Parsing Office Traffic: Message Analyzer & Fiddler

Jingyu Shao

Software Engineer

Agenda

• Message Analyzer• What’s Message Analyzer

• Protocol analysis

• Parsers available

• Demo

• Resources

• Fiddler• Office Inspectors

• Demo

• Resources

• Comparison and how to chose

What is Message Analyzer?

Message Analyzer Protocol analysis

Protocol Analysis

Message Analyzer Parsers Overview

Message Analyzer

Parsers for public protocols (e.g. HTTP, SOAP) and Windows protocols

Office Parsers Packages

Office & SharePoint

92 parsersMS-LISTSWS, MS-ADMINS,MS-WEBSS, …

Exchange Web Service

35 parsersMS-OXWSCORE, MS-OXWSFOLD, MS-OXWSSYNC,….

Exchange Active Sync

4 parsersMS-ASCMD,MS-ASHTTP, MS-ASPROV, MS-ASWBXML WOPI/FSSHTTP

5 parsersMS-FSSHTTP,MS-FSSHTTPB, MS-FSSHTTPD, MS-WOPI, FileSyncBasic

Exchange MAPI

14 parsersMS-OXCDATA,MS-OXCROPS, MS-OXCRPC, MS-OXCMAPIHTTP,…

Skype for Business

12 parsersMS-CONFBAS, MS-SIPREGE, MS-TURN, MS-ICE, …

Demo

Office Parses Features

WBXML decoder for EAS

Message Recognition Binary XML decoding Validation*

* Not available for all parsers yet

Message Analyzer Resources

• Download: http://www.microsoft.com/en-us/download/details.aspx?id=44226

• Operating Guide: https://technet.microsoft.com/en-us/library/jj649776.aspx

• Office Interoperability Blog:http://blogs.msdn.com/b/officeinteroperability/

• MA Blog:http://blogs.technet.com/b/messageanalyzer/

• Forum:https://social.technet.microsoft.com/Forums/en-US/home?forum=messageanalyzer

Agenda

• Message Analyzer• What’s Message Analyzer

• Protocol analysis

• Parsers available

• Demo

• Resources

• Fiddler• Office Inspectors

• Demo

• Resources

• Comparison and how to chose

Fiddler Office Inspectors

WOPI/FSSHTTP

MS-FSSHTTP,MS-FSSHTTPB, MS-FSSHTTPD, MS-WOPI

Exchange MAPI

MS-OXCDATA,MS-OXCROPS, MS-OXCRPC, MS-OXCMAPIHTTP,…

Demo

Fiddler Office Inspectors Resources

• Github Repos: MAPIHTTP:

https://github.com/OfficeDev/Office-Inspectors-for-Fiddler/tree/master/MAPIInspector

WOPI/FSSHTTP:

https://github.com/OfficeDev/Office-Inspectors-for-Fiddler/tree/master/FSSHTTPWOPIInspector

• Office Interoperability Blog:http://blogs.msdn.com/b/officeinteroperability/

Agenda

• Message Analyzer• What’s Message Analyzer

• Protocol analysis

• Parsers available

• Demo

• Resources

• Fiddler• Office Inspectors

• Demo

• Resources

• Comparison and how to chose

Comparison and how to choose

Capture• Numerous transport protocols supported

Protocol families supported• Office & SP

• EWS

• EAS

• MAPI

• WOPI/FSSHTTP

• Skype for Business

Community Participation• Parser source code

• Share through asset

Capture

• HTTP/S only

Protocol families supported

• Office & SP (let us know if you want this)

• EWS (let us know if you want this)

• EAS

• MAPI (HTTP)

• WOPI/FSSHTTP

• Skype for Business

Community Participation• Open Source in Github

Thank You!