Evolution of Message Analyzer and Windows …...What is Message Analyzer Protocol and Log File...

2014 Storage Developer Conference. © Microsoft. All Rights Reserved.

Evolution of Message Analyzer and Windows Interoperability

Paul Long Microsoft


2

What is Message Analyzer?

blogs.technet.com/MessageAnalyzer


What is Message Analyzer

Protocol and Log File Analysis Tool Correlation across traces and logs Visualize Data

Trace Collection Tool Remote and Local ETW events

4


Demo: A quick tour

5

Start Page News


Demo: A quick tour

6

Start Page Settings

Synchronized

Not Synchronized


Demo: A quick tour

7


Demo: A quick tour

8


Demo: A quick tour

9

Trace Viewer

Message Stack Tool

Message Detail Tool

Various Stacked Tools

View Filter Tool

Session Tool

Status Bar

Viewer Actions


Demo: A quick tour

10


Demo: A quick tour

11


12

Demo: Correlation with

Multiple Logs


Differences – Netmon

TCP (135)

Ethernet

IPv4

SMB Req (partial)

TCP (135)

Ethernet

IPv4

TCP (135)

Ethernet

IPv4

TCP (135)

Ethernet

IPv4

SMB Resp


Differences – Wireshark

TCP (135)

Ethernet

IPv4

SMB Req (Reassembled)

TCP (135)

Ethernet

IPv4

TCP (135)

Ethernet

IPv4

TCP (135)

Ethernet

IPv4

SMB Resp


Differences – Message Analyzer

TCP

Ethernet

IPv4


TCP

Ethernet

IPv4

TCP

Ethernet

IPv4

TCP

Ethernet

IPv4

SMB Resp ReassembledTCP

(meta)

SMB Operation Summary of Request and Response Top Level

Protocol

Top Level Operation


Message Analyzer

Network Moniotr

Wireshark



TCP

Ethernet

IPv4


TCP

Ethernet

IPv4

TCP

Ethernet

IPv4

TCP

Ethernet

IPv4


(meta)

Top Level Protocol

Hide Operation



TCP (135)

Ethernet

IPv4


TCP (135)

Ethernet

IPv4

TCP (135)

Ethernet

IPv4

TCP (135)

Ethernet

IPv4


(meta) TCP Viewpoint

SMB Operation Summary of Request and Response Top Level

Protocol

Top Level Operation



TCP (135)

Ethernet

IPv4

TCP (135)

Ethernet

IPv4

TCP (135)

Ethernet

IPv4

TCP (135)

Ethernet

IPv4

TCP Viewpoint

SMB Operation SMB Operation SMB Operation SMB Operation

Top Level Summary Property


Differences – Message Analyzer in 3D

Ethernet Ethernet Ethernet Ethernet




IPv4 IPv4

IPv4 ARP

ARP IPv4

ARP

ARP

IPv4

IPv4IPv4

IPv4 IPv4 ARP

IPv4

IPv4

TCP TCP TCP

TCP

TCP TCP

TCP TCP

TCP

TCP

TCPTCP VIEWPOINT

TLS HTTP Chunk

TLS

TLS

TLS

HTTP Chunk

SMBResponse

ReassembledTCP

SMBRequest

HTTP Response

HTTP Request

Network:192.168.1.10-192.168.1.20Transport: 443-3333


Network:00-50-8D-B6-CD-56-00-50-8D-B6-CD-66


C1Network:192.168.1.10-192.168.1.20Transport: 443-3333


C3Network:00-50-8D-B6-CD-56-00-50-8D-B6-CD-66


1s

2s

3s

4s


Differences – Message Analyzer in 3D

Ethernet Ethernet Ethernet

Ethernet Ethernet



IPv4 IPv4

IPv4

IPv4

IPv4

IPv4IPv4

IPv4 IPv4

IPv4

IPv4

TCP TCP TCP

TCP

TCP TCP

TCP TCP

TCP

TCP

TCP



Network:00-50-8D-B6-CD-56-00-50-8D-B6-CD-66




C3Network:00-50-8D-B6-CD-56-00-50-8D-B6-CD-66


1s

2s

3s

4s


Differences: Session Explorer

24

Total number of messages at the bottom. For a .cap or .pcap. This is

what Netmon/Wireshark display

Total Number after data is reassembled and summarized with

operations.


Dealing with Encrypted Traffic

Capture before encryption HTTPs IPSEC SMB SMB Direct

Decrypt a trace afterwards

26


27

Demo: Post Decryption


Decrypting a trace

28


Decrypting a trace

29

Decryption Tool can be docked anywhere.

1

2


Decrypting a trace

30

3. Decrypted Traffic for the in focus

selected message

1. Select successfully decrypted session

from Decryption Tool

2. This triggers a global selection of those messages


Decrypting a trace

31

Selection Tool Window is a helpful way to find all the

selected messages and bring each one in focus.


Decrypting a trace

32


Questions? 33


Resources

http://blogs.technet.com/MessageAnalyzer http://social.technet.microsoft.com/Forums/en-

US/home?forum=messageanalyzer http://connect.Microsoft.com/Site216

34

http://blogs.technet.com/MessageAnalyzer

http://social.technet.microsoft.com/Forums/en-US/home?forum=messageanalyzer

http://social.technet.microsoft.com/Forums/en-US/home?forum=messageanalyzer

http://connect.microsoft.com/Site216

Evolution of Message Analyzer and Windows …...What is Message Analyzer Protocol and Log File...

Documents

Transcript of Evolution of Message Analyzer and Windows …...What is Message Analyzer Protocol and Log File...