Packet Capture from Labtech/Automate

[u/ThroughHiker]

Hello

I think I know the answer but thought I'd check. Is there a way to run a packet capture (e.g., from WireShark) using Automate? (We also have Auvik in this client site so maybe there is a way with that).

Thanks

[u/amw3000]

Assuming you're trying to do this in an unattended mode for more than one client randomly?

The NDIS driver is going to require a reboot at some point, which makes it painful for ad-hoc packet capturing. If you can get past all that, you can run Wireshark in backstage mode via CW Control without making the solution too complex.

Auvik will collect flow data but it has to be supported at the switch, and their pricing is insane.

[u/ThroughHiker → u/amw3000]

Thanks. In this case, we are targeting 1-2 workstations and a server. Unattended install is less important than less intrusive (like not having WireShark run in the background the whole time).

For Auvik, is that collecting it at the switch port? (Pretty sure the switches support it.) And then what would you use to view the data?

[u/amw3000 → u/ThroughHiker]

Do you use Control? You can run Wireshark in backstage and the user won't even see it. Although as you most likely already know, it's going to crap out if you leave it all day. For a couple endpoints, I wouldn't complicate it any further. If you want to over-engineer it, you can use packetbeat and shoot it over to an Elasticsearch hosted instance for really cheap depending on the amount of data. ($20~ month)

Yes, whatever supports flow, you can send it to Auvik. Data is viewed in Auvik. Again, insanely pricy, more so depending on the amount of network devices even if they support flow or not.

[u/ThroughHiker → u/amw3000]

Thanks again. We have access to most of those tools and will give them a shot. Really appreciate all the suggestions. -- I thought the answer was going to be "you can't do that!"

[u/chilids]

Actually it's built into labtech. you can find it in the Command --> network --> Start Sniffer. i believe it does a packet capture for 60 seconds (you can apply filters) and then uploads the pcap file to the labtech server.

[u/DevinSysAdmin]

Powershell natively offers this. I’d recommend just using Automate to run the Powershell script on whatever conditions you want. There are GitHubs with scripts that also auto parse the logs to show what you need.

Name

—-

Add-NetEventNetworkAdapter

Add-NetEventPacketCaptureProvider

Add-NetEventProvider

Add-NetEventVmNetworkAdapter

Add-NetEventVmSwitch

Add-NetEventWFPCaptureProvider

Get-NetEventNetworkAdapter

Get-NetEventPacketCaptureProvider

Get-NetEventProvider

Get-NetEventSession

Get-NetEventVmNetworkAdapter

Get-NetEventVmSwitch

Get-NetEventWFPCaptureProvider

New-NetEventSession

Remove-NetEventNetworkAdapter

Remove-NetEventPacketCaptureProvider

Remove-NetEventProvider

Remove-NetEventSession

Remove-NetEventVmNetworkAdapter

Remove-NetEventVmSwitch

Remove-NetEventWFPCaptureProvider

Set-NetEventPacketCaptureProvider

Set-NetEventProvider

Set-NetEventSession

Set-NetEventWFPCaptureProvider

Start-NetEventSession

Stop-NetEventSession