Quick links
| Table of Contents | ||||||||
|---|---|---|---|---|---|---|---|---|
|
...
Download the DumpcapSetup here
Extract the contents
Double click the “Install.bat” script
You will likely be prompted by Windows defender indicating “Windows Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk.” – This is expected since the batch file was not created local to the machine in use.
Click the “More info” link, then choose “Run anyway”
User Account Control will prompt for evaluated permissions. Continue or enter Administrator credentials to continue
Observe the text at the top of the command prompt window. It will display all the observed network interfaces available to dumpcap, and will launch the windows network connections control panel
Input the corresponding numeric entry associated with the active network interface handling Sharpen traffic.
Tip: In most cases, multiple network adapters will show. Choose the one which has the name matching the “Connected” status. Unless simultaneously connected to networks, this will be the active adapter
Please also note that dumpcap’s identification of network adapters by ID can change upon reboot. The initial setup of this script sets the ID statically. So, if the ID changes, the capture will not work. If possible, it is best to disable all but the necessary (“Connected”) network interface for the duration of the data gathering.
Here’s an example from a machine with a few virtual adapters, a VPN, and a bridged WiFi connection. In this case, the bridge is the active connection, so option “1” would be chosen in the command prompt.
Press Enter
Setup is now complete
Validate logs are capturing
Navigate to Desktop\DumpCap\Captures
Observe whether file(s) such as the following exist
file_00001_20181101115841.pcap
File size is only expected to increase once audio traffic to/from Sharpen commences
...
Download the DumpcapSetup here
Extract the contents
Double click the “Install.bat” script
You will likely be prompted by Windows defender indicating “Windows Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk.” – This is expected since the batch file was not created local to the machine in use.
Click the “More info” link, then choose “Run anyway”
User Account Control will prompt for evaluated permissions. Continue or enter Administrator credentials to continue
Observe the text at the top of the command prompt window. It will display all the observed network interfaces available to dumpcap, and will launch the windows network connections control panel
Input the corresponding numeric entry associated with the active network interface handling Sharpen traffic.
Tip: In most cases, multiple network adapters will show. Choose the one which has the name matching the “Connected” status. Unless simultaneously connected to networks, this will be the active adapter
Please also note that dumpcap’s identification of network adapters by ID can change upon reboot. The initial setup of this script sets the ID statically. So, if the ID changes, the capture will not work. If possible, it is best to disable all but the necessary (“Connected”) network interface for the duration of the data gathering.
Here’s an example from a machine with a few virtual adapters, a VPN, and a bridged WiFi connection. In this case, the bridge is the active connection, so option “1” would be chosen in the command prompt.
Press Enter
Setup is now complete
Validate logs are capturing
Navigate to Desktop\DumpCap\Captures
Observe whether file(s) such as the following exist
file_00001_20181101115841.pcap
File size is only expected to increase once audio traffic to/from Sharpen commences
...
Navigate to the original extraction point of the DumpcapSetup.zip
Locate the “Uninstall.bat” file and double-click
User Account Control will prompt for evaluated permissions. Continue or enter Administrator credentials to continue
Navigate to Desktop\DumpCap\Captures
Identify the proper capture associated with the incident
Date and time can be interpreted by observing the file name
file_00001_20181101115841.pcap
Year, Month, Day, Hour, Minute, Second indicates start time of file Date Modified File Explorer column indicates the end time of the file
Copy the identified packet capture file
Upload the file to a cloud storage solution such as Google Drive, Onedrive, Dropbox, etc...
Provide public link to Sharpen in SharpenCare case
Sharpen will analyze the capture in conjunction with server-side captures to help reach root cause understanding.
...