So let's look at how we query network information.
I suppose the first thing here is to understand what the
query network components would be.
So the first one here would be the IP address of the computer.
That's fundamentally a network thing.
Second would be the detailed IP configuration information.
So does it have multiple?
What's the subnet?
What's the main route table that it utilizes?
Then it would be pinging the computers to find out if they're awake,
if they're even on the network and then even going a little bit further
and retrieving network adapter properties as well.
So how do we query computer network properties?
Well, what about network adapter?
So now this is really when we're on the machine itself.
We can utilize Get‑NetAdapterStatistics,
and this will give us information of the statistics for a specific adapter.
So in this instance, I'm using Wi‑Fi.
It could be ethernet 0.
It could be any type of adapter that exists on that machine.
Now if I want to get more information about the adapter properties,
then I can use Get‑NetAdapter.
Now you'll notice I'm doing ‑Name and a *.
That means it will give me information for every network
adapter that exists on that device.
If you wish to do targeted, you'll simply put the name,
like in the last option where I say ‑Name Wi‑Fi.
And you'll see another one there where it says IncludeHidden.
And that's because sometimes the network adapters are hidden and not visible,
and so we wish to include those in that query as well.
Now if I also want to get that from a remote machine,
we're going to do something a little bit different.
We have to actually create a remote session to the machine.
We can't simply just say here's my computer name, go and get it.
In this instance, I'm utilizing a new session,
which is created by using New‑CimSession,
which I passed the ComputerName to.
Once the session has been created,
then I have a property on the Get‑NetAdapter called CimSession,
which then I'm allowed to pass those values across.
So just remember, even though we've been utilizing ‑ComputerName,
not every PowerShell command works that way.
You will often need to create a session somewhere and then pass the
PowerShell command into the session and have it execute remotely.
Now what about if you wanted to perform a network trace?
Well, the first thing we have to do is create the network event session,
so we have to create this session that we're going
to utilize for doing the trace.
We then need to add the event provider that we wish to
utilize to perform the network trace, and then we can start the session.
Once that session's executed and began,
then we can start to retrieve the session details.
Then we run it for a period of time, and then we stop the event session,
and then we will clean up and remove the created session.
Now what I will say here is network traces can retrieve a lot of information,
so you will want to ensure that you run it for a short space of time
and then stop and clean and remove those sessions.
Now to perform a network trace, we're first going to create that session,
so I'm going to say New‑NetEventSession and give it a name.
I've called it Session‑001.
I'm then going to add my provider,
which in this example is going to be Microsoft‑Windows‑TCPIP.
So what I'm looking for here is TCPIP traffic that's
leaving the device that I'm utilizing or the remote
machine that I would be connecting to.
Once I have those two created, I can then start my event session,
so I can use Start‑NetEventSession.
And then if I want to view any of the data at any point,
I can simply just say Get‑NetEventSession,
and it will start to retrieve the values back.
Once I've completed this, I can then say edit and remove.
I can say stop this specific session and then remove the session at that point.
That will allow me to have performed a network trace.
Now, of course, we can also use other tools,
which is great because when we're utilizing PowerShell we
don't necessarily have to use the cmdlets.
We can use existing tools that have been around for a long time.
And one of those would be netsh, which is in executable that's available.
What we can do is combine things together.
So we can call an older executable or even a newer
one by utilizing Start‑Process, which is part of PowerShell.
So in this example, I'm actually outputting to a log directory.
And then I'm creating a new process, which is pointing to netsh.
And then I'm populating all of the argument list and the
properties that the executable requires.
And then at that point,
it can execute a process using the previous kind of older
version of netsh instead of using PowerShell.
Don't underestimate using previous executables.
They are still just as powerful even as some of the
PowerShell commands that exist.
Now, of course, if we wish to retrieve the network session entries,
then we can go through and say Get‑WinEvent,
and then you can see I'm utilizing an exported path here,
which is called Trace.etl.
That will go ahead and bring me those values,
and I'm saying, get me the Oldest ones first.
If I want to query the logs, then I can use simple Where commands.
So I can say log.Where a specific ID equals,
and then I can get the various properties such as
the messages that have come in.
Or I can do a query and say show me everything in that log where the
provider name was the TCPIP that we selected previously.
What you are able to do at that point is,
of course,
because you want to do forensics on that information is then
you then want to export that to a local file.
So I could simply say, get me the log object,
export it to a CSV using PowerShell Again,
set the delimiter,
and then I'm able to import that into another application to
be able to do further testing and querying.