Santa’s Bag was Full

Geek Lectures - Things geeks should know about » Blog Archive » Santa???s Bag was Full

Fri, 28 Dec 2007 21:35:10 GMT

PingBack from http://geeklectures.info/2007/12/28/santa%e2%80%99s-bag-was-full/

re: Santa’s Bag was Full

abhijit — Wed, 02 Jan 2008 23:21:13 GMT

Thank you - I look forward to NM 3.2.

The "extensibility" part of this parser is awesome - very powerful. Using the ParserLanguage.doc and the NPLs provided I wrote a parser for a proprietary protocol that is reasonably complicated. I am writing a Primer kind of a doc - if anyone wants - pl send me an email.

It would be very helpful (with 3.2) to be able to

- create short cuts (or macros) to launch a Protocol parser on a piece of data.

- change font size and type

Wish you all a wonderful 2008!

re: Santa’s Bag was Full

HeatfanJohn — Thu, 03 Jan 2008 17:51:42 GMT

Hi Abhijit,

I can't find your email address ...

My address is jpmasseria(at)yahoo(dot)com

I'm interested in reading your document.

Thank you,

John

re: Santa’s Bag was Full

PaulELong — Thu, 03 Jan 2008 17:57:43 GMT

Changing Font size is on our list (has been for a while). I'm not certain when we will implement this feature.

As for short cuts to launch a protocol parser, I'll have to add this one for consideration. It sounds like an interesting idea. You can highlight a portion of the hex details and decode as any protocol you want, but it sounds like you want to automate this a bit.

re: Santa’s Bag was Full

rferrisx — Mon, 14 Jan 2008 01:29:38 GMT

Here are some ideas that would be useful to testers and admins:

(1) some sample scripting that would log message to an event log when a filter's criteria is exceeded.

(2)a /q switch to install NM3 or nmcap remotely. Or just description of a process to install nmcap remotely so it could be run with psexec.

(3) some integration with Powershell SQL queries.

re: Santa’s Bag was Full

PaulELong — Mon, 14 Jan 2008 17:54:39 GMT

#1 Will be possible with the API. You'll be able programmatical filter capture data and then log an event or what ever you want when any criteria is met/exceeded.

#2 Is possible today. You can use the /quiet switch to install NM3. You should be able to run with PSExec or using Scheduler.

#3 This is another job that the API could handle, though I've not looked at Powershell integration to understand for sure how straight forward it would be. But the filtcap application I mentioned does something similar.

re: Santa’s Bag was Full

abhijit — Mon, 10 Mar 2008 22:26:35 GMT

Hello,

The protocol I am parsing is shown below

Protocol A

{

Preamble P;

Header h1;

header h2;

Payload P[n]

}

Premable is fixed size, whereas the Header is variable size. I am able to parse Protocol A and get it displayed properly. I modified TCP.npl to load this parser as required.

At the top level, I show a field from the Preamble. (Top level == before expanding in the Network Monitor- at Frame Summary). I am unable to show a field from h2. The field from Preamble is being shown using LookAhead, but I am not able to get the LookAhead working with accessing the field in h2. I am not able to resolve with the variable size of h1 and h2. Any comments / pointers you may have is very helpful.

Thanks a lot

re: Santa’s Bag was Full

abhijit — Mon, 10 Mar 2008 22:26:35 GMT

Hello,

The protocol I am parsing is shown below

Protocol A

{

Preamble P;

Header h1;

header h2;

Payload P[n]

}

Premable is fixed size, whereas the Header is variable size. I am able to parse Protocol A and get it displayed properly. I modified TCP.npl to load this parser as required.

Thanks a lot

re: Santa’s Bag was Full

PaulELong — Tue, 11 Mar 2008 17:57:12 GMT

I think I need more clarification on what you are asking. Are you trying to reference a field from h2 in P?

Can you send me the code for Header and Preamble to help me understand better what you are referencing?

Thanks,

Paul

re: Santa’s Bag was Full

abhijit — Wed, 12 Mar 2008 04:35:43 GMT

Thank you for the prompt response

> Are you trying to reference a field from h2 in P?

yes that is correct

> Can you send me the code ...

Here are the relevant portions

<BEGIN>

Struct aaHeader

{

aaPE h1;

aaPE h2 = FormatString("%s", GetCommandType(

AsciiString(h2.Value, 0, h2.ValueLen)));

}

Struct aaMessage

{

aaPreamble pre;

aaHeader hdrSet;

}

Protocol Avalanche = FormatString("TotalLength=%d ", UINT32(FrameData, offset))

{

// we *Lookahead* to decide if we have received h.abort

// Message header- h.mid(18 byte) and h.cmd(19 bytes) are mandatory,

// whereas h.abort is optional

switch ( UINT32(FrameData, offset + 4))

{

case 36:

case 37:

aaMessage Message =

FormatString("%s", GetCommandType(

AsciiString(

Message.hdrSet.h2.Value,

Message.hdrSet.h2.ValueLen)));

default:

avaAbortMessage AbortMessage;

}

///////////////////////

// Message Payload //

///////////////////////

while options[FrameData[offset] != 0xFF]

{

<END>

I am trying to display the h2.Value along with "Total Length".

Thanks again!

re: Santa’s Bag was Full

gazanga — Wed, 12 Mar 2008 16:17:30 GMT

I would love to see a sortable column (I know, I know). Lex from MSFT told me not to ask, but it would be swell if I could sort by such.

I'm pretty stoked! I've slowly been converting the network guys away from the *cough cough* other popular product.

I've noticed a problem where I'm only seeing one side of a conversation when using NLB also. With the *cough cough* other product, I can do a trace on each interface and get all the traffic, but in NM, I have to disable NLB in order to recreate and see all the traffic.

re: Santa’s Bag was Full

PaulELong — Fri, 14 Mar 2008 18:00:33 GMT

Abhijit, you may be running into an issue where structs with the same name get overwritten, but let's narrow down this further by finding some very simple NPL. One trick is that NPL doesn't have really do much, and we can simplify the whole thing down to follow. Creating an Sparser.npl with only this will build and you can view traces with it.

number byte

{

size = 1;

DisplayFormat = FormatString("%d", this);

}

struct aaPe

{

byte val;

byte len;

}

struct aaHeader

{

aaPe h1;

aaPe h2;

}

protocol frame

{

aaHeader header = FormatString("h1.val = %d h2.val = %d", header.h1.val, header.h2.val);

}

So the problem that this example exposes is that since h1 and h2 are both of the same type. The engine only remembers the last instance, so the aaHeader will show h1.val and v2.val as the same value. We can work around this problem by using properties, but first lets determine if this is the issue you are running into.

Can you confirm that this is the problem you are seeing?

Thanks,

Paul

re: Santa’s Bag was Full

PaulELong — Fri, 14 Mar 2008 18:05:49 GMT

Gazanga, sorting is on our list, but there are some difficulties with this. Currently we only resolve those frames which are currently in view. So to sort on a column would require we parse each frame summary and then sort. This could be a lengthy process, and also would require a way to keep different frame orders in memory. While this is all possible, we haven't had enough of a justification to do this. It would be nice to understand your requirements here as there may be better options here.

As for the NDR issue, I will have to investigate this futher. It's possible this is due to how our driver works. I would appriciate if you could file a bug on this on our http://connect.microsoft.com site under the Network Monitor 3 project.

Thanks,

Paul

re: Santa’s Bag was Full

abhirao — Sat, 15 Mar 2008 04:04:15 GMT

Hello Paul,

Thank you - yes you guessed it correct.

h1.val and h2.val show the same value

Abhijit

re: Santa’s Bag was Full

abhirao — Sat, 15 Mar 2008 04:25:54 GMT

Hello Paul,

Here is the modified portions of the npl that you pasted earlier

If there is a better way to do it - please let me know. Initially I started with AddToProperty - I could not get it to work - so I went this way.

struct aaHeader

{

[ Property.val1 = h1.val]

aaPe1 h1;

[Property.val2 = h2.val]

aaPe1 h2;

}

protocol avaFrame= FormatString("1 h1.val = %d h2.val = %d", Property.val1, Property.val2)

{

aaHeader header = FormatString("2 h1.val = %d h2.val = %d", header.h1.val, header.h2.val);

}

the string that starts with 2 displays incorrect values, whereas string that starts with 1 shows the correct values.

Thank you

re: Santa’s Bag was Full

PaulELong — Mon, 17 Mar 2008 16:46:18 GMT

Using the properties like you did is the proper work around. In the next version of NM3 this should not be neccessary as we've changed the way the engine deals with multiple structs with the same name.

Thanks,

Paul

re: Santa’s Bag was Full

kevers — Thu, 01 May 2008 02:37:22 GMT

I am not seeing any more talk about when NM3.2 will be released. I have an AirPCAP card and it appears that it will only work on NM3.2.

Thank you.

Kirk

re: Santa’s Bag was Full

PaulELong — Thu, 01 May 2008 06:22:24 GMT

We are actually delayed a bit, but we expect to ship a beta in may.

However, as for the AirPCAP card, this is not something related to our product. It is specific to the driver and their support for wireless management mode. Please contact that manufacturer to see if the support this mode.

Thanks,

Paul

Network Monitor 3.2 Beta has released!!!

Network Monitor — Thu, 12 Jun 2008 16:54:10 GMT

I’m excited to announce that the Network Monitor 3.2 Beta has released. There are some exiting new features

Network Monitor 3.2 Beta has released!!!

Bink.nu — Thu, 12 Jun 2008 17:50:40 GMT

I’m excited to announce that the Network Monitor 3.2 Beta has released. There are some exiting new features