Using Network Monitor with the Microsoft Office and SharePoint Products Parsers

Summary: This article introduces Network Monitor, defines and provides an example of parsers, and shows how to install Network Monitor and the latest versions of Windows, Microsoft Office and SharePoint Products Network Monitor, SQL, and Lync parsers. The parser example focuses on the Microsoft Office and SharePoint Products parsers, and describes how to use these parsers along with standard Network Monitor features to inspect and analyze specific network traffic data.

Published:   August 2011

Applies to: Business Connectivity Services | Office client | Open XML | SharePoint Designer 2010 | SharePoint Foundation 2010 | SharePoint Online | SharePoint Server 2010 | Visual Studio

Provided by: Microsoft Corporation

Contents

Introduction to Network Monitor

Network Monitor is a tool that you use to view, or capture network traffic in real time and analyze it against filters and parsers that you have installed or created. Network Monitor installs a default set of core, base, common, and Windows parsers, but Microsoft also offers parsers for Microsoft Office and SharePoint Products, Lync and SQL protocols as well as updated core, base, common and Windows parsers that must be installed before installing any other parsers offered by Microsoft.

The standard features of Network Monitor enable you to:

  • View real-time network traffic.

  • Capture network traffic and save it in a file for future analysis.

Network Monitor also includes a standard set of filters that help you identify and capture the particular network traffic and data that most interests you.

You can download the latest version of Microsoft Network Monitor from the Microsoft Download Center. For more information, see Appendix A: Install Network Monitor.

Network Monitor Parsers

Parsers are script files written by using the Network Monitor Parsing Language (NPL) that specifies the layout of network data. You can use a parser file as a filter to isolate the data that is pertinent to the protocol or structure defined by the parser file.

The following figure shows the basic layout of Network Monitor with the base, core, common and Windows parsers that are supplied with it. It also shows the other available parsers that extend the basic set of parsers, which is discussed in more detail in the next section, Overview of Microsoft Office and SharePoint Products Network Monitor Parsers.

Network Monitor and Parsers Overview

Figure 1. Network Monitor and the available parsers

Overview of Microsoft Office and SharePoint Products Network Monitor Parsers

The Microsoft Office and SharePoint Products Network Monitor Parsers extend the default parsers in Network Monitor by enabling you to get a more detailed look into the Microsoft Office and SharePoint protocol traffic. The Microsoft Office and SharePoint Products parsers consist of parser files that have, in most cases, a one-to-one relationship to a Microsoft Office or SharePoint open specification. For more information about how the parser files map to the Microsoft Office and SharePoint open specifications, see Appendix E: Microsoft Office and SharePoint Parser File Filters. The parser file name reflects the parent open specification. For example, MS-VERSS.npl contains a set of rules that is used to capture the network traffic that is defined in the MS-VERSS open specification. The Microsoft Office and SharePoint parser package includes support for the 2007 Microsoft Office system, Microsoft Office 2010, SharePoint Products and Technologies, and Microsoft SharePoint 2010.

Microsoft Office and SharePoint Products parsers are designed to help you monitor network traffic for solutions that you create by using the Microsoft Office and SharePoint Products and Technologies open specifications. By using the parsers and Network Monitor, you can efficiently debug your protocol implementation by gaining enhanced insight into the protocol traffic.

The most recent set of the default MicrosoftNetwork Monitor parsers and Microsoft Office and SharePoint Product parsers are available for download from CodePlex and the Microsoft Download Center, as described in the following table. The table also includes links to the latest versions of MicrosoftNetwork Monitor, Lync, and SQL parsers that define parser files pertaining to specific Lync and SQL open specifications.

Available parser package downloads

Parser package download link

Installation instructions

Microsoft Network Monitor Parsers

Appendix B: Install the Latest Microsoft Network Monitor Parsers

Microsoft Office and SharePoint Products Network Monitor Parsers

Appendix C: Install the Latest Office and SharePoint Products Network Monitor Parsers

The Lync Network Monitor Parsers

Appendix D: Install the Latest Lync and SQL Network Monitor Parsers

The SQL Network Monitor Parsers

Appendix D: Install the Latest Lync and SQL Network Monitor Parsers

Microsoft Office and SharePoint Products Network Monitor Parsers Example

After you install the parsers that you need, you need to activate them. After activating them, you can verify the installations by using the Parser Profiles option in Network Monitor.

You can also verify that the parsers are installed by using the View installed updates feature under Programs and Features in Control Panel.

In the following example shows the activation for Microsoft Office and SharePoint Products Network Monitor parsers; however, the process is the same for any installed parsers.

To activate the Office and SharePoint Products Network Monitor Parsers

  1. In Network Monitor, click Parser Profiles, and then click Parser Profile Options.

  2. In the Options dialog box, right-click Office, click Set As Active, and then click OK.

    Set Office parsers to active

    Figure 2. The Options dialog box

  3. This step builds and sets the Microsoft Office and SharePoint Products Network Monitor parsers as active so that you can use them to analyze network traffic data.

  4. Click the Parsers tab.

  5. In Object View, click Parser Files to expand it.

    Network Monitor Parser FIles

    Figure 3. The Object View in Network Monitor

  6. In the parser file list, locate a Microsoft Office parser file, for example "MS-VERSS.npl", double-click it to view the source file in the code window.

    MS-VERSS NPL FIle

    Figure 4. MS-VERSS.npl

The following example shows how to capture the network traffic for a Microsoft Word 2010 file that is created, saved on a SharePoint Product and Technologies site, and then versioned.

View the Word 2010 network conversations

  1. On the Network Monitor menu bar, click New Capture, and then click Start.

  2. Create a new Word 2010 document, enter some text, and then save it as "creating capturedemo.docx" to a SharePoint Products and Technologies site that has version control enabled.

  3. Check out the document, and add more text.

  4. Save the file, and in the Check In dialog box, select Minor version for the version type.

  5. Save the file, and in the Check In dialog box, select Minor version for the version type.

  6. On the Network Monitor menu bar, click Stop.

    Click Save As to optionally save the capture into a file.

  7. In the Network Conversations window, select WINWORD.EXE to view the network traffic for the creating capturedemo.docx file as it progressed through the steps 2 through 6.

    View Word conversation

    Figure 5. The Network Conversations window with Word conversations selected

  8. The Frame Summary window shows all the Microsoft Word traffic, the Frame Details window shows the details for the selected frame, and the Hex Details window shows the details for the selected frame in hexadecimal representation.

    Network Monitor capture for a Word file

    Figure 6. The Frame Summary and Frame Details windows showing a network capture for a Word file

    The data shows the network traffic for this conversation, including the following five open specifications:

    • MS-WSSCAP

    • MS-WEBBS

    • MS-LISTSWS

    • MS-VERSS

    • MS-FSSHTTP

  9. To view only the traffic that is defined by the Microsoft Office and SharePoint Products parsers, type the following in the Display Filter window:

    .Protocol.MSWSSCAP or
    .Protocol.MSWEBSS or
    .Protocol.MSLISTSWS or
    .Protocol.MSVERSS or
    .Protocol.MSFSSHTTP
    
  10. Click Apply to show only the filtered data in the Frame Summary window.

    For more information about how filter names map to the open specifications, see Appendix E: Microsoft Office and SharePoint Parser File Filters.

    Note

    Type the Microsoft Office protocol name without the dash after the "MS."

    Only the data related to the filters that are currently applied is now displayed in the Frame Summary window.

    Office and SharePoint Products filters

    Figure 7. The Destination values shown as an "ENDPOINT" alias and an IP address

Add an alias for the SharePoint server

  1. To create an alias for the destination address, right-click on the server IP address in the Destination column of a frame, and then click Create Alias for ‘Destination’ Address.

  2. In the Create New Alias dialog box, in the Name:* field, type SharePoint Server, and then click OK.

    The Frame Summary window displays the addresses in the Destination column as the easy to understand alias, you created, instead of a network address.

    Frame Summary window with aliases

    Figure 8. The Destination values shown as "ENDPOINT" and "SharePoint Server" aliases

Add a color rule for MS-VERSS traffic

  1. You can use color rules to more easily distinguish the network traffic data that displays in the Frame Summary window. To create a new color rule:

  2. On the top frame of the Frame Summary window, click Color Rules.

  3. In the Manage rules: box, click New.

  4. In the Add New Color Rule dialog box, in the Enter filter expression box, type .Protocol.MSVERSS.

    Click Background color, select green, and then click OK twice.

    Netwrok Monitor Color Rule

    Figure 9. The Add New Color Rule dialog box

    The Frame Summary window now displays the MSVERSS request and response messages as green.

    Frame SUmmary window with color rules

    Figure 10. The MS-VERSS request and response messages

Examine MS-VERSS data

  1. To see a simple example of how to use the Microsoft Office protocols to understand the network data, click an MSVERSS request message in the Frame Summary window.

  2. In the Frame Details window, expand nodes until you see the file name that you created for the Wordfile when you checked it into Microsoft SharePoint Server.

    Filename for a version request file

    Figure 11. MS-VERSS network data nodes

    You can further examine all the nodes in the Frame Summary window for all the MSVERSS response and request messages.

Appendix A: Install Network Monitor

To install the Microsoft Network Monitor 3.4, or the latest version of Network Monitor, download Network Monitor from the Microsoft download center. The download center always has the latest available version of Network Monitor.

To install the latest version of Network Monitor

  1. On the download page, click the appropriate Download button for the 32-bit or the 64-bit operating system.

  2. Click Run to immediately begin the installation. You can also save the executable file on your computer for a later installation.

  3. Click Yes to confirm the installation.

  4. On the Welcome to the Microsoft Network Monitor 3.4 (Capture and Parser Engine) Setup Wizard page, click Next.

  5. On the End-User License Agreement page, if you agree with the terms, click I accept the terms in the License Agreement, and then click Next.

  6. On the Choose Setup Type page:

    • Click Typical to install the most common program features in the default location on your computer.

    • Click Complete to install the full features of Network Monitor.

    • Click Custom to choose the program features you want installed and the location where you want them installed on your computer.

  7. On the Ready to Install page, if you do not want a shortcut placed on your desktop, clear the Create shortcut for Microsoft Network Monitor on the desktop option, and then click Install when you are ready to start the installation.

  8. On the Completing the Setup Wizard page, click Finish. The installation progresses, and also automatically installs a default set of base, core and common parsers.

You can then download and install the latest Network Monitor parsers.

Network Monitor help is also installed and is available on the Help menu as compiled help, or as commonly asked questions; for example "How Do I Use Filters?"

Appendix B: Install the Latest Microsoft Network Monitor Parsers

Download Microsoft Network Monitor Parsers on the CodePlex page. Network Monitor comes with a default version of base, core, common and Windows parsers, but you should install the latest available versions. You also must install the latest version of the default parsers before you can install Microsoft Office and SharePoint Products Network Monitor, Lync, or SQL parsers.

To install Microsoft Network Monitor Parsers

  1. On the CodePlex page, on the right side, click View All Downloads to display all the available downloads, and then click the appropriate Download button for the 32-bit or the 64-bit operating system.

  2. On the License page, if you agree with the terms, click I Agree.

  3. Click Run to immediately begin the installation. You can also save the executable file on your computer for a later installation.

  4. On the Welcome to the Microsoft Network Monitor: Network Monitor Parsers 3.4 Setup Wizard page, click Next.

  5. On the End-User License Agreement page, if you agree with the terms, click I accept the terms in the License Agreement, and then click Next.

  6. Because you installed a default version of parsers during the initial installation of Network Monitor, on the Previous versions of Microsoft Network Monitor: NetworkMonitor Parsers 3.4 page, click Yes to upgrade to the latest version of parsers, and then click Next.

  7. On the Choose Setup Type page:

    • Click Typical to install the most common program features in the default location on your computer.

    • Click Custom to choose the program features you want installed and the location where you want them installed on your computer.

    Note

    Typical setup is recommended for most users. Currently Complete setup is the same as the Typical setup.

  8. On the Ready to Install page, click Install when you are ready to start the installation.

  9. On the Completing the Setup Wizard page, click Finish.

Appendix C: Install the Latest Office and SharePoint Products Network Monitor Parsers

Download the latest Microsoft Office and SharePoint Products Network Monitor Parser.

To install Office and SharePoint Products Network Monitor Parsers

  1. Click the appropriate Download button for the 32-bit or the 64-bit operating system.

  2. Click Run to immediately begin the installation. You can also save the executable file on your computer for a later installation.

  3. On the Welcome to the Office and SharePoint Products Network Monitor Parsers Setup Wizard page, click Next.

  4. On the End-User License Agreement page, if you agree with the terms, click I accept the terms in the License Agreement, and then click Next.

  5. On the Choose Setup Type page:

    • Click Typical to install the most common program features in the default location on your computer.

    • Click Custom to choose the program features you want installed and the location where you want them installed on your computer.

    Note

    Typical setup is recommended for most users. Currently Complete setup is the same as the Typical setup.

  6. On the Ready to Install page, click Install when you are ready to start the installation.

  7. On the Completing the Setup Wizard page, click Finish.

Appendix D: Install the Latest Lync and SQL Network Monitor Parsers

After you have installed the latest Network Monitor parsers, you can also install The Lync Network Monitor Parsers and The SQL Network Monitor Parsers. The installation process is very similar to the Microsoft Office and SharePoint Products Network Monitor Parsers installation.

Appendix E: Microsoft Office and SharePoint Parser File Filters

The Microsoft Office and SharePoint Products parser files have, in most cases, a one-to-one relationship to a Microsoft Office or SharePoint Products open specification. The parser file name reflects the parent open specification. For example, MS-VERSS.npl contains a set of rules that is used to capture the network traffic defined in the MS-VERSS open specification.

Some open specifications, however, have multiple filters, and the filter name corresponds to structures used in the parser files. In the following table, the filter name for such parser files is noted as multiple. Whenever a parser file has multiple filters, you can view the parser file in Network Monitor, identify the structure name, and then type that structure name as a filter in the Display Filter window. For example, from the MS-CSOMSPT.npl open specification, you can use the structure name "CSOMSPTAddFieldAsXmlSchemaXmlParameter" to filter network traffic related to the AddField XmlParameter of the MS-CSOMSPT open specification.

The following table lists each Microsoft Office and SharePoint parser file, a link to the corresponding open specification, and the filter name that you can use to filter the related network traffic. The filter name is listed as multiple for parsers that use structure names as filters.

Parser file name

Filter name

Link to the Open Specification

MS-ADMINS.npl

MSADMINS

MS-ADMINS

MS-ADMWS.npl

MSADMWS

MS-ADMWS

MS-ADS.npl

MSADS

MS-ADS

MS-ALERTSS.npl

MSALERTSS

MS-ALERTSS

MS-ASWS.npl

MSASWS

MS-ASWS

MS-AUTHWS.npl

MSAUTHWS

MS-AUTHWS

MS-AXL.npl

MSAXL

MS-AXL

MS-BCSDWPS.npl

MSBCSDWPS

MS-BCSDWPS

MS-BDCDP.npl

MSBDCDP

MS-BDCDP

MS-BDCMP.npl

MSBDCMP

MS-BDCMP

MS-BDCRAWPS.npl

MSBDCRAWPS

MS-BDCRAWPS

MS-BDCWPS.npl

MSBDCWPS

MS-BDCWPS

MS-CDEPLOY.npl

MSCDEPLOY

MS-CDEPLOY

MS-CONATB.npl

MSCONATB

MS-CONATB

MS-COPYS.npl

MSCOPYS

MS-COPYS

MS-CPSWS.npl

MSCPSWS

MS-CPSWS

MS-CSOM.npl

MSCSOM

MS-CSOM

MS-CSOMSPT.npl

multiple

MS-CSOMSPT

MS-DADMWS.npl

MSDADMWS

MS-DADMWS

MS-DOCTRANS.npl

MSDOCTRANS

MS-DOCTRANS

MS-DSPSTSS.npl

MSDSPSTSS

MS-DSPSTSS

MS-DWSS.npl

MSDWSS

MS-DWSS

MS-EAWF.npl

MSEAWF

MS-EAWF

MS-ECTPWPS.npl

MSECTPWPS

MS-ECTPWPS

MS-EMMWCF.npl

MSEMMWCF

MS-EMMWCF

MS-EMMWS.npl

MSEMMWS

MS-EMMWS

MS-ESP.npl

MSESP

MS-ESP

MS-ESURL.npl

MSESURL

MS-ESURL

MS-EXSPWS.npl

MSEXSPWS

MS-EXSPWS

MS-EXSPWS2.npl

MSEXSPWS2

MS-EXSPWS2

MS-EXSPXML.npl

MSEXSPXML

MS-EXSPXML

MS-FORMS.npl

MSFORMS

MS-FORMS

MS-FSDAP.npl

MSFSDAP

MS-FSDAP

MS-FSFDP.npl

MSFSFDP

MS-FSFDP

MS-FSPP.npl

MSFSPP

MS-FSPP

MS-FSSHTTP.npl

MSFSSHTTP

MS-FSSHTTP

MS-FSSHTTPB.npl

MSFSSHTTPB

MS-FSSHTTPB

MS-FSSHTTPD.npl

multiple

MS-FSSHTTPD

MS-GLOADWS.npl

MSGLOADWS

MS-GLOADWS

MS-GRVHENC.npl

MSGRVHENC

MS-GRVHENC

MS-GRVSSTP.npl

MSGRVSSTP

MS-GRVSSTP

MS-GRVSSTPS.npl

MSGRVSSTPS

MS-GRVSSTPS

MS-GRVWDPP.npl

MSGRVWDPP

MS-GRVWDPP

MS-IMAGS.npl

MSIMAGS

MS-IMAGS

MS-INFODCF.npl

MSINFODCF

MS-INFODCF

MS-IPDSP.npl

MSIPDSP

MS-IPDSP

MS-IPHWS.npl

MSIPHWS

MS-IPHWS

MS-LISTSWS.npl

MSLISTSWS

MS-LISTSWS

MS-MAR.npl

MSMAR

MS-MAR

MS-MEETS.npl

MSMEETS

MS-MEETS

MS-MERX.npl

MSMERX

MS-MERX

MS-METAWEB.npl

MSMETAWEB

MS-METAWEB

MS-NOTESWS.npl

MSNOTESWS

MS-NOTESWS

MS-OFBA.npl

MSOFBA

MS-OFBA

MS-OFFICIALFILE.npl

MSOFFICIALFILE

MS-OFFICIALFILE

MS-OMPWHP.npl

MSOMPWHP

MS-OMPWHP

MS-OMS.npl

MSOMS

MS-OMS

MS-OMWWH.npl

MSOMWWH

MS-OMWWH

MS-OOWQWS.npl

MSOOWQWS

MS-OOWQWS

MS-OSALER.npl

MSOSALER

MS-OSALER

MS-OSCO.npl

MSOSCO

MS-OSCO

MS-OUTSPS.npl

MSOUTSPS

MS-OUTSPS

MS-PEOPS.npl

MSPEOPS

MS-PEOPS

MS-PERMS.npl

MSPERMS

MS-PERMS

MS-PLSP.npl

MSPLSP

MS-PLSP

MS-PPSAPP.npl

MSPPSAPP

MS-PPSAPP

MS-PPSAS.npl

MSPPSAS

MS-PPSAS

MS-PPSDECO.npl

MSPPSDECO

MS-PPSDECO

MS-PRSTFR.npl

MSPRSTFR

MS-PRSTFR

MS-PUBWS.npl

MSPUBWS

MS-PUBWS

MS-PWBDPS.npl

MSPWBDPS

MS-PWBDPS

MS-PWBHPS.npl

MSPWBHPS

MS-PWBHPS

MS-PWBPS.npl

MSPWBPS

MS-PWBPS

MS-PWEDPS.npl

MSPWEDPS

MS-PWEDPS

MS-PWVPDP.npl

MSPWVPDP

MS-PWVPDP

MS-PWVRSC.npl

MSPWVRSC

MS-PWVRSC

MS-QSSWS.npl

MSQSSWS

MS-QSSWS

MS-SADMWS.npl

MSSADMWS

MS-SADMWS

MS-SEARCH.npl

MSSEARCH

MS-SEARCH

MS-SHDACCWS.npl

MSSHDACCWS

MS-SHDACCWS

MS-SITED3S.npl

MSSITED3S

MS-SITED3S

MS-SITEDATS.npl

MSSITEDATS

MS-SITEDATS

MS-SITESS.npl

MSSITESS

MS-SITESS

MS-SLIDELI.npl

MSSLIDELI

MS-SLIDELI

MS-SPAFWI.npl

MSSPAFWI

MS-SPAFWI

MS-SPDIAG.npl

MSSPDIAG

MS-SPDIAG

MS-SPEMAWS.npl

MSSPEMAWS

MS-SPEMAWS

MS-SPLCHK.npl

MSSPLCHK

MS-SPLCHK

MS-SPPTC.npl

MSSPPTC

MS-SPPTC.npl

MS-SPRSS.npl

multiple

MS-SPRSS

MS-SPSCRWL.npl

MSSPSCRWL

MS-SPSCRWL

MS-SPSETWS.npl

MSSPSETWS

MS-SPSETWS

MS-SPTWS.npl

MSSPTWS

MS-SPTWS

MS-SQP.npl

MSSQP

MS-SQP

MS-SQP2.npl

MSSQP2

MS-SQP2

MS-SSP.npl

MSSSP

MS-SSP

MS-SSWPS.npl

MSSSWPS

MS-SSWPS

MS-STSSYN.npl

MSSTSSYN

MS-STSSYN

MS-STWEB.npl

MSSTWEB

MS-STWEB

MS-TMPLDISC.npl

MSTMPLDISC

MS-TMPLDISC

MS-UDCX.npl

MS-UDCX

MS-UDCX

MS-UGS.npl

MSUGS

MS-UGS

MS-UPIEWS.npl

MSUPIEWS

MS-UPIEWS

MS-UPSCWS.npl

MSUPSCWS

MS-UPSCWS

MS-UPSDWS.npl

MSUPSCWS

MS-UPSDWS

MS-UPWCFWS.npl

MSUPWCFWS

MS-UPWCFWS

MS-USPSWS.npl

MSUSPSWS

MS-USPSWS

MS-USRPCH.npl

MSUSRPCH

MS-USRPCH

MS-VERSS.npl

MSVERSS

MS-VERSS

MS-VGSP.npl

MSVGSP

MS-VGSP

MS-VIEWSS.npl

MSVIEWSS

MS-VIEWSS

MS-WDVMODUU.npl

MSWDVMODUU

MS-WDVMODUU

MS-WEBDAVE.npl

MSWEBDAVE

MS-WEBDAVE

MS-WEBSS.npl

MSWEBSS

MS-WEBSS

MS-WORDSWCF.npl

MSWORDSWCF

MS-WORDSWCF

MS-WPPS.npl

MSWPPS

MS-WPPS

MS-WSSCAML.npl

MSWSSCAML

MS-WSSCAML

MS-WSSCAP.npl

MSWSSCAP

MS-WSSCAP

MS-WSSHP.npl

MSWSSHP

MS-WSSHP

MS-WSSREST.npl

MSWSSREST

MS-WSSREST

MS-WWSP.npl

MSWWSP

MS-WWSP