A VB script to stop a network trace based on trace contents

REM == kill_dumpcap.vbs starts here                                       
REM
REM kill_dumpcap.vbs
REM version 1.0 12-05-18
REM Noah Davids - noah@noahdavids.org

REM
REM This software is provided on an "AS IS" basis, WITHOUT ANY WARRANTY OR ANY SUPPORT OF ANY KIND. 
REM The AUTHOR SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR ANY
REM PARTICULAR PURPOSE.  This disclaimer applies, despite any verbal representations of any kind provided
REM by the author or anyone else.
REM

option explicit
  Dim fso, folder, colFiles, sFolder
  Dim baseName, baseNameLen, matchString, BPFString, confirmString, confirmStringFound, flag, PID, sleepTime, ngrepOut, terminatePID
  Dim maxIndex, maxIndex9, index, fileList, folderIdx, ngrepRun, oldFileList, sLine
  Dim wShell
  DIM objWMIService, colProcessList, objProcess
  
  If WScript.Arguments.Count <> 7 then
    WScript.Echo "Usage:"
    WScript.Echo "   csript kill_dumpcap ""Base Name"" ""matchString String"" ""Confirm String"" PID SleepTime Flag"
    WScript.Echo vbtab & "   ""Base Name"" is the base name of the files being created by dumpcap"
    WScript.Echo vbtab & "   ""match String String"" is an ngrep match condition that is looked for in the trace"
    Wscript.Echo vbtab & "   ""Packet Specification"" is an ngrep Berkely Packet Filter condition that is looked for in the trace"
    WScript.Echo vbtab & "   ""Confirm String"" is a string in the ngrep output that confirms"
    Wscript.Echo vbtab & vbtab & "ngrep found the correct string"
    Wscript.Echo vbtab & "   PID is the process ID of the dumpcap process to terminate. "
    Wscript.Echo vbtab & vbtab & "Use list_dumpcap to find it"
    Wscript.Echo vbtab & "   SleepTime is time in seconds"
    Wscript.Echo vbtab & "   Flag indictaes if dumpcap should be stopped if the ""Confirm String"" "
    Wscript.Echo vbtab & vbtab & "is found (+) or not found (-)."
    WScript.Echo
    WScript.Quit
  End If

  Set fso = CreateObject("Scripting.FileSystemObject")
  Set wShell = CreateObject("WScript.Shell")
  
  baseName = Wscript.Arguments.Item (0)
  baseNameLen = len (baseName)
  matchString = Wscript.Arguments.Item (1)
  BPFString = Wscript.Arguments.Item (2)
  confirmString = Wscript.Arguments.Item (3)
  PID = Wscript.Arguments.Item (4)
  sleepTime = Wscript.Arguments.Item (5)
  flag = Wscript.Arguments.Item (6)
  
  if flag <> "+" AND flag <> "-" Then
     Wscript.Echo "The Flag argument must be either a + or - character not """ & flag & """"
     Wscript.Quit
  End If
  
  if len (matchString) = 0 AND len (BPFString) = 0 Then
     Wscript.Echo "Either match string OR BPF string must be specified - both cannot be null"
     WScript.Quit
  End If
  
  Wscript.Echo "cscript kill_dumpcap """ & basename & """ """ & matchString & """ """ & _
       BPFString & """ """ & confirmString & """ " & PID & " " & sleepTime & " " & flag

REM General flow of program
REM
REM Create an output file name to accummunate the results of the ngrep command by appending a time string HH_MM_SS
REM to "ngrep_". This allows you to run multiples copies of the script to trigger on different things. There is
REM of course a window where two instances could create the same output file but its a small window.
REM Loop forever
REM   delete the ngrep_HH_MM_SS.txt file. Note that the HH_MM_SS corresponds to when the script was started
REM   create a collection of files that are in the current dir
REM   loop through the file collection and find the maximum index for the dumpcap base name. If it weren't for the
REM      fact that the index rolls over from 99999 to 00001 this would be easy. What I do is collect two maximum index
REM      values one for indexes starting with 9, that is 9XXXX named maxIndex9 and one for all others named maxIndex. 
REM      if maxIndex is the initial value of 00000 I used the maxIndex9 value or if the first character of maxIndex is 8
REM      and the first character of maxIndex9 is 9 I use the maxIndex9 value otherwise I use the maxIndex value. If
REM      you configure dumpcap to collect more than 10,000 files, that is yuo can files 89999 through 99999 and then 00001
REM      this algorithm will incorrectly pick 99999 as the maxindex. It will eventually scan the file so I am not sure
REM      this is a fatal flaw. At any rate collecting more than 10,000 trace files seems excessive so I am not going
REM      to worry about it.
REM   loop the the file collection (again).
REM      For each file that matches the base name, see if it also matches the max index. If it doesn't match the max
REM         index add it to a file list string and then search the old file list string to see if its already there.
REM         NOTE that if the dumpcap ring of files is large enough we will probably exceed some maximum string size.
REM         I tested this with 100 files without problems.
REM         if there is a file that is not in the old file list then run ngrep on the file looking for the
REM               match string or packet specification. Put the output in the ngrep_HH_MM_SS.txt file. It is
REM               possible that there could be several new files so all the output is accummulated in the
REM               ngrep_HH_MM_ss.txt file. Note that if a match string is found don't include the -e argument
REM               -e causes all the packets with no data to be matched as well. You need the -e when using
REM               a BPF string so the confirmation string can be one of the TCP flags.
REM   If ngrep was run then the file list string built in the previous loop is different from the old list
REM      so the first thing to do is update the old file list. Then open the ngrep_HH_mm-ss.txt file and read
REM      each line looking for the confirmation string. This second test is needed because I couldn't figure
REM      out how to confirm that the ngrep found at least 1 packet that meet its specifictaions (or didn't
REM      as indicated by the flag variable just by looking at the ngre_HH_MM_SS.txt You cannot do it based
REM      on file size. We can stop reading as soon as 1 confirmation string is seen.
REM   If the confirmation string is found and the flag is positive we need to terminate dumpcap. If the 
REM      confirmation string is not found and the flag is negative we need to terminate dumpcap.
REM   To terminate dumpcap we search the process list for the process ID that was provided as an input
REM      argument. Once found it is terminated and we quit out of this program as well. If the process
REM      cannot be found we report that and we just quit out of this program.
REM   Assuming we do quit the program we sleep for the indicated time and then start the loop again

  ngrepOut = "ngrep_" & Hour (Time) & "_" & Minute (Time) & "_" & Second (Time) & ".txt"
    
  oldFileList = ""
  While (1)
    fileList = ""
    wShell.Run "cmd.exe /c DEL " & ngrepOut, 7, 1
    ngrepRun = 0  
    Set folder = fso.GetFolder(".")
    Set colFiles = folder.Files
    maxIndex = "00000"
    maxIndex9 = "00000"
    For each folderIdx In colFiles 
       if mid (folderIdx.Name, 1, baseNameLen) = baseName Then
          index = mid (folderIdx.Name, baseNameLen +2, 5)
          if mid (index, 1, 1) = "9" Then
             if StrComp (maxIndex9, index, 1) = -1 Then maxIndex9 = index
          Else
             if StrComp (maxIndex, index, 1) = -1 Then maxIndex = index
          End If
       End If
    Next
    If mid (maxIndex, 1, 1) = "8" and mid (maxIndex9, 1, 1) = "9" Then
       maxIndex = maxIndex9
    Else 
       If maxIndex = "00000" Then maxIndex = maxIndex9
    End If
    For each folderIdx In colFiles
       if mid (folderIdx.Name, 1, baseNameLen) = baseName Then 
          if mid (folderIdx.Name, 1, baseNameLen + 6) <> baseName & "_" & maxIndex Then
             fileList = fileList & folderIdx.Name & " "
             if instr (oldFileList, folderIdx.Name) = 0 Then
                Wscript.Echo "New file " & folderIdx.Name
                if len (matchString) > 0 Then
                   wShell.Run "cmd.exe /c ngrep -q -I" & folderIdx.Name & _
                		" """ & matchString & """ " & BPFString & " >>" & ngrepOut, 7, 1
                Else wShell.Run "cmd.exe /c ngrep -q -e -I" & folderIdx.Name & _
                		" """ & matchString & """ " & """" & BPFString & """ >>" & ngrepOut, 7, 1
                End If
                ngrepRun = 1
             End If
          End If
       End If
    Next
    if ngrepRun Then
       oldFileList = fileList
       confirmStringFound = 0
       Set colFiles = fso.OpenTextFile (ngrepOut)
       Do Until colFiles.AtEndOfStream
          sLine = colFiles.ReadLine
          if instr (sLine, confirmString) > 0 Then
             confirmStringFound = 1
             Exit Do
          End If
       Loop
       colFiles.Close
       
       terminatePID = 0
       If Flag = "+" AND confirmStringFound = 1 Then
          Wscript.Echo "Found confirmation string """ & confirmString & """"
          terminatePID = 1
       ElseIf Flag = "-" AND confirmStringFound = 0 Then
          Wscript.Echo "Did not find confirmation string """ & confirmString & """"
          terminatePID = 1
       End If
       
       if TerminatePID = 1 Then
          Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")
          Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE " & _
              "ProcessId = '" & PID & "'")
          if colProcessList.Count = 0 Then
             Wscript.Echo "Could not find process with PID = " & PID
             Wscript.Echo "Terminating kill_dumpcap at " & (Date) & "_" & (Time)
             Wscript.Quit
          Else
             For Each objProcess in colProcessList
                 Wscript.Echo "Terminating process with PID = " & objProcess.ProcessId & _
                    " at " & (Date) & "_" & (Time) 
	             objProcess.Terminate()
             NEXT
          End If
          Wscript.Quit
       End If
       
    End If
    Wscript.sleep sleepTime * 1000
  Wend
REM
REM == kill_dumpcap.vbs end  here 

REM == list_dumpcap.vbs starts here                                       
REM
REM list_dumpcap.vbs
REM version 1.0 12-05-20
REM Noah Davids - noah@noahdavids.org

REM
REM This software is provided on an "AS IS" basis, WITHOUT ANY WARRANTY OR ANY SUPPORT OF ANY KIND. 
REM The AUTHOR SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR ANY
REM PARTICULAR PURPOSE.  This disclaimer applies, despite any verbal representations of any kind provided
REM by the author or anyone else.
REM

option explicit
  Dim wShell
  DIM objWMIService, colProcessList, objProcess

  Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")
  Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE " & "Name = 'dumpcap.exe'")
  if colProcessList.Count = 0 Then
     Wscript.Echo "Could not find a dumpcap.exe process"
  Else
     For Each objProcess in colProcessList
         Wscript.Echo objProcess.CommandLine & " started on " & objProcess.CreationDate & _
           " PID = " & objProcess.ProcessId
	 NEXT
  End IF               
REM
REM == list_dumpcap.vbs end  here