Skip to content

Commit 9305c5d

Browse files
Malcolm-StewartMalcolm-Stewart
committed
SQLTrace Network capture updates
Added extra NETSH dummy trace before real trace to improve reliability. Added New-NetEventSession NDIS capture method.
1 parent 3d36afe commit 9305c5d

File tree

2 files changed

+105
-26
lines changed

2 files changed

+105
-26
lines changed

‎SQLTrace/SQLTrace.ini‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
##
55
## https://github.com/microsoft/CSS_SQL_Networking_Tools/wiki
66
##
7-
## Requires SQLTrace version 1.0.0150.0 or above or some options will be ignored
7+
## Requires SQLTrace version 1.0.0197.0 or above or some options will be ignored
88
##
99

1010

@@ -32,16 +32,18 @@ BIDProviderList = System.Data System.Data.SNI
3232

3333
NETTrace = Yes # Controls the overall category of collection
3434
NETSH = Yes # Default for Windows; built-in Supports TruncatePackets, FilterString, TCPEvents
35+
PSNETCAPTURE = No # PowerShell New-NetEvent NDIS capture; built-in Supports TruncatePackets, FilterString, TCPEvents
3536
NETMON = No # Must be installed separately Supports TruncatePackets, FilterString
3637
WIRESHARK = No # WireShark can see VPN traffic, must be installed separately Supports TruncatePackets, FilterString
3738
Pktmon = No # Windows 2019 and later, Windows 11 and later, Windows 10 builds equivalent to Windows 2019. Supports TruncatePackets, FilterString, TCPEvents
3839
TruncatePackets = No # Whether to capture full packet payload or just the beginning portion
39-
TCPEvents = No # For NETSH: collect TCPIP and Winsock AFD events
40+
TCPEvents = NO # For NETSH, PSNETCAPTURE, PkyMon: collect TCPIP, Winsock AFD, Firewall, and DNS events
4041

41-
# FilterString = IPv4.Address=10.10.10.10 Ethernet.Type=IPv4 # NETSH filter string example; no port filtering; only a single = used in comparisons; For help: netsh trace show CaptureFilterHelp
42-
# FilterString = ipv4.address==10.10.10.10 and tcp.port==1433 # NETMON filter string example; double == used in comparisons
43-
# FilterString = -f "host 10.10.10.10 and port 1433" # WIRSHARK filter string example; no = signs; for help run Wireshark | Capture | Capture Filters ... menu
44-
# FilterString = -t tcp -i 10.10.10.10 -p 1433 # PKTMON filter string example; not expression-based; spaces separate multiple values for IP addresses and ports
42+
# FilterString = IPv4.Address=10.10.10.10 Ethernet.Type=IPv4 # NETSH filter string example; no port filtering; single = used in comparisons; For help: netsh trace show CaptureFilterHelp
43+
# FilterString = -EtherType 0x0800 -IPAddresses 10.10.10.10 -IpProtocols 6,17 # PSNETCAPTURE filter string example; 0x800 = IPV4, 0x86DD = IPV6, 6 = TCP, 17 = UDP - omit to not filter on a particular item
44+
# FilterString = ipv4.address==10.10.10.10 and tcp.port==1433 # NETMON filter string example; double == used in comparisons
45+
# FilterString = -f "host 10.10.10.10 and port 1433" # WIRSHARK filter string example; not expression-based; for help run Wireshark | Capture | Capture Filters ... menu
46+
# FilterString = -t tcp -i 10.10.10.10 -p 1433 # PKTMON filter string example; not expression-based; spaces separate multiple values for IP addresses and ports
4547

4648

4749
################## AUTH TRACE #############

‎SQLTrace/SQLTrace.ps1‎

Lines changed: 97 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ LogRaw "
9696
/_______ /\_____\ \_/|_______ \|____| |__| (____ / \___ >\___ >
9797
\/ \__> \/ \/ \/ \/
9898
99-
SQLTrace.ps1 version 1.0.0184.0
99+
SQLTrace.ps1 version 1.0.0197.0
100100
by the Microsoft SQL Server Networking Team
101101
"
102102

@@ -156,6 +156,7 @@ Function ReadINIFile
156156
BidProviderList = "" # Empty default
157157

158158
NetTrace = "No"
159+
PSNetCapture = "No"
159160
Netsh = "No"
160161
Netmon = "No"
161162
Wireshark = "No"
@@ -213,6 +214,7 @@ Function ReadINIFile
213214
"BIDProviderList" { $global:INISettings.BIDProviderList = $value ; while ( $global:INISettings.BIDProviderList.IndexOf(" ") -ge 0) { $global:INISettings.BIDProviderList = $global:INISettings.BIDProviderList.Replace(" ", " ") } } # remove extra spaces between provider names
214215
"NETTrace" { $global:INISettings.NetTrace = $value }
215216
"NETSH" { $global:INISettings.NETSH = $value }
217+
"PSNETCAPTURE" { $global:INISettings.PSNETCAPTURE = $value }
216218
"NETMON" { $global:INISettings.NETMON = $value }
217219
"WireShark" { $global:INISettings.WireShark = $value }
218220
"PktMon" { $global:INISettings.PktMon = $value }
@@ -246,6 +248,7 @@ Function DisplayINIValues
246248
""
247249
"NETTrace " + $global:INISettings.NETTrace
248250
"NETSH " + $global:INISettings.NETSH
251+
"PSNETCAPTURE " + $global:INISettings.PSNETCAPTURE
249252
"NETMON " + $global:INISettings.NETMON
250253
"WireShark " + $global:INISettings.WireShark
251254
"PktMon " + $global:INISettings.PktMon
@@ -445,6 +448,17 @@ Function FlushExistingTraces
445448

446449
LogInfo "Stopping previously running traces ..."
447450

451+
# stop any PowerShell Net Event Session traces
452+
$sessions = get-neteventsession
453+
foreach ($session in $sessions)
454+
{
455+
if ($session.name -eq "PSTraceNDIS")
456+
{
457+
Stop-NetEventSession -Name $session.name
458+
Remove-NetEventSession -Name $session.name
459+
}
460+
}
461+
448462
logman stop SQLTraceBID -ets 2>&1 | Out-Null
449463

450464
logman stop SQLTraceNDIS -ets 2>&1 | Out-Null
@@ -578,10 +592,6 @@ Function StartBIDTraces
578592
$CleanupValues = "$($global:LogFolderName)\BIDTraces\bidtrace*.etl", $global:INISettings.MinMinutes, $global:INISettings.MinFiles # Filespec, min_minutes, min_files
579593
$PathsToClean.Add("BID", $CleanupValues)
580594

581-
# if(((Test-Path "$($global:LogFolderName)\BIDTraces" -PathType Container) -eq $True) -and ($global:INISettings.DeleteOldFiles -eq "Yes"))
582-
# {
583-
# StartCleanupETLTraceFiles -jobname "BIDTRACECLEANUP" -folder "$($global:LogFolderName)\BIDTraces" -numofFilesToKeep 30 -jobrunintervalMin 30
584-
# }
585595
}
586596
}
587597

@@ -622,7 +632,6 @@ Function StartNetworkMonitor
622632
LogInfo "NMCAP Args: $ArgumentList"
623633

624634
#Start the capture
625-
# [System.Diagnostics.Process] $NetmonProcess = Start-Process $NMCap -PassThru -NoNewWindow -ArgumentList $ArgumentList
626635
[System.Diagnostics.Process] $NetmonProcess = Start-Process $NMCap -PassThru -NoNewWindow -RedirectStandardOutput "$($global:LogFolderName)\NetworkTraces\Console.txt" -ArgumentList $ArgumentList
627636
LogInfo "Network Monitor is running with PID: " + $NetmonProcess.ID
628637
LogWarning "Killing this process will corrupt the most recent capture file."
@@ -684,7 +693,6 @@ Function StartDeleteOldFiles
684693
$MinMinutes = $PathToClean[1] -as [int]
685694
$MinFiles = $PathToClean[2] -as [int]
686695
get-item $FileSpec | sort-object -property LastWriteTime -descending | select -skip $MinFiles | where-object {$_.LastWriteTime -lt ((get-date).AddMinutes($MinMinutes * -1))} | remove-item -force
687-
# get-item $FileSpec | sort-object -property LastWriteTime -descending | select -skip 5 | where-object {$_.LastWriteTime -lt ((get-date).AddMinutes(5 * -1))} | remove-item -force
688696
}
689697
} -ArgumentList $FilesToDelete
690698
$job.Options.RunElevated=$True
@@ -739,8 +747,32 @@ Function StartNetworkTraces
739747
if($global:INISettings.NETSH -eq "Yes")
740748
{
741749
LogInfo "Starting NETSH..."
742-
# $commandLine = "netsh trace start capture=yes overwrite=yes tracefile=$($global:LogFolderName)\NetworkTraces\" + $env:computername +".etl filemode=circular maxSize=200MB"
743-
# Invoke-Expression $commandLine
750+
751+
# NETSH often won't collect on the first invocation
752+
# Dummy NETSH collection so the next one will be reliable
753+
754+
$cmd = "netsh trace start capture=yes maxsize=1 report=disabled TRACEFILE=`"$($global:LogFolderName)\NetworkTraces\deletemeD.etl`""
755+
LogInfo "NETSH dummy start: $cmd"
756+
757+
$result = invoke-expression $cmd
758+
LogInfo "NETSH: $result"
759+
760+
$result = netsh trace stop
761+
LogInfo "NETSH dummy stop: $result"
762+
763+
# remove files generated by the dummy run
764+
765+
if (Test-Path "$($global:LogFolderName)\NetworkTraces\deletemeD.etl")
766+
{
767+
del "$($global:LogFolderName)\NetworkTraces\deletemeD.etl"
768+
}
769+
770+
if (Test-Path "$($global:LogFolderName)\NetworkTraces\deleteme.cab")
771+
{
772+
del "$($global:LogFolderName)\NetworkTraces\deletemeD.cab"
773+
}
774+
775+
# NETSH second invocation and real data capture to be logged by LOGMAN in a chained set of files
744776

745777
$truncatePackets = ""
746778
if ($global:INISettings.TruncatePackets -eq "Yes") { $truncatePackets = "PACKETTRUNCATEBYTES=250"; }
@@ -756,25 +788,62 @@ Function StartNetworkTraces
756788

757789
if ($global:INISettings.TCPEvents -eq "Yes")
758790
{
759-
$result = logman update trace ndiscap -p Microsoft-Windows-Winsock-AFD -ets
791+
$result = logman update trace SQLTraceNDIS -p Microsoft-Windows-Winsock-AFD -ets
760792
LogInfo "LOGMAN Winsock AFD Events: $result"
761-
$result = logman update trace ndiscap -p Microsoft-Windows-TCPIP -ets
793+
$result = logman update trace SQLTraceNDIS -p Microsoft-Windows-TCPIP -ets
762794
LogInfo "LOGMAN TCPIP Events: $result"
763-
$result = logman update trace ndiscap -p Microsoft-Windows-WFP -ets
795+
$result = logman update trace SQLTraceNDIS -p Microsoft-Windows-WFP -ets
764796
LogInfo "LOGMAN Windows Firewall Events: $result"
765-
$result = logman update trace ndiscap -p Microsoft-Windows-Winsock-NameResolution -ets
797+
$result = logman update trace SQLTraceNDIS -p Microsoft-Windows-Winsock-NameResolution -ets
766798
LogInfo "LOGMAN DNS Events: $result"
767799
}
768800

769801
# Values for DeleteOldFiles
770802
$CleanupValues = "$($global:LogFolderName)\NetworkTraces\nettrace*.etl", $global:INISettings.MinMinutes, $global:INISettings.MinFiles # Filespec, min_minutes, min_files
771803
$PathsToClean.Add("NETSH", $CleanupValues)
772804

773-
# if ($global:INISettings.DeleteOldFiles -eq "Yes")
774-
# {
775-
# # StartCleanupNetworkTraces -folder "$($global:LogFolderName)\NetworkTraces" # Clintonw
776-
# StartCleanupETLTraceFiles -jobname "NETWORKTRACECLEANUP" -folder "$($global:LogFolderName)\NetworkTraces" -numofFilesToKeep 30 -jobrunintervalMin 30
777-
# }
805+
}
806+
if($global:INISettings.PSNETCAPTURE -eq "Yes")
807+
{
808+
LogInfo "Starting PowerShell NetEvent NDIS packet capture ..."
809+
810+
New-NetEventSession -Name "PSTraceNDIS" -CaptureMode SaveToFile -LocalFilePath "$($global:LogFolderName)\NetworkTraces\deleteme.etl" -TraceBufferSize 1024 -MaxFileSize 1
811+
812+
$PacketSize = 0 # collect full packet
813+
if ($global:INISettings.TruncatePackets -eq "Yes") { $PacketSize = 250; } # same as netsh
814+
815+
Add-NetEventPacketCaptureProvider -SessionName "PSTraceNDIS" -TruncationLength $PacketSize
816+
817+
if ($global:INISettings.FilterString -ne "")
818+
{
819+
$cmd = "Set-NetEventPacketCaptureProvider -SessionName PSTraceNDIS $($global:INISettings.FilterString)"
820+
LogInfo "Adding filter: $cmd"
821+
822+
$result = invoke-expression $cmd
823+
LogInfo "Filter: $result"
824+
}
825+
826+
Start-NetEventSession -Name "PSTraceNDIS"
827+
828+
$result = logman start SQLTraceNDIS -p Microsoft-Windows-NDIS-PacketCapture -mode newfile -max 300 -o "$($global:LogFolderName)\NetworkTraces\nettrace%d.etl" -ets
829+
LogInfo "LOGMAN: $result"
830+
831+
if ($global:INISettings.TCPEvents -eq "Yes")
832+
{
833+
$result = logman update trace SQLTraceNDIS -p Microsoft-Windows-Winsock-AFD -ets
834+
LogInfo "LOGMAN Winsock AFD Events: $result"
835+
$result = logman update trace SQLTraceNDIS -p Microsoft-Windows-TCPIP -ets
836+
LogInfo "LOGMAN TCPIP Events: $result"
837+
$result = logman update trace SQLTraceNDIS -p Microsoft-Windows-WFP -ets
838+
LogInfo "LOGMAN Windows Firewall Events: $result"
839+
$result = logman update trace SQLTraceNDIS -p Microsoft-Windows-Winsock-NameResolution -ets
840+
LogInfo "LOGMAN DNS Events: $result"
841+
}
842+
843+
# Values for DeleteOldFiles
844+
$CleanupValues = "$($global:LogFolderName)\NetworkTraces\nettrace*.etl", $global:INISettings.MinMinutes, $global:INISettings.MinFiles # Filespec, min_minutes, min_files
845+
$PathsToClean.Add("PSTrace", $CleanupValues)
846+
778847
}
779848
if($global:INISettings.NETMON -eq "Yes")
780849
{
@@ -1060,9 +1129,17 @@ Function StopNetworkTraces
10601129
{
10611130
Rename-Item "$($global:LogFolderName)\NetworkTraces\deleteme.cab" "network_settings.cab"
10621131
}
1132+
}
1133+
if($global:INISettings.PSNETCAPTURE -eq "Yes")
1134+
{
1135+
logman stop SQLTraceNDIS -ets
1136+
Stop-NetEventSession -Name "PSTraceNDIS"
1137+
Remove-NetEventSession -Name "PSTraceNDIS"
10631138

1064-
## StopCleanupNetworkTraces # clintonw
1065-
#StopCleanupETLTraceFiles -jobname "NETWORKTRACECLEANUP"
1139+
if (Test-Path "$($global:LogFolderName)\NetworkTraces\deleteme.etl")
1140+
{
1141+
del "$($global:LogFolderName)\NetworkTraces\deleteme.etl"
1142+
}
10661143
}
10671144
if($global:INISettings.NETMON -eq "Yes")
10681145
{

0 commit comments

Comments
 (0)