Unable to download Wireshark Patches

Products

Patch Management Solution IT Management Suite

Issue/Introduction

There are a few customer that are unable to download Wireshark Patches using the SMP Console. Customer checked with firewall team if any port is blocking the download from the Altiris Console but everything looks fine from their end. They are able to access the download link via browser from our computers and the SMP (The Download link is found in the SMP Logs - open LogViewer to review the logs).

We were able to use the PSPing command (included with Sysinternals PSTools) to validate customer has access to 2.na.dl.wireshark.org, and can download the files from a Browser when logged into the SMP with the Application Identification account.

You can also use Powershell Command Test-NetConnection <ipaddress> -port <port> to get similar results to PSPing. More information on Test-NetConnection: https://docs.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps

One thing that has changed, is that Wireshark updated the URL for download. Previous URL was www.wireshark.org and the new URL is 2.na.dl.wireshark.org. Customer state that previous updates were staged just fine on the SMP.

Environment

Patch Management 8.x

Cause

From the SMP Logs we found that the download failed for: https://2.na.dl.wireshark.org/win64/Wireshark-win64-3.2.10.exe

Error message: The request was aborted: Could not create SSL/TLS secure channel.

We also see these download links, and their intended destination:

Start download [from:'https://2.na.dl.wireshark.org/win32/Wireshark-win32-3.4.6.exe' to:':\Program Files\..\Updates\WIRES34-210603\{82584f57-1ff4-4042-8866-04971aa0c13b}\Wireshark-win32-3.4.6.exe' task:Download Software Update Package]
Finished download [from:'https://2.na.dl.wireshark.org/win32/Wireshark-win32-3.4.6.exe' to:':\Program Files..\..\Updates\WIRES34-210603\{82584f57-1ff4-4042-8866-04971aa0c13b}\Wireshark-win32-3.4.6.exe' task:Download Software Update Package time:00:01:00.5092000]

Resolution

While the URL is the only thing that has changed programmatically, we suspect that this issue is environmental as our testing has shown that these packages can be downloaded and staged in most environments. If you have other information that would help us resolve this issue for our customers, please contact support.

Workaround. Create a Software Package by Importing the Wireshark files as a new Software Package; then create a Managed Software Policy to deploy the Software Package, and finally create a Target of vulnerable systems.

Steps to complete the Workaround #1 using MANAGED SOFTWARE DELIVERY POLICY:

Download the files to any computer
1. The specific URL can be found in the SMP Logs for the patch you are trying to download. Alternatively, Google may be helpful
Copy the file over to the SMP
Use the Import Method to create a new Software Package
1. See Page 39 of KB 175693 (Software Management Best Practices) for additional information and instructions
Create a Managed Software Delivery Policy to deploy the package to targeted systems.
1. See Page 77 of KB 175693 for additional instructions
Create a Target of systems to deploy
1. Pages 78 and 71 of KB 175693

Workaround #2 brings the Wireshark update into PATCH MANAGEMENT by recreating the expected File Structure as if the files were downloaded by another SMP and then Importing the Files.

Part 1 - manually create the staging paths and files:

Open up the Altiris LogViewer(Start > Symantec > Altiris LogViewer)
Find the Failed download messages. If needed, use the Find: to search for "Wireshark"
There will be 2 error messages like this for each .exe:
1. [1 / 4] Downloading Software Update Package [Wireshark-win64-X.X.XX.exe for WIRES34-XXXXX]
2. Start download [from:'https://2.na.dl.wireshark.org/win64/Wireshark-win64-X.X.X.exe' to:'X:..\...\Updates\WIRES34-XXXX\{<XXXXXXX-some-GUID>}\Wireshark-win64-X.X.X.exe' task:Download Software Update Package]
These Log messages tell us:
1. How many Files there are
2. the Name of the Bulletin we are downloading
3. the GUID for that Bulletin
4. the URL / Download location for each file
Create a folder named Updates on the Desktop, or another location of your choice
Using the information from the Log file, create the expected Name \ {<GUID>} path in the Updates folder on the Desktop of the SMP
1. NOTE: The name of each bulletin and GUID will be different with each release.
Find file [1 / X], Locate its URL and Download the File using the browser of your choice.
Put the downloaded file in the following Path on the SMP: ..\Desktop\Updates\NameOfBulletin\{GUIDofBulletin}\File.exe
Repeat steps 6 - 8 with the next file until all files have been downloaded and put in the correct {GUIDofBulletin} folder. Make sure to add the { } around the GUID as part of the path.
On the Desktop, you will now have created the needed File Structure to Import the files into the SMP, continue to Part 2.

Part 2 - Importing the Staged files into the SMP

Open the SMP Console and go to Settings > All Settings > Software > Patch Management > Core Services
In Core Services, we are going to redirect the download to come from our Desktop or another location
Check the box next to Download from staging location: and enter the location of the files we created, i.e. C:\Users\MyUser\Desktop\Updates, and click save changes
Make sure the Application ID has rights to the location, and Use Application Credentials. Alternatively, enter the user credentials needed.
In the SMP Console - find the Wireshark Bulletin you want to roll out in the Patch Remediation Center and click "Download Packages"
1. The Files should be downloaded from your Desktop\Updates folder or another location
When the files download are complete, go back to Core Services, and uncheck the option "Download from staging location", and save changes
Check your Download Location in Core Services for the packages (i.e. ..\Program Files\Altiris\Patch Management\Packages\Updates)
1. They should be there just like they were created: Bulletin Name \ {GUID folder} \ .exe
At this point you should be able to use the Patch Remediation Center to create a Patch Policy and distribute the files to targeted systems.