2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Microsoft Message Analyzer: New Looks and New Tricks

Paul Long Microsoft

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

What is Message Analyzer?

Protocol Analysis Protocol Validation Log File Analyzer Deep Data Inspection and Correlation Packet Capture and Event Tracing Collector

2

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Demo – Inspection and Correlation

3

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

What’s Different with Message Analyzer?

Message Reassembly and Operations Reduces Noise Increasing Filtering performance Simplifies Application Troubleshooting Simplifies Performance Troubleshooting

4

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

What’s Unique About Message Analyzer?

Read more than just Network Traces Text Log Files (IIS, NetLogon, SambaSysLog) Event Logs and Tracing (EVTX and ETL) PowerShell CSV/TSV SQL Databases Azure Tables

5

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

What’s Unique About Message Analyzer?

6

Grouping Pivot Top Users Chart

Gantt Pattern

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Demo – Pattern Match TCP Sequences

7

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Messages are Coalesced

Operations – Group related messages, like Requests and Responses

Automatic Reassembly – Fragments for IP, TCP, HTTP, and others are automatically reassembled and stored as a tree

Protocol is Validated – Protocols can be Analyzed and Simulated which allows us to identify differences from the specification.

8

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Operation Message

Operations and Reassembly

Request Message

Response Message

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Network Monitor View

10

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Wireshark View

11

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Message Analyzer View

12

Measure Performance

Visualize Data

Limit Noise

0.0222278

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Filtering Differences

13

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Filtering Difference

14

Filtering always applies to the entire tree. If any node in the tree contains a match, top level message is returned. Even when operations are hidden.

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Viewpoints

15

Viewpoints let you see messages at layers in the stack. A TCP viewpoint let’s you see all TCP fragments.

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Viewpoint Filter

16

Viewpoint filters let you apply a filter at the top row under the viewpoint (blue line).

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Filtering is Fast

17

View Filter: TCP.Port==1234

Port=1234

Port=1234

Port=7777

Port=7777

Viewpoint Filter: TCP.SequenceNumber==1234

Requires looking at 4 messages

Requires looking at only the TCP

fragments in the 2 resulting Messages

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

What’s New with Message Analyzer

Comparison Tools UI Workflow Improvements Parse As support Performance Improvements

18

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Demo – Comparison Tools

19

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Demo – Parse As

20

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Upcoming Features

21

To be updated later

2015 Storage Developer Conference. © Microsoft. All Rights Reserved.

Useful Links

Blog: http://blogs.technet.com/MessageAnalyzer Latest Download Videos Support Forums

22