Using Network Monitor with the Microsoft Office and SharePoint Products Parsers
Summary: This article introduces Netzwerkmonitor, defines and provides an example of parsers, and shows how to install Netzwerkmonitor and the latest versions of Windows, Microsoft Office and SharePoint Products Netzwerkmonitor, SQL, and Lync parsers. The parser example focuses on the Microsoft Office and SharePoint Products parsers, and describes how to use these parsers along with standard Netzwerkmonitor features to inspect and analyze specific network traffic data.
Letzte Änderung: Montag, 9. März 2015
Gilt für: Business Connectivity Services | Office client | Open XML | SharePoint Designer 2010 | SharePoint Foundation 2010 | SharePoint Online | SharePoint Server 2010 | Visual Studio
Inhalt dieses Artikels
Introduction to Network Monitor
Appendix A: Install Network Monitor
Appendix B: Install the Latest Microsoft Network Monitor Parsers
Appendix C: Install the Latest Office and SharePoint Products Network Monitor Parsers
Appendix D: Install the Latest Lync and SQL Network Monitor Parsers
Appendix E: Microsoft Office and SharePoint Parser File Filters
Published: August 2011
Applies to: Microsoft Office | Microsoft SharePoint Products and Technologies | Microsoft Lync 2010
Provided by: Microsoft Corporation
Contents
Overview of Microsoft Office and SharePoint Products Network Monitor Parsers
Microsoft Office and SharePoint Products Network Monitor Parsers Example
Appendix B: Install the Latest Microsoft Network Monitor Parsers
Appendix C: Install the Latest Office and SharePoint Products Network Monitor Parsers
Appendix D: Install the Latest Lync and SQL Network Monitor Parsers
Appendix E: Microsoft Office and SharePoint Parser File Filters
Introduction to Network Monitor
Netzwerkmonitor is a tool that you use to view, or capture network traffic in real time and analyze it against filters and parsers that you have installed or created. Netzwerkmonitor installs a default set of core, base, common, and Windows parsers, but Microsoft also offers parsers for Microsoft Office and SharePoint Products, Lync and SQL protocols as well as updated core, base, common and Windows parsers that must be installed before installing any other parsers offered by Microsoft.
The standard features of Netzwerkmonitor enable you to:
View real-time network traffic.
Capture network traffic and save it in a file for future analysis.
Netzwerkmonitor also includes a standard set of filters that help you identify and capture the particular network traffic and data that most interests you.
You can download the latest version of Microsoft Network Monitor from the Microsoft Download Center. For more information, see Appendix A: Install Network Monitor.
Network Monitor Parsers
Parsers are script files written by using the Netzwerkmonitor Parsing Language (NPL) that specifies the layout of network data. You can use a parser file as a filter to isolate the data that is pertinent to the protocol or structure defined by the parser file.
The following figure shows the basic layout of Netzwerkmonitor with the base, core, common and Windows parsers that are supplied with it. It also shows the other available parsers that extend the basic set of parsers, which is discussed in more detail in the next section, Overview of Microsoft Office and SharePoint Products Netzwerkmonitor Parsers.
Figure 1. Network Monitor and the available parsers
Overview of Microsoft Office and SharePoint Products Network Monitor Parsers
The Microsoft Office and SharePoint Products Netzwerkmonitor Parsers extend the default parsers in Netzwerkmonitor by enabling you to get a more detailed look into the Microsoft Office and SharePoint protocol traffic. The Microsoft Office and SharePoint Products parsers consist of parser files that have, in most cases, a one-to-one relationship to a Microsoft Office or SharePoint open specification. For more information about how the parser files map to the Microsoft Office and SharePoint open specifications, see Appendix E: Microsoft Office and SharePoint Parser File Filters. The parser file name reflects the parent open specification. For example, MS-VERSS.npl contains a set of rules that is used to capture the network traffic that is defined in the MS-VERSS open specification. The Microsoft Office and SharePoint parser package includes support for the 2007 Microsoft Office System, Microsoft Office 2010, SharePoint Products and Technologies, and Microsoft SharePoint 2010.
Microsoft Office and SharePoint Products parsers are designed to help you monitor network traffic for solutions that you create by using the Microsoft Office and SharePoint Products and Technologies open specifications. By using the parsers and Netzwerkmonitor, you can efficiently debug your protocol implementation by gaining enhanced insight into the protocol traffic.
The most recent set of the default MicrosoftNetzwerkmonitor parsers and Microsoft Office and SharePoint Product parsers are available for download from CodePlex and the Microsoft Download Center, as described in the following table. The table also includes links to the latest versions of MicrosoftNetzwerkmonitor, Lync, and SQL parsers that define parser files pertaining to specific Lync and SQL open specifications.
Available parser package downloads
Microsoft Office and SharePoint Products Network Monitor Parsers Example
After you install the parsers that you need, you need to activate them. After activating them, you can verify the installations by using the Parser Profiles option in Netzwerkmonitor.
You can also verify that the parsers are installed by using the View installed updates feature under Programs and Features in Control Panel.
In the following example shows the activation for Microsoft Office and SharePoint Products Netzwerkmonitor parsers; however, the process is the same for any installed parsers.
To activate the Office and SharePoint Products Network Monitor Parsers
In Netzwerkmonitor, click Parser Profiles, and then click Parser Profile Options.
In the Options dialog box, right-click Office, click Set As Active, and then click OK.
Figure 2. The Options dialog box
This step builds and sets the Microsoft Office and SharePoint Products Netzwerkmonitor parsers as active so that you can use them to analyze network traffic data.
Click the Parsers tab.
In Object View, click Parser Files to expand it.
Figure 3. The Object View in Network Monitor
In the parser file list, locate a Microsoft Office parser file, for example "MS-VERSS.npl", double-click it to view the source file in the code window.
Figure 4. MS-VERSS.npl
The following example shows how to capture the network traffic for a Microsoft Word 2010 file that is created, saved on a SharePoint Product and Technologies site, and then versioned.
View the Word 2010 network conversations
On the Netzwerkmonitor menu bar, click New Capture, and then click Start.
Create a new Word 2010 document, enter some text, and then save it as "creating capturedemo.docx" to a SharePoint Products and Technologies site that has version control enabled.
Check out the document, and add more text.
Save the file, and in the Check In dialog box, select Minor version for the version type.
Save the file, and in the Check In dialog box, select Minor version for the version type.
On the Netzwerkmonitor menu bar, click Stop.
Click Save As to optionally save the capture into a file.
In the Network Conversations window, select WINWORD.EXE to view the network traffic for the creating capturedemo.docx file as it progressed through the steps 2 through 6.
Figure 5. The Network Conversations window with Word conversations selected
The Frame Summary window shows all the Microsoft Word traffic, the Frame Details window shows the details for the selected frame, and the Hex Details window shows the details for the selected frame in hexadecimal representation.
Figure 6. The Frame Summary and Frame Details windows showing a network capture for a Word file
The data shows the network traffic for this conversation, including the following five open specifications:
MS-WSSCAP
MS-WEBBS
MS-LISTSWS
MS-VERSS
MS-FSSHTTP
To view only the traffic that is defined by the Microsoft Office and SharePoint Products parsers, type the following in the Display Filter window:
.Protocol.MSWSSCAP or .Protocol.MSWEBSS or .Protocol.MSLISTSWS or .Protocol.MSVERSS or .Protocol.MSFSSHTTP
Click Apply to show only the filtered data in the Frame Summary window.
For more information about how filter names map to the open specifications, see Appendix E: Microsoft Office and SharePoint Parser File Filters.
Hinweis Type the Microsoft Office protocol name without the dash after the "MS."
Only the data related to the filters that are currently applied is now displayed in the Frame Summary window.
Figure 7. The Destination values shown as an "ENDPOINT" alias and an IP address
Add an alias for the SharePoint server
To create an alias for the destination address, right-click on the server IP address in the Destination column of a frame, and then click Create Alias for ‘Destination’ Address.
In the Create New Alias dialog box, in the Name:* field, type SharePoint Server, and then click OK.
The Frame Summary window displays the addresses in the Destination column as the easy to understand alias, you created, instead of a network address.
Figure 8. The Destination values shown as "ENDPOINT" and "SharePoint Server" aliases
Add a color rule for MS-VERSS traffic
You can use color rules to more easily distinguish the network traffic data that displays in the Frame Summary window. To create a new color rule:
On the top frame of the Frame Summary window, click Color Rules.
In the Manage rules: box, click New.
In the Add New Color Rule dialog box, in the Enter filter expression box, type .Protocol.MSVERSS.
Click Background color, select green, and then click OK twice.
Figure 9. The Add New Color Rule dialog box
The Frame Summary window now displays the MSVERSS request and response messages as green.
Figure 10. The MS-VERSS request and response messages
Examine MS-VERSS data
To see a simple example of how to use the Microsoft Office protocols to understand the network data, click an MSVERSS request message in the Frame Summary window.
In the Frame Details window, expand nodes until you see the file name that you created for the Wordfile when you checked it into Microsoft SharePoint Server.
Figure 11. MS-VERSS network data nodes
You can further examine all the nodes in the Frame Summary window for all the MSVERSS response and request messages.
Appendix A: Install Network Monitor
To install the Microsoft Netzwerkmonitor 3.4, or the latest version of Netzwerkmonitor, download Network Monitor from the Microsoft download center. The download center always has the latest available version of Netzwerkmonitor.
To install the latest version of Netzwerkmonitor
On the download page, click the appropriate Download button for the 32-bit or the 64-bit operating system.
Click Run to immediately begin the installation. You can also save the executable file on your computer for a later installation.
Click Yes to confirm the installation.
On the Welcome to the Microsoft Network Monitor 3.4 (Capture and Parser Engine) Setup Wizard page, click Next.
On the End-User License Agreement page, if you agree with the terms, click I accept the terms in the License Agreement, and then click Next.
On the Choose Setup Type page:
Click Typical to install the most common program features in the default location on your computer.
Click Complete to install the full features of Netzwerkmonitor.
Click Custom to choose the program features you want installed and the location where you want them installed on your computer.
On the Ready to Install page, if you do not want a shortcut placed on your desktop, clear the Create shortcut for Microsoft Network Monitor on the desktop option, and then click Install when you are ready to start the installation.
On the Completing the Setup Wizard page, click Finish. The installation progresses, and also automatically installs a default set of base, core and common parsers.
You can then download and install the latest Netzwerkmonitor parsers.
Netzwerkmonitor help is also installed and is available on the Help menu as compiled help, or as commonly asked questions; for example "How Do I Use Filters?"
Appendix B: Install the Latest Microsoft Network Monitor Parsers
Download Microsoft Network Monitor Parsers on the CodePlex page. Netzwerkmonitor comes with a default version of base, core, common and Windows parsers, but you should install the latest available versions. You also must install the latest version of the default parsers before you can install Microsoft Office and SharePoint Products Netzwerkmonitor, Lync, or SQL parsers.
To install Microsoft Network Monitor Parsers
On the CodePlex page, on the right side, click View All Downloads to display all the available downloads, and then click the appropriate Download button for the 32-bit or the 64-bit operating system.
On the License page, if you agree with the terms, click I Agree.
Click Run to immediately begin the installation. You can also save the executable file on your computer for a later installation.
On the Welcome to the Microsoft Network Monitor: Network Monitor Parsers 3.4 Setup Wizard page, click Next.
On the End-User License Agreement page, if you agree with the terms, click I accept the terms in the License Agreement, and then click Next.
Because you installed a default version of parsers during the initial installation of Netzwerkmonitor, on the Previous versions of Microsoft Network Monitor: NetworkMonitor Parsers 3.4 page, click Yes to upgrade to the latest version of parsers, and then click Next.
On the Choose Setup Type page:
Click Typical to install the most common program features in the default location on your computer.
Click Custom to choose the program features you want installed and the location where you want them installed on your computer.
Hinweis Typical setup is recommended for most users. Currently Complete setup is the same as the Typical setup.
On the Ready to Install page, click Install when you are ready to start the installation.
On the Completing the Setup Wizard page, click Finish.
Appendix C: Install the Latest Office and SharePoint Products Network Monitor Parsers
Download the latest Microsoft Office and SharePoint Products Network Monitor Parser.
To install Office and SharePoint Products Network Monitor Parsers
Click the appropriate Download button for the 32-bit or the 64-bit operating system.
Click Run to immediately begin the installation. You can also save the executable file on your computer for a later installation.
On the Welcome to the Office and SharePoint Products Network Monitor Parsers Setup Wizard page, click Next.
On the End-User License Agreement page, if you agree with the terms, click I accept the terms in the License Agreement, and then click Next.
On the Choose Setup Type page:
Click Typical to install the most common program features in the default location on your computer.
Click Custom to choose the program features you want installed and the location where you want them installed on your computer.
Hinweis Typical setup is recommended for most users. Currently Complete setup is the same as the Typical setup.
On the Ready to Install page, click Install when you are ready to start the installation.
On the Completing the Setup Wizard page, click Finish.
Appendix D: Install the Latest Lync and SQL Network Monitor Parsers
After you have installed the latest Netzwerkmonitor parsers, you can also install The Lync Network Monitor Parsers and The SQL Network Monitor Parsers. The installation process is very similar to the Microsoft Office and SharePoint Products Netzwerkmonitor Parsers installation.
Appendix E: Microsoft Office and SharePoint Parser File Filters
The Microsoft Office and SharePoint Products parser files have, in most cases, a one-to-one relationship to a Microsoft Office or SharePoint Products open specification. The parser file name reflects the parent open specification. For example, MS-VERSS.npl contains a set of rules that is used to capture the network traffic defined in the MS-VERSS open specification.
Some open specifications, however, have multiple filters, and the filter name corresponds to structures used in the parser files. In the following table, the filter name for such parser files is noted as multiple. Whenever a parser file has multiple filters, you can view the parser file in Netzwerkmonitor, identify the structure name, and then type that structure name as a filter in the Display Filter window. For example, from the MS-CSOMSPT.npl open specification, you can use the structure name "CSOMSPTAddFieldAsXmlSchemaXmlParameter" to filter network traffic related to the AddField XmlParameter of the MS-CSOMSPT open specification.
The following table lists each Microsoft Office and SharePoint parser file, a link to the corresponding open specification, and the filter name that you can use to filter the related network traffic. The filter name is listed as multiple for parsers that use structure names as filters.
Parser file name |
Filter name |
Link to the Open Specification |
---|---|---|
MS-ADMINS.npl |
MSADMINS |
|
MS-ADMWS.npl |
MSADMWS |
|
MS-ADS.npl |
MSADS |
|
MS-ALERTSS.npl |
MSALERTSS |
|
MS-ASWS.npl |
MSASWS |
|
MS-AUTHWS.npl |
MSAUTHWS |
|
MS-AXL.npl |
MSAXL |
|
MS-BCSDWPS.npl |
MSBCSDWPS |
|
MS-BDCDP.npl |
MSBDCDP |
|
MS-BDCMP.npl |
MSBDCMP |
|
MS-BDCRAWPS.npl |
MSBDCRAWPS |
|
MS-BDCWPS.npl |
MSBDCWPS |
|
MS-CDEPLOY.npl |
MSCDEPLOY |
|
MS-CONATB.npl |
MSCONATB |
|
MS-COPYS.npl |
MSCOPYS |
|
MS-CPSWS.npl |
MSCPSWS |
|
MS-CSOM.npl |
MSCSOM |
|
MS-CSOMSPT.npl |
multiple |
|
MS-DADMWS.npl |
MSDADMWS |
|
MS-DOCTRANS.npl |
MSDOCTRANS |
|
MS-DSPSTSS.npl |
MSDSPSTSS |
|
MS-DWSS.npl |
MSDWSS |
|
MS-EAWF.npl |
MSEAWF |
|
MS-ECTPWPS.npl |
MSECTPWPS |
|
MS-EMMWCF.npl |
MSEMMWCF |
|
MS-EMMWS.npl |
MSEMMWS |
|
MS-ESP.npl |
MSESP |
|
MS-ESURL.npl |
MSESURL |
|
MS-EXSPWS.npl |
MSEXSPWS |
|
MS-EXSPWS2.npl |
MSEXSPWS2 |
|
MS-EXSPXML.npl |
MSEXSPXML |
|
MS-FORMS.npl |
MSFORMS |
|
MS-FSDAP.npl |
MSFSDAP |
|
MS-FSFDP.npl |
MSFSFDP |
|
MS-FSPP.npl |
MSFSPP |
|
MS-FSSHTTP.npl |
MSFSSHTTP |
|
MS-FSSHTTPB.npl |
MSFSSHTTPB |
|
MS-FSSHTTPD.npl |
multiple |
|
MS-GLOADWS.npl |
MSGLOADWS |
|
MS-GRVHENC.npl |
MSGRVHENC |
|
MS-GRVSSTP.npl |
MSGRVSSTP |
|
MS-GRVSSTPS.npl |
MSGRVSSTPS |
|
MS-GRVWDPP.npl |
MSGRVWDPP |
|
MS-IMAGS.npl |
MSIMAGS |
|
MS-INFODCF.npl |
MSINFODCF |
|
MS-IPDSP.npl |
MSIPDSP |
|
MS-IPHWS.npl |
MSIPHWS |
|
MS-LISTSWS.npl |
MSLISTSWS |
|
MS-MAR.npl |
MSMAR |
|
MS-MEETS.npl |
MSMEETS |
|
MS-MERX.npl |
MSMERX |
|
MS-METAWEB.npl |
MSMETAWEB |
|
MS-NOTESWS.npl |
MSNOTESWS |
|
MS-OFBA.npl |
MSOFBA |
|
MS-OFFICIALFILE.npl |
MSOFFICIALFILE |
|
MS-OMPWHP.npl |
MSOMPWHP |
|
MS-OMS.npl |
MSOMS |
|
MS-OMWWH.npl |
MSOMWWH |
|
MS-OOWQWS.npl |
MSOOWQWS |
|
MS-OSALER.npl |
MSOSALER |
|
MS-OSCO.npl |
MSOSCO |
|
MS-OUTSPS.npl |
MSOUTSPS |
|
MS-PEOPS.npl |
MSPEOPS |
|
MS-PERMS.npl |
MSPERMS |
|
MS-PLSP.npl |
MSPLSP |
|
MS-PPSAPP.npl |
MSPPSAPP |
|
MS-PPSAS.npl |
MSPPSAS |
|
MS-PPSDECO.npl |
MSPPSDECO |
|
MS-PRSTFR.npl |
MSPRSTFR |
|
MS-PUBWS.npl |
MSPUBWS |
|
MS-PWBDPS.npl |
MSPWBDPS |
|
MS-PWBHPS.npl |
MSPWBHPS |
|
MS-PWBPS.npl |
MSPWBPS |
|
MS-PWEDPS.npl |
MSPWEDPS |
|
MS-PWVPDP.npl |
MSPWVPDP |
|
MS-PWVRSC.npl |
MSPWVRSC |
|
MS-QSSWS.npl |
MSQSSWS |
|
MS-SADMWS.npl |
MSSADMWS |
|
MS-SEARCH.npl |
MSSEARCH |
|
MS-SHDACCWS.npl |
MSSHDACCWS |
|
MS-SITED3S.npl |
MSSITED3S |
|
MS-SITEDATS.npl |
MSSITEDATS |
|
MS-SITESS.npl |
MSSITESS |
|
MS-SLIDELI.npl |
MSSLIDELI |
|
MS-SPAFWI.npl |
MSSPAFWI |
|
MS-SPDIAG.npl |
MSSPDIAG |
|
MS-SPEMAWS.npl |
MSSPEMAWS |
|
MS-SPLCHK.npl |
MSSPLCHK |
|
MS-SPPTC.npl |
MSSPPTC |
|
MS-SPRSS.npl |
multiple |
|
MS-SPSCRWL.npl |
MSSPSCRWL |
|
MS-SPSETWS.npl |
MSSPSETWS |
|
MS-SPTWS.npl |
MSSPTWS |
|
MS-SQP.npl |
MSSQP |
|
MS-SQP2.npl |
MSSQP2 |
|
MS-SSP.npl |
MSSSP |
|
MS-SSWPS.npl |
MSSSWPS |
|
MS-STSSYN.npl |
MSSTSSYN |
|
MS-STWEB.npl |
MSSTWEB |
|
MS-TMPLDISC.npl |
MSTMPLDISC |
|
MS-UDCX.npl |
MS-UDCX |
|
MS-UGS.npl |
MSUGS |
|
MS-UPIEWS.npl |
MSUPIEWS |
|
MS-UPSCWS.npl |
MSUPSCWS |
|
MS-UPSDWS.npl |
MSUPSCWS |
|
MS-UPWCFWS.npl |
MSUPWCFWS |
|
MS-USPSWS.npl |
MSUSPSWS |
|
MS-USRPCH.npl |
MSUSRPCH |
|
MS-VERSS.npl |
MSVERSS |
|
MS-VGSP.npl |
MSVGSP |
|
MS-VIEWSS.npl |
MSVIEWSS |
|
MS-WDVMODUU.npl |
MSWDVMODUU |
|
MS-WEBDAVE.npl |
MSWEBDAVE |
|
MS-WEBSS.npl |
MSWEBSS |
|
MS-WORDSWCF.npl |
MSWORDSWCF |
|
MS-WPPS.npl |
MSWPPS |
|
MS-WSSCAML.npl |
MSWSSCAML |
|
MS-WSSCAP.npl |
MSWSSCAP |
|
MS-WSSHP.npl |
MSWSSHP |
|
MS-WSSREST.npl |
MSWSSREST |
|
MS-WWSP.npl |
MSWWSP |