Search code examples
powershellparsingtcppowershell-5.0nmap

Parsing NPING with powershell


I'm not sure how to start here, but I'd like to parse the output of nping with powershell. To handle the hosts that did send a response or syn/ack packet, hostname that was resolved, and the statistics such as sent/rcvd. Maybe into a formatted ouput, or ideally as values/objects that can be passed to other commands.

variable value

$allDCs.hostname
output:

piac2.prod.com
pidc1.prod.com
...(etc)

nping command and output

nping --tcp -p 53 $allDCs.Hostname -c 1 2>&1
output:

Starting Nping 0.7.70 ( https://nmap.org/nping ) at 2019-09-17 17:26 Mountain Daylight Time                                            
SENT (0.8900s) TCP 10.1.27.5:30887 > 10.20.6.42:53 S ttl=64 id=34100 iplen=40  seq=1487089230 win=1480                                 
SENT (2.3560s) TCP 10.1.27.5:30887 > 10.20.6.41:53 S ttl=64 id=34100 iplen=40  seq=1487089230 win=1480                                 
SENT (3.3600s) TCP 10.1.27.5:30887 > 10.39.97.149:53 S ttl=64 id=34100 iplen=40  seq=1487089230 win=1480                               
RCVD (3.4240s) TCP 10.39.97.149:53 > 10.1.27.5:30887 SA ttl=120 id=9453 iplen=44  seq=3297277271 win=8192 <mss 1360>                   
SENT (4.3640s) TCP 10.1.27.5:30887 > 10.39.99.202:53 S ttl=64 id=34100 iplen=40  seq=1487089230 win=1480                               
RCVD (4.4690s) TCP 10.39.99.202:53 > 10.1.27.5:30887 SA ttl=118 id=22952 iplen=44  seq=348121009 win=8192 <mss 1360>                   
SENT (5.3680s) TCP 10.1.27.5:30887 > 10.39.96.248:53 S ttl=64 id=34100 iplen=40  seq=1487089230 win=1480                               
RCVD (5.4320s) TCP 10.39.96.248:53 > 10.1.27.5:30887 SA ttl=120 id=15898 iplen=44  seq=1550015899 win=8192 <mss 1360>                  
SENT (6.3720s) TCP 10.1.27.5:30887 > 10.39.98.214:53 S ttl=64 id=34100 iplen=40  seq=1487089230 win=1480                               
RCVD (6.4240s) TCP 10.39.97.149:53 > 10.1.27.5:30887 SA ttl=120 id=9455 iplen=44  seq=3297277271 win=8192 <mss 1360>                   
RCVD (6.4760s) TCP 10.39.98.214:53 > 10.1.27.5:30887 SA ttl=118 id=15876 iplen=44  seq=1297194692 win=8192 <mss 1360>                  
SENT (7.3760s) TCP 10.1.27.5:30887 > 10.39.99.207:53 S ttl=64 id=34100 iplen=40  seq=1487089230 win=1480                               
RCVD (7.4810s) TCP 10.39.99.207:53 > 10.1.27.5:30887 SA ttl=118 id=31712 iplen=44  seq=1894886499 win=8192 <mss 1360>                                                                                                                                                         

Statistics for host plc2.prod.com (10.20.6.42):                                                                                
|  Probes Sent: 1 | Rcvd: 0 | Lost: 1  (100.00%)                                                                                       
|_ Max rtt: N/A | Min rtt: N/A | Avg rtt: N/A                                                                                         
Statistics for host pic1.prod.com (10.20.6.41):                                                                                
|  Probes Sent: 1 | Rcvd: 0 | Lost: 1  (100.00%)                                                                                       
|_ Max rtt: N/A | Min rtt: N/A | Avg rtt: N/A                                                                                         
Statistics for host pi-dc2.prod.com (10.39.97.149):                                                                             
|  Probes Sent: 1 | Rcvd: 2 | Lost: -1  (429496729600.00%)                                                                             
|_ Max rtt: 3060.000ms | Min rtt: 60.000ms | Avg rtt: 1560.000ms                                                                      
Statistics for host pivadc4.prod.com (10.39.99.202):                                                                             
|  Probes Sent: 1 | Rcvd: 1 | Lost: 0  (0.00%)                                                                                         
|_ Max rtt: 101.000ms | Min rtt: 101.000ms | Avg rtt: 101.000ms                                                                       
Statistics for host piodc1.prod.com (10.39.96.248):                                                                             
|  Probes Sent: 1 | Rcvd: 1 | Lost: 0  (0.00%)                                                                                         
|_ Max rtt: 60.000ms | Min rtt: 60.000ms | Avg rtt: 60.000ms                                                                          
Statistics for host pivadc1.prod.com (10.39.98.214):                                                                             
|  Probes Sent: 1 | Rcvd: 1 | Lost: 0  (0.00%)                                                                                         
|_ Max rtt: 100.000ms | Min rtt: 100.000ms | Avg rtt: 100.000ms                                                                       
Statistics for host pivadc2.prod.com (10.39.99.207):                                                                             
|  Probes Sent: 1 | Rcvd: 1 | Lost: 0  (0.00%)                                                                                         
|_ Max rtt: 101.000ms | Min rtt: 101.000ms | Avg rtt: 101.000ms                                                                       
Raw packets sent: 7 (378B) | Rcvd: 6 (276B) | Lost: 1 (14.29%)                                                                         
Nping done: 7 IP addresses pinged in 7.49 seconds 

how to generate the data for $allDCs

$domain1 = "prod.com"

$allDCs = $domain1 | %{ Get-ADDomainController -Credential prod\userx -Filter * -Server $_ }

Solution

  • Why not use test-netconnection instead?

    $allDCs.Hostname | test-netconnection -port 53 2>&1