windump and pcap for Windows and interface name enumeration

Tonight I took the plunge: I moved from winpcap and windump from Riverbed (formerly from CACE and before that from Politecnico di Torino) to npcap. There are lots of great reasons discussed on the npcap page, not to mention that winpcap hasn't had an update since 2013.

Even though I installed it with winpcap compatibility, I still got an error when running windump. That was fixed by installing WinDump for Npcap (see the Releases section for pre-compiled binaries).

It has always bothered me that enumerating interfaces using windump -D was more luck and trial-and-error than actually being able to see which interface you want to dump. So I wrote a little batch file called listif.cmd that will give me a nice list so I can run windump -i # to dump my packets. Besides windump itself, it doesn't require anything that doesn't come with Windows.

@echo off

setlocal ENABLEDELAYEDEXPANSION

set LIST=%temp%\getmac-list.txt

echo Getting available adapter list...
getmac /fo csv /v > %LIST%

echo Resolving available adapter list...
for /f "tokens=1,3 delims=.{}" %%a in ('windump -D') do (
 for /f "tokens=1,2 delims=," %%m in ('findstr "%%b" %LIST% 2^>nul') do (
  set CONN_NAME=%%m
  set ADAPTER_NAME=%%n
  echo  %%a. !CONN_NAME:"=! (!ADAPTER_NAME:"=!^)
 )
)

Batch down-sampling lots of MP3 files

I had to convert about 1,100 mp3 files from 44.1 kHz to 22.05 kHz so I could get them from a total of 6 gigabytes to 3 gigabytes. I just thought I would share my process.

First I had to decide what software to use. There are two that came to mind: FFmpeg and LAME. I primarily use Windows 10, but I also administer several Linux systems. I try to pick whichever one will be most efficient. For tasks I do on my own computer, I sometimes do it “natively” in Windows, and sometimes I use the Windows Subsystem for Linux, which is a full-blown Debian installation.

This time, however, I just did it in Windows. Here is the batch file I wrote to do it. I will include comments afterward. The thing to know is that the folders with the audio all have the format NN-LLL (N=number; L=letter).

1. @echo off
2. 
   
3. for /d %%I in (??-???) do (
4.  for %%J in (%%I\*.mp3) do (
5.   if not exist _22kHz\%%~nxJ (
6.    ffmpeg -i %%J -ac 1 -ab 64000 -ar 22050 _22kHz\%%~nxJ
7.   )
8.  )
9. )

I put it in a numbered list so I can refer to the line numbers.

Line 3 says to get a list of all directories that have the format XX-XXX and put them in a variable called ‘I.’ I often pick ‘I’ because that's what the examples at the end of “for /?” in command prompt use, so it's a no-brainer. The ‘/d’ is necessary because the ‘for’ command will ignore directories by default.

Line 4 looks in the directory stored in variable ‘I’ and gets a list of all the mp3 files and stores them (with pathname) in the variable ‘J.’

Line 5 indicates that my output folder is called ‘_22kHz.’ I had manually created this folder (an important step!). So it says that if the file doesn't already exist in that folder, go ahead and run line 6. The ~nx is important because it basically strips the full path name of the file and gives you just the file name, so we can accurately check for it.

Line 6 is the actual FFmpeg command to convert to 64k bit rate at 22.05 kHz sampling. It reads the file in the ‘J’ variable and outputs it to the new ‘_22kHz’ folder.

Regular Expression for Book/Chapter of the Bible

What perl-compatible regular expression (PCRE) could match books/chapters of the bible?
How about this one:

/(^[123]?(\s+)?[a-zA-Z\s]+)(\s+)?([0-9]+)/

---

Everything between the first set of parenthesis is the book name. The parenthesis are done so we can pass the variables separately on to an array. This is a common task in working with PCRE, but for simply matching a pattern, may or may not be necessary. Though the second set, putting the \s+ in parenthesis, is for grouping as opposed to passing.

^[123]?

First we have to see if it is one of the books that starts with (^) a 1, 2, or 3 (e.g., 1 Chronicles, 3 John). The question-mark means that it's optional, because most books of the bible don't have those.

(\s+)?

Next we have to check if there is a space between that and the book name, because when somebody is searching for a book of the bible, they may get lazy (like me) and not put in a space. Again, it's optional as to whether or not it's there, so we use a question-mark.

[a-zA-Z\s]+

Next we have to check for all variations of capital or small letters, and we need to allow spaces as well for books like "Song of Solomon" (actually that's the only one with a space in it). Instead of the question-mark we have the plus, because at least one of these is required. You could also use [\p{L}\s]+ in PCRE, where \p{L}, or it's long form, \p{Letter} indicates a letter from any language.

The second set of parenthesis is the chapter...

(\s+)?

Again, the space (or more than one space for that matter) is optional between the book name and the chapter.

([0-9]+)

A chapter. At least one chapter is required (the + symbol).

Pretty easy, and honestly I put this blog entry in for myself to quickly refer to in case I have documented all my code badly (which I have!).