NMExperts Discussions Rss Feed

New Post: TCP Analyzer

PaulLong — Tue, 14 May 2013 13:24:33 GMT

You can only run the expert on a single TCP conversation. If you select a different conversation in the conversation tree, or right click one of the frames in the conversation you are interested in and Find Conversation->TCP, the expert will run based on that selected conversation.

We don't have a tool to give a high level analysis of all the TCP messages. I'm not aware of a Network Monitor expert that does this.

Paul

New Post: TCP Analyzer

Patrickmoore — Tue, 14 May 2013 09:51:15 GMT

Conner1 there are many tools but what exact your requirement about data transmission means platform etc.

New Post: TCP Analyzer

conner1 — Mon, 13 May 2013 19:02:16 GMT

When I run TCP analyzer for a given application/program shown in network conversations, e.g. iexplorer.exe, it only seems to select/show statistics for the first TCP 'conversation' listed under it. I wanted to be able to find the stats (provided in TCP analyzer) for all of the traffic under iexplorer.exe (on 'My Traffic) and/or at least choose another TCP conversation that falls under it. I can't seem to get it to do either...

And/or is there another expert that provides high level summary stats (able to sort out by application running)? By high level summary stats I mean total number of bits received, transmitted etc. ( the numbers provided at top of TCP analyzer).

Thanks.

New Post: Created a capture file to identify reason for network spikes whilst gaming. What next?

PaulLong — Tue, 18 Dec 2012 18:25:55 GMT

From a general perspective, you can look at the application traffic specific by clicking on it in the conversation tree. Then you can look at each IP and TCP conversation underneath and see if you can spot something like a burst of traffic around a certain point. However, there's really not a good way to look at all traffic and look for spikes. In the Message Analyzer (the eventual replacement for Network Monitor) we have start create visualizers that can be configured to do this. You can play with the beta on http://connect.microsoft.com/site216, but there is nothing explicitly built in.

The only other option today is that you could add columns to the UI for TCPPayloadLength, (assuming it's TCP traffic), then export the data to Excel with copy/paste and do some analysis there. Other than that, you could use the API to extract the info you want.

Paul

New Post: Created a capture file to identify reason for network spikes whilst gaming. What next?

nightfrogs — Tue, 18 Dec 2012 16:11:56 GMT

Hi,

I downloaded Netmon hoping to identify the reason behind my lag spikes whilst gaming online. I created a short capture file but do not know how to interpret it to isolate any potential issues.

Can anyone point me in the right dfirection or help me understand the problems?

Thanks!

New Post: Did NetMon SDK has the API for switching to monitor mode & changing wifi channels?

w001en — Fri, 14 Sep 2012 17:25:12 GMT

PaulLong wrote:

You can use NDIS APIs to set the adapter mode. Since this functionallity is provided by NDIS, we chose not to duplicate that effort in our API. I would lookup information about NDIS_PACKET_TYPE_PROMISCUOUS. If you have further questions, you could ask in our MSDN forums.

Thanks,

Paul

Thanks very much.

New Post: Did NetMon SDK has the API for switching to monitor mode & changing wifi channels?

PaulLong — Fri, 14 Sep 2012 13:31:26 GMT

You can use NDIS APIs to set the adapter mode. Since this functionallity is provided by NDIS, we chose not to duplicate that effort in our API. I would lookup information about NDIS_PACKET_TYPE_PROMISCUOUS. If you have further questions, you could ask in our MSDN forums.

Thanks,

Paul

New Post: Did NetMon SDK has the API for switching to monitor mode & changing wifi channels?

w001en — Fri, 14 Sep 2012 07:29:52 GMT

I don't know if it‘s proper to ask this question in here but I do meet this problem, I saw that local and p mode are provided to choose when start capture and I didn't see monitor mode to be an option. So is this api not provided yet?

New Post: An expert to decrypt IPsec?

PaulLong — Fri, 17 Aug 2012 13:23:57 GMT

I'm not aware of any experts to do this. Perhaps another community member is aware of one.

Paul

New Post: An expert to decrypt IPsec?

johnconnett — Thu, 16 Aug 2012 08:57:44 GMT

Has anyone tried to produce an expert to decrypt IPsec? I'm particularly interested in pre-shared key encryption as used in Azure Virtual Network connections.

New Post: Hostotosto

Hostotosto — Wed, 20 Jun 2012 15:54:52 GMT

Hostotosto wrote:

Hello Paul

I managed to install the expert, but it still does not appear in Microsoft Network Monitor 3.4, the menu of experts. We must take additional steps?

Thanks,

Hostotosto

New Post: Hostotosto

Hostotosto — Wed, 20 Jun 2012 15:54:28 GMT

Hello Paul

I managed to install the expert, but it still does not appear in Microsoft Network Monitor 3.4, the menu of experts. We must take additional steps?

Thanks,

Hostotosto

New Post: Hostotosto

Hostotosto — Fri, 15 Jun 2012 20:14:57 GMT

Hostotosto wrote:

Hello Paul

I Microsoft.Common.Targhets generates this error: error MSB3073 error.
Regarding Expert.msi not create it, even if I take a punch.

Thanks,

Hostotosto

New Post: Hostotosto

PaulLong — Fri, 15 Jun 2012 20:14:55 GMT

That means the command line post-build steps returned and error. Can you paste the contents of the output? Did you follow all the prerequisite steps in the documentation?

Paul

New Post: Hostotosto

Hostotosto — Fri, 15 Jun 2012 20:11:09 GMT

Hello Paul

I Microsoft.Common.Targhets generates this error: error MSB3073 error.
Regarding Expert.msi not create it, even if I take a punch.

Thanks,

Hostotosto

New Post: Hostotosto

PaulLong — Thu, 14 Jun 2012 14:48:03 GMT

The document is "Writeing Experts for Network Monitor.docx". It appears in the ExpertExample Solution.

Running the expert doens't really do anything. It's just an example to show you how to create an expert that integrates into the UI.

After creating the debug project, do you now have an MSI? If not, can you create a release verison and see?

New Post: Hostotosto

Hostotosto — Wed, 13 Jun 2012 20:18:36 GMT

Hello Paul

I ran the Debug project Expertexample, gave me the following output:

The thread 0x13a4 has exited with code 0 (0x0).
'ExpertExample.vshost.exe' (Managed): Loaded 'C: \ Users \ PC-NOEMI \ Documents \ ExpertExample \ bin \ x86 \ Debug \ ExpertExample.exe', Symbols loaded.
The thread 0xcf0 has exited with code 0 (0x0).
The thread '<No Name>' (0x1368) has exited with code 0 (0x0).
The thread 0x1318 has exited with code 0 (0x0).
The thread 0x1570 has exited with code 0 (0x0).
The thread 0xda8 has exited with code 0 (0x0).
The program '[3980] ExpertExample.vshost.exe: Managed' has exited with code 0 (0x0).

thanks

Hostotosto

New Post: Hostotosto

Hostotosto — Wed, 13 Jun 2012 20:07:49 GMT

What document do you speak?

thanks

Hostotosto

New Post: Hostotosto

PaulLong — Wed, 13 Jun 2012 18:02:25 GMT

One other step you probably have to do is change the version to release and choose the approriate platform (x64 or x86). Then rebuild and paste any errors that show up. Make sure you've completed all the steps in the document referenced before.

Paul

New Post: Hostotosto

Hostotosto — Wed, 13 Jun 2012 16:42:03 GMT

Paul

In the folder is not present any msi, what I do is recompile again?

Thanks,

Hostotosto