host of these features on your system. Although, the fully loaded suite is certainly not bloated. There is also a commercial PRO version of this tool which extends support to

Cisco Config Management

Netflow Analyzer

Opensource tools integration (like Nagios & Cacti)

Remote TCP reset

Syslog server

Network Discovery

Encrypted Password vault

If I have to point and select the best possible  feature, I would choose Wake On LAN feature which allows you to start a bunch of hosts which supports the feature. This can be of great help with remote access/administration when you need to start a PC which you know is shutdown. Departments may even adapt it for green policies. Also, all SNMP, Password and other credentials are stored in encrypted format on the disk.

Overall a great tool for simple network administration. If there is anything that one could call a downside it is that PacketTrap pt360 could have been Web-based Client-Server tool than desktop based. This would allow Small and Medium Networks and may be to a level Enterprise networks to adapt.

As a Network professional, I would personally recommend this product to my fellow professionals!!!

For more information and download, click here

Nipper, the opensource Security Audit Tool that can perform Securiy Audits of Network Device Configurations is now integrated into ZipTie, a Network Inventory and Configuration Management framework. Nipper in Ziptie will be called as Zipper.

Since, Ziptie supports all the network devices that can be audited by Nipper, all the functionality Nipper are available under Ziptie. An admin has to select the device and select Nipper to run the audit on the backedup configuration file.

Because, of the different licensing on both the products (Ziptie uses MPL while Nipper uses a GPL license). Zipper is not available out of the box and has to be installed using the plugin and is supported only on Windows at the moment and there is an intention to extend to other platforms on which ZipTie is supported.

For more information and download, click here

ARPing is an utility that can be used to ping using ARP requests instead of using ICMP as used in standard Ping utility.

Because it involves ARP, arping is limited to the local network to which the server or the interface (if more than one interface) is connected to. ARPing can be quite useful to

• Check if an IP Address is already in use before assigning to another device
• Duplicate address detection
• Update neighbors ARP cache

There are two arping versions,

1. arping as a part of iputils in Linux
2. arping2 from Thomas Habets using libcap and libnet

arping2 is considered a better version than the iputils version. arping in iputils cannot send a "Who has what MAC Address" packet and works only in Linux, most of UNIX versions while arping2 can work on of the Linux, UNIX operating systems and can work on Windows.

Example:

using ARPing (iputils)

ARPING 192.168.0.1 from 192.168.0.10 eth0
Unicast reply from 192.168.0.1 [00:01:80:38:F7:4C]  0.510ms
Unicast reply from 192.168.0.1 [00:01:80:38:F7:4C]  0.601ms
Unicast reply from 192.168.0.1 [00:01:80:38:F7:4C]  0.610ms
Unicast reply from 192.168.0.1 [00:01:80:38:F7:4C]  0.605ms
Sent 4 probes (1 broadcast(s))
Received 4 response(s)

Using ARPing (libcap and libnet version)

arping2 00:01:02:03:04:05
arping2 192.168.0.10

For more details and download of arping2, click here

For a iputils version of arping man page, click here

NDCC is a system of monitoring and recording changes to configurations of network equipment. It can store configuration snapshots for any text-based configs. It has been used to store configurations from Unix and Linux systems; Cisco routers, switches, load balancers, and firewalls; Foundry; NetScreen, Juniper, NetScaler, and others.

A good demo is available here

It can be downloaded here

Fping is a free console program, much like the ping program that comes with windows.

Why use fping instead of the standard windows ping?

Fping has the same options as the regular ping as well as several unique options:

• Time between pings can be adjusted as needed from 1ms to 5s.
• Beep on every successful or unsuccessful reply allowing you to test your network status in the background.
• Ping multiple hosts with one simple command.
• Read a hostlist from a file
• Output redirection to a file for parsing.
• Ping with random data, or data you provide
• Ping using raw sockets, or use the ICMP dll. The choice is up to you.
• More options available in the program. Download Fping for free and give it a try.

For more information and download, click here

fping is a ping like program which uses the Internet Control Message Protocol (ICMP) echo request to determine if a host is up. fping is different from ping in that you can specify any number of hosts on the command line, or specify a file containing the lists of hosts to ping.

Instead of trying one host until it timeouts or replies, fping will send out a ping packet and move on to the next host in a round-robin fashion. If a host replies, it is noted and removed from the list of hosts to check. If a host does not respond within a certain time limit and/or retry limit it will be considered unreachable.

Unlike ping, fping is meant to be used in scripts and its output is easy to parse.

The home page for fping, http://www.fping.com/ seems not updated and hence can download the source from http://packages.debian.org/unstable/net/fping and compile.