0

I'm trying to automate the Paketbeat installation, but one of the required things on Windows is that you need to find the device id of the active network adapter. The list of devices can be queried with .\packetbeat devices.

An example output is:

PS C:\Program Files\packetbeat> .\packetbeat.exe devices
0: \Device\NPF_NdisWanIp (NdisWan Adapter) (Not assigned ip address)
1: \Device\NPF_NdisWanBh (NdisWan Adapter) (Not assigned ip address)
2: \Device\NPF_{DD2F4800-0DEB-4A98-A302-0777CB955DC1} (AsyncMac Adapter) (Not assigned ip address)
3: \Device\NPF_NdisWanIpv6 (NdisWan Adapter) (Not assigned ip address)
4: \Device\NPF_{5B8B7F6A-EF39-4D95-A3A5-4BF70077E936} (VMware vmxnet3 virtual network device) (12.54.26.105)
5: \Device\NPF_{B8522370-3DA7-4F29-91FC-0718181D5661} (MS LoopBack Driver) (0.0.0.0)

In the above use case I would need to retrieve 4. Or

PS C:\Program Files\packetbeat> .\packetbeat.exe devices
0: \Device\NPF_NdisWanIp (NdisWan Adapter) (Not assigned ip address)
1: \Device\NPF_NdisWanBh (NdisWan Adapter) (Not assigned ip address)
2: \Device\NPF_{DD2F4800-0DEB-4A98-A302-0777CB955DC1} (AsyncMac Adapter) (Not assigned ip address)
3: \Device\NPF_{8E8A32C0-6E4D-46ED-9723-9D656A26D1F5} (EMULEX) (12.54.18.145)
4: \Device\NPF_NdisWanIpv6 (NdisWan Adapter) (Not assigned ip address)
5: \Device\NPF_{83485D06-422D-4558-AC88-5D0EB800BB1C} (MS LoopBack Driver) (fe80::ezeb:459b:61a4:c175 0.0.0.0)
PS C:\Program Files\packetbeat> .\packetbeat.exe devices | Select-Object

In the above use case I would need to retrieve 3. I'd love to find the ID with PowerShell based on the device ID which has an IP configured starting with 12.45.

Ansgar Wiechers
  • 193,178
  • 25
  • 254
  • 328
willemdh
  • 796
  • 2
  • 13
  • 34

1 Answers1

1

Use the -match operator to filter the output for the line ending with a matching IP address, then split that line at colons and pick the first element from the resulting array:

((packetbeat.exe devices) -match '\(12\.54\.\d+\.\d+\)$' -split ':')[0]
Ansgar Wiechers
  • 193,178
  • 25
  • 254
  • 328
  • packetbeat documentation says that by specifying "any" in the configuration we can sniff the data out of all the devices on the server. Is there an alternative for this on Windows? – Abhi Mar 21 '18 at 01:17
  • @Abhi Please post your question as a new question. – Ansgar Wiechers Mar 21 '18 at 01:41
  • Thanks. Just asked a new question here https://stackoverflow.com/questions/49396920/how-to-configure-packetbeat-to-sniff-any-devices-on-windows – Abhi Mar 21 '18 at 01:56