New SSL Public Parser Available: How to deal with new parsers

re: New SSL Public Parser Available: How to deal with new parsers

xiaoyong_wu — Thu, 29 Nov 2007 03:20:41 GMT

I was trying to write a new parser to reassemble some payloads. Do you have any good example on how to do it?

re: New SSL Public Parser Available: How to deal with new parsers

PaulELong — Thu, 29 Nov 2007 17:39:13 GMT

You can look at http.npl, tcp.npl or ipv4.npl for examples. Just look for PayloadStart, which is the callout that determines how to do reassembly.

You'll want to look at the documentation in the help directory on the parser langauge for all the details, but basically you can do reassembly with sequence numbers, a length, or by specifically tagging the first, middle and last fragments.

If you have further questions, please ask in the NPL Forum on our connect.microsoft.com support site.

Thanks,

Paul

SMB2 Parser for NM3.1

Network Monitor — Wed, 07 May 2008 00:12:49 GMT

We have decided to release an SMB2 parser for Network Monitor 3.1 (released July 07) to hold people over