Network Monitor : Release

Windows 7 and ISA Remote Windows Sockets Parsers Available

PaulELong — Thu, 04 Jun 2009 19:17:00 GMT

If you don't already know, we have been updating the our parsers for Network Monitor on http://www.CodePlex.com/NMParsers every month. Most recently we have updated the Windows parser set to support Windows 7 protocol updates. In the June parser release on CodePlex we have support for Remote Windows Sockets (RWS) protocol, which is used to proxy TCP and UDP traffic from Winsock applications. So now with the new parser set you can decode this traffic into the upper level protocols that ride on top of RWS.

These parsers rely on Network Monitor 3.3, so please upgrade first if you haven't already. Please visit NMParsers on CodePlex and download the last parser set so you can get the most up to date parsing experience. Enjoy!

Top Users Expert for Network Monitor 3.3

PaulELong — Fri, 01 May 2009 00:48:00 GMT

One of the major new features in Network Monitor 3.3 is the ability to run experts directly from the UI. And now NMTopUsers is available from our Experts Portal. Plus as it's a CodePlex project, we have opened the source code as well. It's a fairly simple C# project which uses the NMAPI to access data from a trace. You can view and download the source code if you are interested in more details.

What Does NMTopUsers Do?

The problem we are trying to solve is a way to quickly identify the heaviest users of network traffic. For instance you might want to understand if there's a computer on your network that is hogging all the bandwidth. You might also want to identify a chatty machine which could be an indication that it has been infected with a virus or adware.

There are actually two experts in one here. The Endpoint version shows traffic for each machine address, IPv4, or IPv6 address on your network. The Conversation version, on the other hand, shows traffic based on a pair of machines, IPv4, or IPv6 addresses so you can understand the traffic involved between machines.

How Does NMTopUsers Work?

Once you've installed the expert by running the MSI, "Top Users by Endpoint" and/or "Top Users by Conversation" will appear in the experts menu. Once you run the expert a new window will show up and display a data grid. The data will depend on any display filters applied or conversation tree nodes you might have selected. The data grid contains a list of nodes or conversations and then statics on the frames and bytes that have been sent and/or received.

By default the data is sorted by Total Bytes. But you can click on any column header to sort by that column.

The Address Type drop-down lets you select which types of addresses you want to see. By default we only show IPv4 addresses, but you can add Machine addresses and IPv6 addresses as well.

The Tree View allows you to see the IPv4 and IPv6 address as they relate to the Machine addresses that they belong too. But as you can imagine this option is only available if you've enabled the Machine address type. Also if you've re-sorted on a different column in the Tree View, you can reset to the original order by using the Reset Tree button.

Finally you can create a Pie or Bar chart of the information. While sometimes this can be cluttered due to the number of addresses, it can give you a high level overview of the usage. Keep in mind that the Bar chart can't display if you have Machine Addresses selected and multiple IPv4 or IPv6 addresses for a single machine address. This is because the bar chart attempts to line up each IPv4/IPv6 address with its matching Machine address and this doesn't make sense with multiple IP addresses.

Give it a Run

Please go to the Experts Portal and download both Top Users for Conversations and Endpoint. Try it out!

Network Monitor 3.3 has arrived!

PaulELong — Wed, 22 Apr 2009 06:17:00 GMT

Guest blog by Tawanda Sibanda, Lead Program Manager for Network Monitor

Ladies and gentlemen … the Microsoft Network monitor team is excited to announce the release of Network Monitor 3.3. A record 7 months after version 3.2 this is our quickest release ever, but also one of our most functionality-rich. We have added some innovative features that will simplify your network troubleshooting needs. As always, we have also continued to fix bugs and improve the product in those little but important ways.

Let’s take a quick tour of Network Monitor 3.3.

Where are the bits?

Network Monitor 3.3 is available here http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=983b941d-06cb-4658-b7f6-3088333d062f on Microsoft.com

Network Monitor 3.3 will also be offered as an optional feature package in the next few weeks via Microsoft Update if you have a previous version of Network Monitor 3.x installed. To check for updates, click on Help>Check for Updates from the product menu (versions 3.1 and higher) or visit the site http://update.microsoft.com/microsoftupdate

What’s New in Network Monitor 3.3

· Ability to capture WWAN (mobile broadband) and Tunnel traffic on Windows 7.

· Full Hyper-V support on Windows Server 2008

· Right-click-add-to-alias: Right-click a frame in the Frame Summary window with an IPv4, IPv6 or MAC address to add that address as a new alias. This is one of those little things that simplifies your work-flow.

· Right-click-go-to-definition: Have you ever wondered where and how the protocols fields you see in the Frame Details are defined in our in-built parsers? Wonder no more. Introducing right-click-go-to-definition: right-click a field in the Frame Details window and select Go To Data Field Definition or Go To Data Type Definition to see where the field is defined in the NPL parsers.

· Autoscroll: Another one of those little, but priceless things … auto-scroll. See the most recent traffic as it comes in. In a live capture, click the AutoScroll button on the main toolbar to have the Frame Summary window automatically scroll down to display the most recent frames as they come in. Click Autoscroll again to freeze the view in its present location.

· Core Parser Set: We heard your concerns about our parsing performance, and created an optimized Core parser set that only contains 32 protocol parsers for network layer and transport protocols (e.g., Ethernet, IP, and TCP). This parser set can increase your parsing performance by up to 200% depending on the data you are viewing. To enable the Core parser set, go to Tools > Options from the main menu, and click on the Parser tab. Click on the Common folder and click the stubs button to load stub parsers for this folder. Do the same thing for the Windows folder. Your final set up should be as follows:

· ETL Support: Network Monitor 3.3 can open and correlate information in ETL files generated by Network Tracing in Windows 7.

And now for the main event … two of our most exciting features that will revolutionize how you analyze your traces:

· Frame Commenting: Read all about this feature in our previous blog article. Briefly, Frame Commenting lets you attach comments to frames in a saved capture file. Select the Frame Comments tab in the lower-right window to add, view, edit, or delete comments. With this feature you can annotate a trace with your comments and observations and store that metadata directly with the capture file itself!

· Experts: Experts are stand-alone applications that analyze Network Monitor capture data. In Network Monitor 3.3 we provide a simple interface for registering experts with the product and invoking them on a saved capture file. We have made some initial experts available online at http://go.microsoft.com/fwlink/?LinkID=133950. Simply install the experts and run them directly from the UI on a capture file. Better yet, why not create your own expert! We provide a rich API that allows you to filter and parse capture data. We also have a sample SDK on the same experts portal to get you started on creating an installable expert that you can share with others. If you are interested in creating an expert we would love to hear from you. Leave a comment on the blog and Paul will get back to you.

Let us know what you think

We live for feedback, negative or positive. Go to http://go.microsoft.com/fwlink/?LinkID=142458 and let your opinion be heard. The survey requires you to log on with your Windows Live ID.

Enjoy!

Microsoft Network Monitor Team

Left->Right: Xumin Sun, Jin Feng, Darren Fisher, Jim Huang, Ralph Case, Michael Hawker, Paul Long, Saurabh Verma, Ashish Panday, Dave MacDonald, Ning Yang, Fred Wurden, Kathy Snow, Xin Shen, cow, Gi youl Kim, Sean Spratt, Lin Zhong, Tawanda Sibanda

Network Monitor 3.3 Beta Available on Connect

PaulELong — Wed, 04 Mar 2009 23:25:00 GMT

It’s time again for a new Beta version of Network Monitor. Using your feedback we’ve added some compelling new features! One in particular is the ability to launch experts from the UI. And what use would this be without something to launch? We’ll also be releasing some cool experts, like Top Users and Simple Search. In fact Simple Search is already available, just use the Experts menu from a saved trace to connect to our Experts landing page. Return every so often to see what is new.

What’s an Expert? What is Simple Search?

An expert is a tool, run separately from Network Monitor that performs expert analysis on your trace data. For instance, Simple Search will allow you to search all trace data for strings and better yet, regular expressions! Need to find an email address or phone number, but don’t know exactly which one? A regular expression, using Simple Search, lets you find this type of string. Just launch the expert from the menu and search away.

But there’s so much more, so let’s list out what else is new.

What’s New in NM3.3 Beta

Ability to capture on WWAN and Tunnel interfaces on Win7
Critical fixes to NM3.3 to operate correctly with Hyper-V
Right-click add to alias. Right-click a frame in the Frame Summary window with an IPv4, IPv6, or MAC address to add that address as a new alias.

Right click go to definition: Right-click a field in the Frame Details windows and select Go To Data Field Definition or Go To Data Type Definition to see where the field is defined in the NPL parsers.
Auto-scroll. See the most recent traffic as it comes in. In a live capture, click the Autoscroll button on the main toolbar to have the Frame Summary window automatically scroll down to display the most recent frames as they come in. Click Autoscroll again to freeze the view in its present location.
Experts available online: Experts are stand-alone applications that analyze Network Monitor capture data. Various experts are available online at http://go.microsoft.com/fwlink/?LinkID=133950.
Frame Comments: Attach comments to frames in a saved capture file. Select the Frame Comments tab in the lower-right window to add, view, edit, or delete comments.

API Extensions: API methods have been added to enable access to conversation information, properties, field display strings, and comments.
Ability to open ETL files and correlate information by Network Tracing scenario.

See our Release Notes for a complete list of new features and known issues.

Gimme, Gimme, Gimme!

The Beta is available on our connect site at https://connect.microsoft.com/site/sitehome.aspx?SiteID=216. But it is only available as a download if you join Connect. By joining you’ll also get updated when we release and be able to file bugs with us if you find issues. So give NM3.3 Beta a test drive and please let us know what you think!

Provide feedback at http://go.microsoft.com/fwlink/?LinkID=142458 (you will need to login with your Connect Network Monitor credentials to see the Beta survey). Our voting website, input.microsoft.com has an expired certificate that we are working to renew. For now, you can tell your browser to ignore the expired certificate as we address this problem.

Network Monitor 3.2 has arrived!

PaulELong — Wed, 17 Sep 2008 17:32:00 GMT

I’m so excited about this release I had to commandeer Paul’s blog for the day and write about it. My name is Tawanda Sibanda and I am the lead program manager for Network Monitor. The team put a lot of effort into this version, adding many of the requests we heard from our customers, while simultaneously fixing bugs and stabilizing the product. We hope you enjoy this release! Please feel free to leave feedback on Paul’s blog or participate in our Network Monitor survey

Now, let’s deep dive into some of the details of Network Monitor 3.2

Where are the bits?

Network Monitor 3.2 is available on Microsoft.com. The link is: http://go.microsoft.com/fwlink/?LinkID=103158&clcid=0x409

Network Monitor 3.2 will also be offered as an optional feature package in the next few weeks via Microsoft Update if you have a previous version of Network Monitor 3.x installed. To check for updates, click on Help>Check for Updates from the product menu (versions 3.1 and higher) or visit the site http://update.microsoft.com/Microsoftupdate.

So What’s New in Network Monitor 3.2?

Process Tracking: Now you can identify rogue applications sending network data! View all the processes on your machine generating network traffic (process name and PID). Use the conversation tree to view frames associated with each process.

Capture engine re-architecture to improve capture rate in high-speed networks. Network Monitor 3.2 drops significantly fewer frames that Network Monitor 3.1.
Find conversations: You asked for this. Many of our users found conversation tracking to be difficult to use as the view grew hard to manage, and it was difficult to correlate the frames they were seeing with the conversation nodes in the tree. Now, you can quickly isolate frames in the same network conversation. Just right-click on a frame and select a conversation to track, and you will see all the frames in that conversation. View TCP streams, HTTP flows etc.

Extensive parser set: Parsers for over 300 protocols! As before, the parsers are fully customizable.
Better parser management: By default only a subset of parsers are loaded. You can load the full parser set by going to Tools>Options>Parser and choose Full vs. Stub implementations.
CodePlex Ready: In the upcoming months, we plan to place all our Windows parsers on the Microsoft open-source CodePlex site and allow the community to modify and contribute parsers. You can find out more information on this here. This version of Network Monitor seamlessly integrates new parser packages.
Network Monitor API: Create your own applications that capture, parse and analyze network traffic!
More extensive documentation of the API and NPL. Access the documentation from Help > NPL and API Documentation.
IA64 builds.
PCAP capture file support*.
ContainsBin Plug-in: Search frames for arbitrary byte sequences or strings.
… and more. See our Release Notes in the Help directory of the installation folder for a complete list of new features and known issues.

Enjoy!

*This feature includes software developed by the University of California, Berkeley and its contributors.
This feature includes software developed by the Kungliga Tekniska Hogskolan and its contributors.
This feature includes software developed by Yen Yen Lim and North Dakota State University.

Network Monitor 3.2 Beta has released!!!

PaulELong — Thu, 12 Jun 2008 16:53:00 GMT

I’m excited to announce that the Network Monitor 3.2 Beta has released. There are some exiting new features listed below of which many I have already spoken about in this blog:

http://blogs.technet.com/netmon/archive/2007/12/28/santa-s-bag-was-full.aspx

One feature I didn’t mention is our new capture buffer to avoid dropping frames. After adding our drop frames counter, we found out under certain busy situations it would go above zero and we just couldn’t have that. We now buffer the frames before parsing and displaying them. While this does add some complexities to capturing, it insures that packets are more reliably captured which is obviously very important. I will blog about this feature specifically, but I wanted to call it out here.

Where are the bits?

As usual we are hosting our beta at http://connect.microsoft.com under the Network Monitor 3 Project. If you are already signed up, you should have it listed on the main page. If not, look for the project and join up with us to help us find bugs. There is also a web page forum front end to our newsgroup if you need to get support or ask general questions.

What’s New since Netmon 3.1

Process Tracking: View all the processes on your machine generating network traffic (process name and PID). Use the conversation tree to view frames associated with each process.

Find conversations: Quickly isolate frames in the same network conversation. Isolate TCP streams, HTTP flows etc.

PCAP capture file support
Capture engine re-architecture to improve capture rate in high-speed networks. Network Monitor 3.2 drops significantly fewer frames that NM3.1
Extensive parser set: Parsers for over 300 protocols! Parsers for the protocols covered by the Windows Open Protocol Specifications (see http://msdn.microsoft.com/en-us/library/cc216517.aspx).
NM API: Create your own applications that capture, parser and analyze network traffic!
Better parser management: By default only a subset of parsers are loaded. You can load the full parser set by changing the parser search order in Tools>Options>Parser
Support for frame truncation. Go to Tools>Options and limit the number of bytes captured per frame to improve performance.
More extensive documentation of the NPL which includes documentation on the new NMAPI. Access the documentation from Help > NPL and API Documentation
Enhanced filtering on items within NPL while loops or arrays. You can specify an index into the array or while loop to filter on
IA64 version now available.
ContainsBin Plug-in: Search frames for arbitrary byte sequences or strings. For example, ContainsBin(FrameData, ASCII, “msn”).
More UI indications of conversation status, dropped frames and the number of frames in the capture buffer.

… and more. See our Release Notes in the NM3.2 installation directory for a complete list of new features and known issues with the Beta.

Enjoy!

The Network Monitor Team

SMB2 Parser for NM3.1

PaulELong — Tue, 06 May 2008 22:12:00 GMT

We have decided to release an SMB2 parser for Network Monitor 3.1 (released July 07) to hold people over untill the beta for Network Monitor 3.2 releases in early June.

Where can I get the SMB2 parser?

You can download SMB2.NPL parser, along with SPARSER.NPL, CER.NPL, FCCS.NPL, SCNA.NPL and SMB.NPL (all supporting parsers) on http://connect.microsoft.com under the Network Monitor 3 project. If you’ve already signed up you’ll see it as one of your active projects. If you need to sign up you will need to create a passport account and join our project. Once you are in on the Network Monitor 3 project, click on the Downloads link on the left. You will see SMB2 Parser as one of the selections.

How do I use the new SMB2 parser?

Look at the article on using the SSL parser (http://blogs.technet.com/netmon/archive/2007/10/23/new-ssl-public-parser-available-how-to-deal-with-new-parsers.aspx) in the sections “Where do I stick it?” and “Working with NPL Parser path”. The instructions for installing the SMB2 parsers are the same.

Happy SMB2 parsing!

NM3 One Click Capture Tool - BETA

PaulELong — Tue, 06 Nov 2007 17:56:10 GMT

Wish you could get a network capture from a computer with no capture software installed? Wish you could have a network traffic "flight recorder" on a USB key? Here's your answer!"

The motivation behind creating this tool was to provide an extremely simple way to get a trace from an end user. And the name says it all, though maybe a small bit of false advertisement as it may take a bit more than just one click :). Once you have it downloaded to your machine, you can launch the executable and it will lead you through some simple dialogs that install the tool and start a trace. Once the trace is complete, which means it was manually stopped by the user or the default time of 2 hours have passed, a window will be opened to the location for the capture, called OneClick.cap.

Two Versions for Two Scenarios

One Click Autorun: The main scenario is a customer who has network access and can simply click on the EXE from a share or get the tool locally using the internet. Running this version will install NM 3.1 on your machine (if you do not already have a previous version of NM 3) and begin capturing. The capture will terminate after 2 hours, or if you press the 'x' key on your keyboard. If you did not have NM3 on your machine previously, NM 3.1 will subsequently be uninstalled.

Extract Only: For this scenario, the user doesn’t have network access at all. This version is tailor made for use with a USB drive to be inserted into a problem machine. If you place the files on the root of a flash drive, One Click will run automatically when you insert the drive. You can also run One Click by double clicking the file "OneClick.cmd" in the destination folder. The resulting capture will be copied back onto the USB device.

Detailed Tour of a One Click Capture

First thing I should mention is if you are running on Vista and don’t have NM3.1 previously installed or you are not a member of the Netmon User’s group, then you will need to run the EXE with elevated rights. Just right click the EXE and select “Run as Administrator”.

When you launch the One Click tool, it will prompt you with a EULA dialog. Assuming you accept the terms, then click YES. Remember that we do install a driver for Vista in cases where NM3 is not already installed. Also one caveat here is that if NM3.0 is installed, we use that driver rather than installing a new one. The disadvantage here is that NM3.0 can’t do wireless monitor mode or RAS capturing.

Once you accept the EULA, a CMD prompt dialog with a red background and white text shows up. We leverage NMCap for this job which is a command line utility, hence the CMD window. The window contains instructions as to where the capture file will be put by default. If you want to change this location, you can type a new one now.

If you choose the default be pressing enter, the capture will be started. At this point typing X on the keyboard will stop the capture once you are done. If you don’t press the X key, the capture will complete after 2 hours.

When the capture completes, an explorer window will open to the location where the capture file was stored. This allows the user to simply send the file to you in email or upload it to a location where it can be accessed by the original requestor.

If multiple captures are taken with the tool, the current OneClick.cap file will be renamed and appended with an incrementing number on the end.

Obtaining the Tool

At this point we are beta testing the tool. So the only means of getting it is on the Network Monitor project on http://connect.microsoft.com. When you join the project, you will see both the Auto-run and Extract Only packages in the download section. Once we release the tool, we will make it available on the Microsoft Download site as this is more convenient, which is our goal for this tool.

New SSL Public Parser Available: How to deal with new parsers

PaulELong — Tue, 23 Oct 2007 23:39:02 GMT

You’ve made some changes to your parsers and want to keep things organized. With the release of SSL.NPL, which we will also talk about today, it makes sense to understand how to work with parsers when you want to update or modify them. So I’d like to go over some strategies for keeping out of NPL H-E-double hockey sticks. If you are not familiar with this term, don’t worry, it is just a synonym for a type of file management night mare. It’s happened before, so we have learned some lessons and will attempt to help, but sometimes…some things…are in the user’s hands.

Where do I get it?

The SSL.NPL parser is available on our connect.microsoft.com site. http://Connect.microsoft.com is where we host our Netmon community. You can keep up to date, file bugs, and ask questions on our new forum (it’s still a newsgroup, but there’s now a web interface). From the connect.microsoft.com site, you should be able to get to the Network Monitor 3 project if you’ve already signed up. If not, just create a new account and then join the Network Monitor 3 project. Once you are on our site, you can click on the Downloads link on the left side. This will show you a list of files, one of which is the SSL.NPL parser.

Where do I stick it?

You could just plop the SSL.NPL file right on top of the old one in C:\program files\Microsoft Network Monitor 3\NPL, and things will work just fine potentially for the rest of you and your computer’s life. But there is a potential problem lurking.

In this case it’s the next update that may cause a problem. Not so much if we send out a new SSL.NPL, but more if you decide to change a parser yourself. It’s called forward integration, and it makes things complex. In this situation you have to figure out the difference you made and integrate into the new SSL parser, or vice versa if you prefer. Either way it’s an issue that not easy to resolve automatically and does require some user intervention.

But even in the replacing the SSL with new one, there are problems. On Vista, we should not be writing to the Program Files directory. So saving a file there using NM3 could end up shadowing it to some other directory (AppData\Local\VirtualStore\Program Files\Microsoft Network Monitor 3\NPL). So if you ever have a situation where you think you are updating the correct version of SSL.NPL in the NM3 editor, you may not be touching the invisible one. This has also caused problem in the past when trying to update from NM3.0. In any case we hope to address this for NM3.2.

Working with NPL Parser path

The solution is to store your NPLs in your own personal NPL directory using the Tools, Options dialog on the parsers tab. In NM3, you have the ability create a parser load order. This is a list of directories that are searched in order for each parser we encounter. When an NPL file includes another, we search each path in order and load the first NPL we encounter that matches. Even if the file is local to that NPL file, we still use the search order path.

We do create a personal NPL directory (documents\NM3\NPL), but it doesn’t automatically get added to your parser path. So it will search your local directory first and then each path listed in the options dialog in order (top to bottom). Add your local version first and then add the directory for versions of MS supplied files and finally add in the “C:\program files\Microsoft Network Monitor 3\NPL” directory so it searches that directory last. It won’t search the Program Files directory automatically once you add at least one directory in parser search path.

Once you’ve modified your path and added the new version of SSL.NPL, you’ll either need to restart NM3.1, or rebuild the parsers from the parser tab. Since we’ve already plugged a stub version of SSL into public build, no other modifications are need in the parsers to call the new SSL parser. In the case of a new parser, however, you would have to add this to sparser.npl.

This technique helps solve the problem by making sure you don’t clobber the original files. If we update a file, you can also check your local changes and forward integrate our changes in to your version. And if it’s Vista, we can make sure the versions of MS updates end up in an obvious place. Forward integration is a whole other topic, but there are difference tools which display file differences and make it easy to take changes from one file into another. But for simple changes this can be done by hand.

Improvements in NM3.2

There are things we can do in the future to make this more transparent to the user. And working more cooperatively with Vista is one of our goals for the next version. Fortunately this is not something most of us do all the time.

Network Monitor 3.1 Has Released!

PaulELong — Tue, 03 Jul 2007 00:23:00 GMT

The NM3.1 is now available on http://connect.microsoft.com featuring wireless sniffing and an easier way to create filters using "Right Click Add To Filter". Here is a list of features that are new to NM3.1.

What's New in Network Monitor 3.1?

Wireless (802.11) capturing and monitor mode on Vista – With supported hardware, (Native WIFI), you can now trace wireless management packets. You can scan all channels or a subset of the ones your wireless NIC supports. You can also focus in on one specific channel. We now show the wireless metadata for normal wireless frames. This is really cool for t-shooting wireless problems. See signal strength and transfer speed as you walk around your house!
RAS tracing support on Vista – Now you can trace your RAS connections so you can see the traffic inside your VPN tunnel. Previously this was only available with XP.
Right click add to filter – Now there's an easier way to discover how to create filters. Right click in the frame details data element or a column field in the frame summary and select add to filter. What could be easier!
Microsoft Update enabled – Now you will be prompted when new updates exist. NM3.1 will occasionally check for a new version and notify you when one is available.
New look filter toolbar – We've changed the UI related to apply and remove filters. You can now apply a filter without having to UN-apply it first.
New reassembly engine – Our reassembly engine has been improved to handle a larger variety of protocol reassembly schemes.
New public parsers – These include ip1394, ipcp, ipv6cp, madcap, pppoE, soap, ssdp, winsrpl, as well as improvements in the previously shipped parsers.
Numerous Bug Fixes – We've taken your reported problems on the connect site and fixed many of the confirmed bugs.
Faster Parser Loading – We've significantly improved the time it takes to load the parsers. Now rebuilding takes a fraction of the time it used to.

How do I get NM3.1?

NM3.1 is currently available on http://connect.microsoft.com. You will need to sign in with your passport account and participate in the Network Monitor 3 project, if you haven't already. Once you do this, you'll have access to the latest download. This will also give you access to our bug filing process and access to our news groups for getting support. We will also release NM3.1 on the Microsoft Download site within the next few weeks.

Enjoy!

Network Monitor 3.1 Beta Has Released!

PaulELong — Wed, 09 May 2007 04:04:00 GMT

The NM3.1 Beta is available on http://connect.Microsoft.com and simmering with new features for you to test. I'll bet you can't wait to sniff wireless management traffic; for sure an exciting new feature. Not sure how to create a filter? Now this is much easier with our new right click, add to filter feature.

What's New in Network Monitor 3.1?

Wireless (802.11) capturing and monitor mode on Vista – With supported hardware, (Native WIFI), you can now trace wireless management packets. You can scan all channels or a subset of the ones your wireless NIC supports. You can also focus in on one specific channel. We now show the wireless metadata for normal wireless frames. This is really cool for t-shooting wireless problems. See signal strength and transfer speed as you walk around your house!
RAS tracing support on Vista – Now you can trace your RAS connections so you can see the traffic inside your VPN tunnel. Previously this was only available with XP.
Right click add to filter – Now there's an easier way to discover how to create filters. Right click in the frame details data element or a column field in the frame summary and select add to filter. What could be easier!
Microsoft Update enabled – Now you will be prompted when new updates exist. NM3.1 will occasionally check for a new version and notify you when one is available.
New look filter toolbar – We've changed the UI related to apply and remove filters. You can now apply a filter without having to UN-apply it first.
New reassembly engine – Our reassembly engine has been improved to handle a larger variety of protocol reassembly schemes.
New public parsers – These include ip1394, ipcp, ipv6cp, madcap, pppoE, soap, ssdp, winsrpl, as well as improvements in the previously shipped parsers.
Numerous Bug Fixes – We've taken your reported problems on the connect site and fixed many of the confirmed bugs.

How do I get NM3.1 Beta?

The beta will be available on http://connect.microsoft.com. You will need to sign in with your passport account, and if you haven't already, participate in the Network Monitor 3 project. Once you do this, you'll have access to the latest download. This will also give you access to our bug filing process and access to our news groups for getting support.

Our Release Cycle Strategy

It seemed only a few months back we released NM3.0. Oh wait; it was a few months back. One of the fundamental principles on our team is to release frequently. This allows us to provide quick updates for bug fixes as well as adding new features. If a feature doesn't make it in this build, you don't have to wait very long for the next beta. Now the one drawback is that we may not be able to cram in as many features for each release, but in the long run this will help us keep agile and provide the features that are most important today.

Enjoy!

Network Monitor 3.0 has released!!

PaulELong — Wed, 22 Nov 2006 17:32:00 GMT

After many months of hard work we are proud to announce the Release to Web of Microsoft Network Monitor 3.0 (NM3). The final version is available from Microsoft Connects site (http://connect.microsoft.com). The Connects site does require you have a passport account, but this is also free.

What you get for your money

Well since it's free, I suppose you get infinite value. But in nut shell here are some of the key features of NM3.

A completely new user interface
Real time capture and display of frames
Simultaneous capture on multiple network adapters
Multiple simultaneous capture sessions
Network conversations and a tree view displaying frames by conversation
A new script-based protocol parser language, and script-based parsers
Support for Vista/Windows XP/Windows Server 2003
Support for 32bit and 64bit platforms

Done but not finished

While work on the 3.0 release has completed, we have already started work on the next version. There are plenty of improvements and new features that we want to provide moving forwards. We have grand ideas for the future, but had to stop somewhere. And the best thing is that you won't have to wait years for the next version. Our current plan is to release the next version in 6-8 months, though don't hold me to that. I'm sure you know how schedules work, and how hard it is to predict the future.

How Do I Report Problems or Suggest Improvements?

The Connect site has link on the side bar that says Feedback. This is where you would go to provide us with bug reports or suggest ideas that you think would improve our product. We will personally look at your bug report, and if necessary ask for more information. So remember to check back in case we need more information.

How do I get unconfused?

The Connect site also has a Newsgroup link on the sidebar. Once you set your newsgroup password you will be able to join our newsgroup and ask questions in one of the four categories (capturing, filtering, general, npl). Just pick the most appropriate section and ask away. Hopefully somebody on our team or another helpful individual will be able to resolve your issue.

Download and Enjoy

Once you sign in to the Connects site and participate in our product, you'll get to download Network Monitor 3.0 for free. And please let us know what you think by participating in surveys and providing us feedback on the Connects site.

Overview of NetMon by Yuri Diogenes

PaulELong — Thu, 28 Sep 2006 16:41:00 GMT

This article was original posted by Yuri Diogenes on http://blogs.technet.com/latam in Spanish.

Overview of Network Monitor 3 Beta 2

1. Summary

Microsoft is releasing the Beta 2 version of the Network Monitor 3 and we would like to show you some powerful features of this new version that will help you to analyze the packets that are passing though your network. Here are some key features of this new version:

· Completely new user interface that gives you more flexibility to work with captures

· Now you can see the frames while capturing data in real time

· Simultaneous capture on multiple network adapters

· Multiple simultaneous capture sessions

· Network conversations and a tree view displaying frames by conversation

· A new script-based protocol parser language, and script-based parsers

· Support for Vista, Windows XP and Windows Server 2003

· Support for 32bit and 64bit platforms

· New filtering panel with the capability to manually write the filters.

The next session will give you practice examples of some of new features described above.

2. New way to view things

The Network Monitor 3 was completely redesigned to provide the user a better experience while capturing and analyzing network traffic. Now with only one click you can select the network that you want to bind during the capture. With the new design you can see on the same window the filters, the frame summary, frame details and the Hex details.

· Capturing: To start a new capture on Network Monitor 3 you just need to click on the “Create a new capture tab” button. This will create a new tab which contains five panels. On the toolbar you have the play button that starts the capture.

· Real time results: When you starts the capture you can see the traffic in real time on the Frame Summary panel and on the status bar you can see the amount of frames that were capture. On the frame summary panel you also can see that during the capture time the netmon will temporally save the frames in a temp file. To stop the capture click on the stop button on the toolbar. After click on the stop button you can see that the traffic light on the tab became red just to emphasize that you are not capture anything at this point.

· Isolating Frames: On the frame summary window you can select the frames that you want to view separately and then right click on it and chose the option “View selected frame(s) in a new Window”. Another way to aggregate frames in separate files is using the feature call “Buffer Manager”.

3. Filtering

Probably one of the most powerful features on this new version is the way that we can create filters to better analyze the data. The flexibility and interaction that this feature provides are key elements that can save you time during the troubleshooting.

Here we have an example of this filter:

In this example we are filtering all TCP packets using port 8080 where the destination IP address is 192.168.0.3. Although you can manually write your filter the Network Monitor 3 interface already have some pre-defined filters to use for common situations. You can apply this pre-defined filter using the “Load Filter” button, besides the save button in the display filter window.

You can also customize your filter based on the pre-defined filters, you can load the pre-defined filter and manually change the content writing what you want. Another good feature that comes with the filter panel is the IntelliSense that contains the data fields supported by each structure/protocol. The example below shows this feature:

In this example the protocol DNS has the supported data fields that are displayed on this dropdown window. You can select one based on what you want to filter on. Before apply the filter using the “Apply Filter” button you also can verify if the command and syntax that you wrote are correct, to do this you just need to click on the “Verify Filter” button. This option will validate if the filter is correct or not and it will underline the operator or function that was not correct written.

For more filter examples you can use the option “How Do I” on the toolbar and select the option “Use Filters”. The documentation that comes with the product is also very helpful. On the Help folder underneath Network Monitor Folder you have some DOC files with examples of filters that you can use it.

4. Command line version

Sometimes the online analyzes is not what you really want, because sometimes you are troubleshooting an issue that doesn’t happen all the time, however you want to start a capture when one determine thing happens on the network. For this kind of scenario you can use the command line version of the Network Monitor 3, which is the command nmcap.exe.

Let’s see an example of this feature:

- You want to capture the data when the DNS QRecord Question Name contains the value mainisa.ctest.com, the file size should not be bigger than 6MB and the capture needs to stop after two minutes:

nmcap /network * /capture contains(dns.qrecord.questionname,'mainisa.ctest.com') /file dns.cap:6M /stopwhen /timeafter 2 min

This is a good way to keep monitoring the traffic when something that you want to see happens, besides that you are limiting the size of the file, which is good because you don’t need to worry about create a big file that will be hard to read it. You can find more examples using the command: nmcap /examples.

6. Where can I get it?

The Network Monitor 3 Beta 2 is available for customers to evaluate it, follow the steps below to download it:

1. Go to http://connect.microsoft.com

2. Sign in with your passport account

3. Choose "Available Connections" on the left

4. Choose "Apply" for Network Monitor 3.0 (once you've finished with the application, the selection appears in your "My Participation" page)

5. Go to the Downloads page (On the left side), and select the appropriate build 32 or 64 bit build.

We hope that you have a great experience with this new version, your evaluation and feedback are really important to us keep improving this product.

Yuri Diogenes

Support Engineer – Latin America Team – Platforms

Microsoft

A new era of network sniffing has begun...Network Monitor 3.0

PaulELong — Thu, 28 Sep 2006 00:17:00 GMT

A new era of network sniffing has begun at Microsoft with the soon to be released Network Monitor 3.0. So, it seems appropriate that we create a Network Monitor Blog site to accompany it. [So this is what a Blog feels like, nice!]

The Essentials

Microsoft Network Monitor 3.0 Beta 2, where is it?

We currently have a Beta version of Network Monitor 3.0 available on our Microsoft Connects site (http://connect.microsoft.com), you'll need a passport account. Select "Available Connections" and look for Network Monitor 3.0. Once you sign up, it will appear in your "My Participation" section. Feel free to download, provide feedback, and use the newsgroups.

Microsoft Network Monitor 3.0 Beta 2, what is it?

Network Monitor 3.0 is a total overhaul of our previous Netmon2.x program. We actually threw out everything and started from scratch. This has produced a much easier and safer way to analyze network traffic.. DLLs for parsers have the inherent problem of overruns, which pose security risks. All of our parsers are based on editable scripts, (Netmon Parsing Language or NPL), which define how protocols are parsed. Nearly 200 of these scripts are included in the beta release and the list keeps growing. Users can easily review and modify these protocol definitions to add their own protocols or update our definitions as they see fit.

Key features of Microsoft Network Monitor 3.0 include:

A completely new user interface
New powerful filtering
Real time capture and display of frames
Simultaneous capture on multiple network adapters
Multiple simultaneous capture sessions
Network conversations and a tree view displaying frames by conversation
A new script-based protocol parser language, and script-based parsers
Support for Vista/Windows XP/Windows Server 2003
Support for 32bit and 64bit platforms

Who Am I?

My name is Paul Long, and I’ve worked for Microsoft for the last 15 years. Most of my career has been spent in our support organization, and primarily supporting the OS platforms with the Critical Problem Resolution group (CPR). Networking has been my specialty for the last 4 years, though I’ve been involved with networking at many different times in my career. My first job was installing Novell back in the day, and then again with Microsoft’s introduction of Windows for Workgroups 3.1. It was at this time I discovered what a sniffer was, and at that time it was a hunk of a portable (30 lbs Compaq I think), created by Data General. And now my life evolves around Network Monitor 3.0 and its upcoming incarnations.

What is this Blog all about?

The main focus of this Blog is to discuss the features of Network Monitor 3.0 and future versions. This includes how the GUI works, using filters, as well as how NPL works. But I also want to talk about trouble shooting network problems in general and discuss how to apply the features we have in Netmon3.0 towards finding and fixing networking issues.