Edit

Downloading Netmon and Sample DPWS Filters

  • Article

Microsoft Network Monitor 3 (Netmon) is a packet analyzer used to inspect network traffic. Netmon must be downloaded before the troubleshooting steps given in Inspecting Network Traces for UDP WS-Discovery and Inspecting Network Traces for HTTP Metadata Exchange can be followed. After Netmon has been downloaded, DPWS filters can be used to help isolate traffic of interest.

Downloading Netmon

To download Netmon, go to Microsoft Network Monitor, and follow the instructions. For more information about Netmon, see Information about Network Monitor 3.0.

Sample DPWS Filters

Sometimes, WS-Discovery and metadata exchange troubleshooting must take place on a busy network. The sample filters can be used to help limit the Netmon output to traffic of interest. For more information about using Netmon filters, see Information about Network Monitor 3.0.

The following example shows a filter that limits output to all broadcast WS-Discovery traffic.

Note

This filter does not capture traffic from stacks that do not respond to multicast WS-Discovery messages that originate at port 3702. If such a stack is being used, then this sample filter must be modified before use.

 

// All broadcast WS-Discovery traffic
UDP.Port == 3702

The following example shows a filter that limits output to HTTP messages sent to WSDAPI stacks on the default port.

Note

Services may send relevant HTTP messages from ports other than 5357. If traffic from other ports is of interest, then this sample filter must be modified before use.

 

// HTTP messages sent to WSDAPI stacks on default port
TCP.Port == 5357

The following example shows a filter that limits output to IPv4 multicast traffic.

// All IPv4 multicast traffic
IPv4.DestinationAddress == 239.255.255.250

The following example shows a filter that limits output to IPv6 multicast traffic.

// All IPv6 multicast traffic
IPv6.DestinationAddress == FF02::C

Some filters can be combined to further limit results. The following example shows a filter that limits output to IPv4 multicast WS-Discovery traffic.

// All IPv4 multicast WS-Discovery traffic
UDP.Port==3702 && IPv4.DestinationAddress=239.255.255.250

When these filters are used, relevant traffic may be excluded from the Netmon results. Exclusion can occur when services reside at ports other than the default ports (5357/5358) and when a DPWS stack does not respond to messages using the default port. In these cases, the filters must be modified before use.

WSDAPI Diagnostic Procedures

Getting Started with WSDAPI Troubleshooting