NMExperts Wiki & Documentation Rss Feed

Updated Wiki: Filtering with Message Analyzer

PaulLong — Thu, 10 Jan 2013 19:53:21 GMT

I want to point out some differences between Message Analyzer and Network Monitor in a short series of blogs. In this first one, let’s discuss filtering. There are some nice shortcuts that make it easier to type in filters and some differences from Network Monitor. Our goal with Message Analyzer was to keep the flexibility and power user’s expect of filter creation, while providing more help and shortcuts. So while there are certainly differences with how filters are created, the premise is the same.

Filtering Shortcuts

With a better Intellisense still being implemented on our side, there are some discovery issues for these features. However, you can still take advantage these features which I’ve arranged below as a chart. Keep in mind that there is an example in the filter library for most of these.

Example	Feature	Description
TCP.Rst	Partial Paths	TCP.Flags.Rst is the formal full path. But you only have to put the first and last entity name to make a valid, yet more inclusive filter. This might not be as fast as a more precise filter, but the extent of which depends on the filter.
*port==135	Wildcards	You can also place a wild card before an element to filter any message which matched “port”. In this case UDP and TCP will be included, as well as any entity called port. It’s also important to note that port is a special way to reference both the source and destination. Again this is not as precise and performs worse than the example above.
*address==FF-FF-FF-FF-FF-FF	Wildcards	This is similar to above, but an important point is that what is on the left side of address might not be obvious. The hardware address could come from wireless or Ethernet. An IP address might be via the firewall or NDIS driver. The IPv4 layer doesn’t exist in the firewall driver, though there is an IPv4 type address there. Remember that Address is the IPv4 type, but IPv4 is the protocol/module name. This is really important when creating capture filters because IPv4.Address in the firewall will not match. Also important is that the right side can take on any valid literal form. So if you enter an IPv4 address on the right side, we will find those address that match that can return an IPv4 literal type. Again, the address is a special way to reference both the source and destination addresses.
HTTP.Uri contains “msn” TCP contains “Microsoft”	Contains	You can use contains to search a string or all the raw data. You can also search a specific protocol for a string. You can control case sensitivity, but by default it’s case insensitive. For instance ‘TCP contains “bLah” caseSensitive’ would search for “bLah” matching case. Look at the library to see other options for encoding types.
HTTP.Headers[“Host”] == “www.msn.com”	Maps	A big difference in Messages Analyzer is that we created a new type to handle HTTP data. Using a Map is a better data type to describe HTTP and others, but this makes the filtering the syntax different. An advantage is that we can now reference the HTTP fields using the exact match of the HTTP field name. Previously we had to remove dashes which could be confused for subtraction. For instance in Network Monitor 3.x, Content-Type was written as HTTP.Response.ContentType. But now you can Type HTTP.Response.Headers[“Content-Type”] which is more predictable and consistent. On the other hand we group HTTP request and responses as operations. And for an operation we also expose fields which lift some information from the request or response. For example HTTP.ContentType = “jpeg”. Intellisense will make this easier to explore.
Tcp.port != 80 SMB.FileName ~= “”	Existence	This is a Dusey J A feature where math and practicality collide. If you’ve used Network Monitor a lot, you’ll know there’s a difference between tcp.port != 80 and !(tcp.port == 80). This mathematical irony seems to tickle the OCD in all of us. See below for more detailed info.

Existence Example: TCP.Port != 3389 vs. SMB.FileName ~= “”

There are two possible outcomes a user wants. However, a confused user might try and use the same filter for two different situations.

Example 1: Getting Rid of Traffic

One example is that you want to get rid of TCP traffic by a port, commonly used to remove noise, like RDP traffic. A user could mistakenly type TCP.Port != 3389, for instance. But as you see below, the result is not correct. With Network Monitor we automatically assume you want to include only TCP traffic. Behind the scenes we apply a filter like (TCP && TCP. Port != 3389).

For Network Monitor, if you wanted to get rid of traffic, you type “!(tcp.Port == 3389)”. And of course this could be confusing since these two filters seem mathematically equivalent.

With Message Analyzer, the two statements are equivalent. And we no longer assume you want to look for traffic where the TCP.Port fields exists. Tcp.port != 3389 is the same as !(tcp.port == 3389).

Example 2: Displaying Data where the Field Exists

For this example I want to find messages where the SMB File Name is not blank. With Network Monitor, the default action is to only return those fields with the FileName field already there. So something like Property.SMBFileName != “”, returns what you want.

However with Message Analyzer, we don’t assume to check for existence and the result is not exactly what we want. In this example you see we return other messages like the TCP session setup. The filter is more explicit without the check for existence and since TCP doesn’t even have a matching entity, the message matches the filter because there it is true that the smb2.filename is not blank.

Now, we use a new operator, “~=”, which will additionally check for existence. You can see below that we’ve limited the capture to SMB traffic, because in only these messages does the filename entity exists.

Rather than continuing to violate mathematical laws, and to reduce our OCD medicine intake, we’ve added this new operator, ~=. This includes the check for existence and doesn’t return messages which don’t have the field in the first place. We believe this more explicit notation will provide less confusion and more clarity moving forward.

Right Click Add as Filter

We understand this feature doesn’t work perfectly now and we are working to implement it completely. In future versions, the experience for right clicking something in the UI and adding as a filter should be improved. But still, even in this current implementation, it is a helpful way to learn how to specify entities to filter on.

More to Come

There are even more complex things you can do with the filtering language that I will leave to a later post. Hopefully with these small tips, your filtering experience will be better. Please remember to provide us any feedback on our Connect site where we are hosting the Message Analyzer Beta.

Updated Wiki: Filtering with Message Analyzer

PaulLong — Thu, 10 Jan 2013 19:31:02 GMT

Filtering Shortcuts

Example	Feature	Description
TCP.Rst	Partial Paths	TCP.Flags.Rst is the formal full path. But you only have to put the first and last entity name to make a valid, yet more inclusive filter. This might not be as fast as a more precise filter, but the extent of which depends on the filter.
*port==135	Wildcards	You can also place a wild card before an element to filter any message which matched “port”. In this case UDP and TCP will be included, as well as any entity called port. It’s also important to note that port is a special way to reference both the source and destination. Again this is not as precise and performs worse than the example above.
*address==FF-FF-FF-FF-FF-FF	Wildcards	This is similar to above, but an important point is that what is on the left side of address might not be obvious. The hardware address could come from wireless or Ethernet. An IP address might be via the firewall or NDIS driver. The IPv4 layer doesn’t exist in the firewall driver, though there is an IPv4 type address there. Remember that Address is the IPv4 type, but IPv4 is the protocol/module name. This is really important when creating capture filters because IPv4.Address in the firewall will not match. Also important is that the right side can take on any valid literal form. So if you enter an IPv4 address on the right side, we will find those address that match that can return an IPv4 literal type. Again, the address is a special way to reference both the source and destination addresses.
HTTP.Uri contains “msn” TCP contains “Microsoft”	Contains	You can use contains to search a string or all the raw data. You can also search a specific protocol for a string. You can control case sensitivity, but by default it’s case insensitive. For instance ‘TCP contains “bLah” caseSensitive’ would search for “bLah” matching case. Look at the library to see other options for encoding types.
HTTP.Headers[“Host”] == “www.msn.com”	Maps	A big difference in Messages Analyzer is that we created a new type to handle HTTP data. Using a Map is a better data type to describe HTTP and others, but this makes the filtering the syntax different. An advantage is that we can now reference the HTTP fields using the exact match of the HTTP field name. Previously we had to remove dashes which could be confused for subtraction. For instance in Network Monitor 3.x, Content-Type was written as HTTP.Response.ContentType. But now you can Type HTTP.Response.Headers[“Content-Type”] which is more predictable and consistent. On the other hand we group HTTP request and responses as operations. And for an operation we also expose fields which lift some information from the request or response. For example HTTP.ContentType = “jpeg”. Intellisense will make this easier to explore.
Tcp.port != 80 SMB.FileName ~= “”	Existence	This is a Dusey J A feature where math and practicality collide. If you’ve used Network Monitor a lot, you’ll know there’s a difference between tcp.port != 80 and !(tcp.port == 80). This mathematical irony seems to tickle the OCD in all of us. See below for more detailed info.

Existence Example: TCP.Port != 3389 vs. SMB.FileName ~= “”

There are two possible outcomes a user wants. However, a confused user might try and use the same filter for two different situations.

Example 1: Getting Rid of Traffic

For Network Monitor, if you wanted to get rid of traffic, you type “!(tcp.Port == 3389)”. And of course this could be confusing since these two filters seem mathematically equivalent.

With Message Analyzer, the two statements are equivalent. And we no longer assume you want to look for traffic where the TCP.Port fields exists. Tcp.port != 3389 is the same as !(tcp.port == 3389).

Example 2: Displaying Data where the Field Exists

Right Click Add as Filter

More to Come

Updated Wiki: Home

PaulLong — Wed, 07 Nov 2012 16:25:30 GMT

Project Description
Network Monitor 3.3 introduces the Experts menu. This feature allows you to run external analysis tools on an open capture file.

This page is points you to these useful “Experts” for your data analysis needs within Network Monitor. Also provided here is the Expert SDK. More information on Experts can be found here.

Experts can only be invoked from Network Monitor 3.3 Beta and later versions. To install the latest version of Network Monitor please click here. To install an Expert, download the appropriate MSI for your platform from one of the following Expert Download pages. Then, on any new capture you open with Network Monitor, you will see the new Expert available to run on your capture. Experts should also provide specific help on their usage from within the Experts menu.

See our Downloads tab for more information on the Expert SDK. This SDK contains examples as well as reusable code for parsing the command line and building expert MSIs.

News

03/03/2011 - NMTopProtocols Installer Uploaded
02/09/2011 - NMTopProtocols Released (Code only right now)
02/09/2011 - Experts Moved to the Outercurve Foundation.
03/08/2010 - NmDecrypt Expert Released
08/13/2009 - Checkout the NMCap tool NetWiz
06/22/2009 - MSR releases TCP Analyzer, added link below.
05/28/2009 - Released Network Monitor Help C Examples here

Available Experts in the Outercurve Foundation:

NmDecrypt When given a trace with encrypted frames, a security certificate, and a passkey will create a new trace with decrypted frames added inline.
Top Users Lets you determine the heaviest users of network bandwidth.
Top Protocols Lets you determine distribution of protocols.

Other Community Experts:

These experts are not associated with the Outercurve Foundation. But in the spirit of increasing our community we've included links to some other experts.

TCP Analyzer This tool analyzes network traces of Transmission Control Protocol (TCP) connections.
Simple Search Lets you search frames and comments for raw ASCII text case-insensitively or with regular expressions.

Related Programs

The following programs are useful tools which use the Network Monitor API, but don't integrate with the Experts Menu.

NetWiz Provides a wizard type interface to build and execute NMCap command lines.
VRTA The Visual Round Trip Analyzer tool helps web developers and testers visualize the download of their page, identify best practices and changes that improve web performance.

If you have an expert which you think has wide appeal, please feel free to contact us, and we can talk about giving you a link here.

Updated Wiki: Home

PaulLong — Wed, 07 Nov 2012 16:22:58 GMT

News

03/03/2011 - NMTopProtocols Installer Uploaded
02/09/2011 - NMTopProtocols Released (Code only right now)
02/09/2011 - Experts Moved to the Outercurve Foundation.

03/08/2010 - NmDecrypt Expert Released
08/13/2009 - Checkout the NMCap tool NetWiz
06/22/2009 - MSR releases TCP Analyzer, added link below.
05/28/2009 - Released Network Monitor Help C Examples here

Available Experts in the Outercurve Foundation:

NmDecrypt When given a trace with encrypted frames, a security certificate, and a passkey will create a new trace with decrypted frames added inline.
Top Users Lets you determine the heaviest users of network bandwidth.
Top Protocols Lets you determine distribution of protocols.

Other Community Experts:

These experts are not associated with the Outercurve Foundation. But in the spirit of increasing our community we've included links to some other experts.

TCP Analyzer This tool analyzes network traces of Transmission Control Protocol (TCP) connections.
Simple Search Lets you search frames and comments for raw ASCII text case-insensitively or with regular expressions.

Related Programs

The following programs are useful tools which use the Network Monitor API, but don't integrate with the Experts Menu.

NetWiz Provides a wizard type interface to build and execute NMCap command lines.
VRTA The Visual Round Trip Analyzer tool helps web developers and testers visualize the download of their page, identify best practices and changes that improve web performance.

If you have an expert which you think has wide appeal, please feel free to contact us, and we can talk about giving you a link here.

Updated Wiki: Temporary Post Used For Theme Detection (686f5c64-7334-440a-9b3e-686f46859c9c - 3bfe001a-32de-4114-a6b4-4005b770f6d7)

PaulLong — Wed, 07 Nov 2012 14:56:16 GMT

This is a temporary post that was not deleted. Please delete this manually. (762d10ce-ab96-4b4f-b253-6b130949ed21 - 3bfe001a-32de-4114-a6b4-4005b770f6d7)

Updated Wiki: Home

MichaelHawker — Fri, 06 May 2011 17:57:00 GMT

News

03/03/2011 - NMTopProtocols Installer Uploaded
02/09/2011 - NMTopProtocols Released (Code only right now)
02/09/2011 - Experts Moved to the Outercurve Foundation.
03/08/2010 - NmDecrypt Expert Released
08/13/2009 - Checkout the NMCap tool NetWiz
06/22/2009 - MSR releases TCP Analyzer, added link below.
05/28/2009 - Released Network Monitor Help C Examples here

Available Experts in the Outercurve Foundation:

NmDecrypt When given a trace with encrypted frames, a security certificate, and a passkey will create a new trace with decrypted frames added inline.
Top Users Lets you determine the heaviest users of network bandwidth.
Top Protocols Lets you determine distribution of protocols.

Other Community Experts:

These experts are not associated with the Outercurve Foundation. But in the spirit of increasing our community we've included links to some other experts.

TCP Analyzer This tool analyzes network traces of Transmission Control Protocol (TCP) connections.
Simple Search Lets you search frames and comments for raw ASCII text case-insensitively or with regular expressions.

Related Programs

The following programs are useful tools which use the Network Monitor API, but don't integrate with the Experts Menu.

NetWiz Provides a wizard type interface to build and execute NMCap command lines.
VRTA The Visual Round Trip Analyzer tool helps web developers and testers visualize the download of their page, identify best practices and changes that improve web performance.

If you have an expert which you think has wide appeal, please feel free to contact us, and we can talk about giving you a link here.

Updated Wiki: Expert Ideas

MichaelHawker — Fri, 11 Mar 2011 23:35:18 GMT

This page contains a list of ideas for possible Expert analysis tools.

The Network Monitor API is written in C, but provides a basic C# wrapper. Therefore most Experts are written in C or C#. Even in C# though, having a knowledge of C pointers is useful when developing experts; however, with the current Experts available there are plenty of available examples of using most existing API functions.

Response Time Checker (Across Stack)
- Difficulty: Easy (raw data), Medium (graphical display)
- Analyze response times for a user specified protocol layer.
Network Sequence Diagrams
- Difficulty: Medium
- Graphical display of Network Messages passing between two or more machines for a user specified protocol layer and/or across layers.
Comparison of Traces
- Difficulty: Hard
- Graphical comparison of two Network Traces. Looking for common or differentiating patterns in network data, messages, and intent.

Updated Wiki: Expert Ideas

MichaelHawker — Fri, 11 Mar 2011 17:07:01 GMT

This page contains a list of ideas for possible Expert analysis tools.

Network Sequence Diagrams
- Graphical display of Network Messages passing between two or more machines for a user specified protocol layer and/or across layers.
Comparison of Traces
- Graphical comparison of two Network Traces. Looking for common or differentiating patterns in network data, messages, and intent.
Response Time Checker (Across Stack)
- Analyze response times for a user specified protocol layer.

Updated Wiki: Home

MichaelHawker — Fri, 04 Mar 2011 17:03:27 GMT

News

03/03/2011 - NMTopProtocols Installer Uploaded
02/09/2011 - NMTopProtocols Released (Code only right now)
02/09/2011 - Experts Moved to the Outercurve Foundation.
03/08/2010 - NmDecrypt Expert Released
08/13/2009 - Checkout the NMCap tool NetWiz
06/22/2009 - MSR releases TCP Analyzer, added link below.
05/28/2009 - Released Network Monitor Help C Examples here

Available Experts in the Outercurve Foundation:

NmDecrypt When given a trace with encrypted frames, a security certificate, and a passkey will create a new trace with decrypted frames added inline.
Top Users Lets you determine the heaviest users of network bandwidth.
Top Protocols Lets you determine distribution of protocols.

Other Community Experts:

These experts are not associated with the Outercurve Foundation. But in the spirit of increasing our community we've included links to some other experts.

TCP Analyzer This tool analyzes network traces of Transmission Control Protocol (TCP) connections.
Simple Search Lets you search frames and comments for raw ASCII text case-insensitively or with regular expressions.
NetWiz Provides a wizard type interface to build and execute NMCap command lines.

If you have an expert which you think has wide appeal, please feel free to contact us, and we can talk about giving you a link here.

Updated Wiki: Home

PaulLong — Thu, 10 Feb 2011 21:54:23 GMT

News

02/09/2011 - NMTopProtocols Released (Code only right now)
02/09/2011 - Experts Moved to the Outercurve Foundation.
03/08/2010 - NmDecrypt Expert Released
08/13/2009 - Checkout the NMCap tool NetWiz
06/22/2009 - MSR releases TCP Analyzer, added link below.
05/28/2009 - Released Network Monitor Help C Examples here

Available Experts in the Outercurve Foundation:

NmDecrypt When given a trace with encrypted frames, a security certificate, and a passkey will create a new trace with decrypted frames added inline.
Top Users Lets you determine the heaviest users of network bandwidth.
Top Protocols Lets you determine distribution of protocols. (Code only, release is not availalbe yet)

Other Community Experts:

These experts are not associated with the Outercurve Foundation. But in the spirit of increasing our community we've included links to some other experts.

TCP Analyzer This tool analyzes network traces of Transmission Control Protocol (TCP) connections.
Simple Search Lets you search frames and comments for raw ASCII text case-insensitively or with regular expressions.
NetWiz Provides a wizard type interface to build and execute NMCap command lines.

If you have an expert which you think has wide appeal, please feel free to contact us, and we can talk about giving you a link here.

Updated Wiki: Home

PaulLong — Thu, 10 Feb 2011 21:49:21 GMT

News

02/09/2011 - NMTopProtocols Released (Code only right now)
02/09/2011 - Experts Moved to the Outercurve Foundation.
03/08/2010 - NmDecrypt Expert Released
08/13/2009 - Checkout the NMCap tool NetWiz
06/22/2009 - MSR releases TCP Analyzer, added link below.
05/28/2009 - Released Network Monitor Help C Examples here

Available Experts in the Outercurve Foundation:

NmDecrypt When given a trace with encrypted frames, a security certificate, and a passkey will create a new trace with decrypted frames added inline.
Top Users Lets you determine the heaviest users of network bandwidth.
Top Protocols Lets you determine distribution of protocols. (Code only, release is not availalbe yet)

Other Community Experts:

These experts are not associated with the Outercurve Foundation. But in the spirit of increasing our community we've included links to some other experts.

TCP Analyzer This tool analyzes network traces of Transmission Control Protocol (TCP) connections.
Simple Search Lets you search frames and comments for raw ASCII text case-insensitively or with regular expressions.
NetWiz Provides a wizard type interface to build and execute NMCap command lines.

If you have an expert which you think has wide appeal, please feel free to contact us, and we can talk about giving you a link here.

Updated Wiki: Home

PaulLong — Thu, 10 Feb 2011 21:48:44 GMT

News

02/09/2011 - NMTopProtocols Released (Code only right now)
02/09/2011 - Experts Moved to the Outercurve Foundation.
03/08/2010 - NmDecrypt Expert Released
08/13/2009 - Checkout the NMCap tool NetWiz
06/22/2009 - MSR releases TCP Analyzer, added link below.
05/28/2009 - Released Network Monitor Help C Examples here

Available Experts in the Outercurve Foundation:

NmDecrypt When given a trace with encrypted frames, a security certificate, and a passkey will create a new trace with decrypted frames added inline.
Top Users Lets you determine the heaviest users of network bandwidth.
Top Protocols Lets you determine distribution of protocols. (Code only, release is not availalbe yet)

Other Community Experts:

These experts are not associated with the Outercurve Foundation. But in the spirit of increasing our community we've included links to some other experts.

TCP Analyzer This tool analyzes network traces of Transmission Control Protocol (TCP) connections.
Simple Search Lets you search frames and comments for raw ASCII text case-insensitively or with regular expressions.
NetWiz Provides a wizard type interface to build and execute NMCap command lines.

If you have an expert which you think has wide appeal, please feel free to contact us, and we can talk about giving you a link here.

Updated Wiki: Home

PaulLong — Thu, 10 Feb 2011 21:48:30 GMT

News

02/09/2011 - NMTopProtocols Released (Code only right now)
02/09/2011 - Experts Moved to the Outercurve Foundation.
03/08/2010 - NmDecrypt Expert Released
08/13/2009 - Checkout the NMCap tool NetWiz
06/22/2009 - MSR releases TCP Analyzer, added link below.
05/28/2009 - Released Network Monitor Help C Examples here

Available Experts in the Outercurve Foundation:

NmDecrypt When given a trace with encrypted frames, a security certificate, and a passkey will create a new trace with decrypted frames added inline.
Top Users Lets you determine the heaviest users of network bandwidth.
Top Protocols Lets you determine distribution of protocols. (Code only, release is not availalbe yet)

Other Community Experts:

These experts are not associated with the Outercurve Foundation. But in the spirit of increasing our community we've included links to some other experts.

TCP Analyzer This tool analyzes network traces of Transmission Control Protocol (TCP) connections.
Simple Search Lets you search frames and comments for raw ASCII text case-insensitively or with regular expressions.
NetWize Provides a wizard type interface to build and execute NMCap command lines.

If you have an expert which you think has wide appeal, please feel free to contact us, and we can talk about giving you a link here.

Updated Wiki: Home

PaulLong — Thu, 10 Feb 2011 20:05:37 GMT

News

02/09/2011 - NMTopProtocols Released (Code only right now)
02/09/2011 - Experts Moved to the Outercurve Foundation.
03/08/2010 - NmDecrypt Expert Released
08/13/2009 - Checkout the NMCap tool NetWiz
06/22/2009 - MSR releases TCP Analyzer, added link below.
05/28/2009 - Released Network Monitor Help C Examples here

Available Experts in the Outercurve Foundation:

NmDecrypt When given a trace with encrypted frames, a security certificate, and a passkey will create a new trace with decrypted frames added inline.
Top Users Lets you determine the heaviest users of network bandwidth.
Top Protocols Lets you determine distribution of protocols. (Code only, release is not availalbe yet)

Other Community Experts:

These experts are not associated with the Outercurve Foundation. But in the spirit of increasing our community we've included links to some other experts.

TCP Analyzer This tool analyzes network traces of Transmission Control Protocol (TCP) connections.
Simple Search Lets you search frames and comments for raw ASCII text case-insensitively or with regular expressions.

If you have an expert which you think has wide appeal, please feel free to contact us, and we can talk about giving you a link here.

Updated Wiki: Home

PaulLong — Thu, 10 Feb 2011 19:46:25 GMT

News

02/09/2011 - NMTopProtocols Released (Code only right now)
02/09/2011 - Experts Moved to the Outercurve Foundation.
03/08/2010 - NmDecrypt Expert Released
08/13/2009 - Checkout the NMCap tool NetWiz
06/22/2009 - MSR releases TCP Analyzer, added link below.
05/28/2009 - Released Network Monitor Help C Examples here

Available Experts in the Outercurve Foundation:

NmDecrypt When given a trace with encrypted frames, a security certificate, and a passkey will create a new trace with decrypted frames added inline.
Top Users Lets you determine the heaviest users of network bandwidth.
Top Protocols Lets you determine distribution of protocols. (Code only, release is not availalbe yet)

Other Community Experts:

TCP Analyzer This tool analyzes network traces of Transmission Control Protocol (TCP) connections.
Simple Search Lets you search frames and comments for raw ASCII text case-insensitively or with regular expressions.

If you have an expert which you think has wide appeal, please feel free to contact us, and we can talk about giving you a link here.

Updated Wiki: Home

PaulLong — Thu, 10 Feb 2011 19:44:32 GMT

News

02/09/2011 - Experts Moved to the Outercurve Foundation.
03/08/2010 - NmDecrypt Expert Released
08/13/2009 - Checkout the NMCap tool NetWiz
06/22/2009 - MSR releases TCP Analyzer, added link below.
05/28/2009 - Released Network Monitor Help C Examples here

Available Experts in the Outercurve Foundation:

NmDecrypt When given a trace with encrypted frames, a security certificate, and a passkey will create a new trace with decrypted frames added inline.
Top Users Lets you determine the heaviest users of network bandwidth.
Top Protocols Lets you determine distribution of protocols. (Code only, release is not availalbe yet)

Other Community Experts:

TCP Analyzer This tool analyzes network traces of Transmission Control Protocol (TCP) connections.
Simple Search Lets you search frames and comments for raw ASCII text case-insensitively or with regular expressions.

If you have an expert which you think has wide appeal, please feel free to contact us, and we can talk about giving you a link here.

Updated Wiki: Home

PaulLong — Thu, 10 Feb 2011 19:44:02 GMT

News

02/09/2011 - Experts Moved to the Outercurve Foundation.
03/08/2010 - NmDecrypt Expert Released
08/13/2009 - Checkout the NMCap tool NetWiz
06/22/2009 - MSR releases TCP Analyzer, added link below.
05/28/2009 - Released Network Monitor Help C Examples here

Available Experts in the Outercurve Foundation:

NmDecrypt When given a trace with encrypted frames, a security certificate, and a passkey will create a new trace with decrypted frames added inline.
Top Users Lets you determine the heaviest users of network bandwidth.
Top Protocols Lets you determine distribution of protocols.

Other Community Experts:

TCP Analyzer This tool analyzes network traces of Transmission Control Protocol (TCP) connections.
Simple Search Lets you search frames and comments for raw ASCII text case-insensitively or with regular expressions.

If you have an expert which you think has wide appeal, please feel free to contact us, and we can talk about giving you a link here.

Updated Wiki: Home

PaulLong — Wed, 09 Feb 2011 17:44:33 GMT

News

02/09/2011 - Experts Moved to the Outercurve Foundation.
03/08/2010 - NmDecrypt Expert Released
08/13/2009 - Checkout the NMCap tool NetWiz
06/22/2009 - MSR releases TCP Analyzer, added link below.
05/28/2009 - Released Network Monitor Help C Examples here

Available Experts from Network Monitor Team:

NmDecrypt When given a trace with encrypted frames, a security certificate, and a passkey will create a new trace with decrypted frames added inline.
Simple Search Lets you search frames and comments for raw ASCII text case-insensitively or with regular expressions.
Top Users Lets you determine the heaviest users of network bandwidth.

Other Community Experts:

TCP Analyzer This tool analyzes network traces of Transmission Control Protocol (TCP) connections.
If you have an expert which you think has wide appeal, please feel free to contact us, and we can talk about giving you a link here.

Updated Wiki: Home

MichaelHawker — Mon, 08 Mar 2010 19:53:41 GMT

News

03/08/2010 - NmDecrypt Expert Released
08/13/2009 - Checkout the NMCap tool NetWiz
06/22/2009 - MSR releases TCP Analyzer, added link below.
05/28/2009 - Released Network Monitor Help C Examples here

Available Experts from Network Monitor Team:

NmDecrypt When given a trace with encrypted frames, a security certificate, and a passkey will create a new trace with decrypted frames added inline.
Simple Search Lets you search frames and comments for raw ASCII text case-insensitively or with regular expressions.
Top Users Lets you determine the heaviest users of network bandwidth.

Other Community Experts:

TCP Analyzer This tool analyzes network traces of Transmission Control Protocol (TCP) connections.
If you have an expert which you think has wide appeal, please feel free to contact us, and we can talk about giving you a link here.

Updated Wiki: Home

MichaelHawker — Tue, 18 Aug 2009 18:51:14 GMT

News

08/13/2009 - Checkout the NMCap tool NetWiz
06/22/2009 - MSR releases TCP Analyzer, added link below.
05/28/2009 - Released Network Monitor Help C Examples here

Available Experts from Network Monitor Team:

Simple Search Lets you search frames and comments for raw ASCII text case-insensitively or with regular expressions.
Top Users Lets you determine the heaviest users of network bandwidth.

Other Community Experts:

TCP Analyzer This tool analyzes network traces of Transmission Control Protocol (TCP) connections.
If you have an expert which you think has wide appeal, please feel free to contact us, and we can talk about giving you a link here.