Detect changes to routing table or address resolution protocol on Windows 7

3

On two different Win7 PCs we're having a very specific problem where connecting a device which uses a RNDIS driver sometimes disrupts the PC's network adapter connection (we detect this because we then temporarily lose the connection to our Oracle database). We have determined that the problem occurs only when the device gets connected and Windows activates the driver. We never have a connection problem if the device stays connected or stays disconnected.

Someone suggested that we should monitor the routing table or the address resolution protocol (ARP) to see if something abnormal could be observed when the connection problem occurs. But, since the problem occurs randomly, I need a way to automatically detect changes to the routing table and to the results of the ARP. Specifically, I want to be able to compare the results of the route print and arp -a commands in a good and a bad case.

Are there any software that would help me monitor and log those changes? Optimally, I would like to avoid having to write a software that listens to WinAPI events.

Fueled

Posted 2011-07-08T11:45:56.557

Reputation: 151

Answers

1

This sounds like a typical usecase for SNMP. Microsoft has documented how they expose the table via SNMP, and there are many network monitoring tools that can read that SNMP. You might even be able to use the Microsoft tool snmputil, although that is very basic.

MSalters

Posted 2011-07-08T11:45:56.557

Reputation: 7 587

Forgive my ignorance if I have misunderstood, but 1) I don't want to diagnose a remote machine, but local changes on a PC, 2) I want to automatically detect changes, not have to manually query. Therefore, I don't know how SNMP could help me diagnose my problem. – Fueled – 2011-07-11T15:16:27.963

>

  • is a simple case of pointing your SNMP tool to localhost, 2) is a standard functionality of SNMP monitoring tools. (snmputil may not, but as I said, that's a very basic tool. You'd just use that to quickly prove that the SNMP table does change.)
  • < – MSalters – 2011-07-12T11:08:16.850

    I should have mentioned I'm an absolute novice when it comes to networking. Can you recommend an SNMP monitoring tool? – Fueled – 2011-07-13T06:22:13.057