Powershell packet capture script written by Robbie Foust.
http://blog.robbiefoust.com/?p=68
Start capture of everything on interface outside:
#capture CAPFILE interface outside packet-length 1500 buffer 8192
Start capture on interface outside using access-list (define access-list first):
#capture CAPFILE interface outside packet-length 1500 access-list 345 buffer 8192
Stop capture
# no capture CAPFILE interface outside
Fire up a browser and go to the following URL to fetch your capture (Other protocols can be used too):
https://ASA-IP/capture/CAPFILE/pcap
Clean up
# no capture MYCAP
Typeperf is a command to echo performance counter data out to console (can also output to file or sql)
typeperf "\Processor(_Total)\% Processor Time" -si 0:0:5 -sc 5
Normal behaviour for Windows 2008 onwards is to register all IPs for a certain adapter in DNS if dynamic dns registration is enabled.
To prevent this behaviour you need to install below mentioned hotfix and add the addresses using the following netsh syntax:
Netsh int ipv4 add address skipassource=true
http://support.microsoft.com/kb/975808/EN-US
By default, IIS will bind a certain port to all IPs sharing NIC.
To disable this behaviour you need to disable socket pooling.
You do this providing a list of ip:port pairs to listen to, with socket pooling enabled the list is usually empty
For IIS6 you can use httpcfg.exe from support tools.
httpcfg.exe set iplisten -i 0.0.0.0:80
httpcfg.exe set iplisten -i 10.0.0.1:443
For IIS7 you use netsh
netsh http add iplisten ipaddress=0.0.0.0:80
netsh http add iplisten ipaddress=10.0.0.1:443
To clear all currently registered eventhandlers:
Get-EventSubscriber | % {Unregister-Event $_.SubscriptionID}
Capture Service Status changes (Example uses Wireless Zero Configuration):
Register-WmiEvent -Query "select * from __InstanceModificationEvent within 2 where targetinstance isa 'win32_service' and targetinstance.name= 'WZCSVC'" -sourceIdentifier "WZCSVC Status" -action { $evt=$event.SourceEventArgs.newEvent.TargetInstance ; Write-Host $evt.DisplayName $evt.State on $evt.Systemname}
([wmiclass]"Win32_NetworkAdapterConfiguration").RenewDHCPLeaseAll()