Microsoft Network Monitor (Netmon) is a deprecated packet analyzer. It enables capturing, viewing, and analyzing network data and deciphering network protocols. It can be used to troubleshoot network problems and applications on the network. Microsoft Network Monitor 1.0 (codenamed Bloodhound) was originally designed and developed by Raymond Patch, a transport protocol and network adapter device driver engineer on the Microsoft LAN Manager development team.
| Original author(s) | Raymond Patch, Tom Laird-McConnell, Steve Hiskey, Steve Rosato |
|---|---|
| Developer(s) | Microsoft |
| Final release | 3.4
/ June 24, 2010 |
| Operating system | Windows |
| Type | Packet analyzer |
| Website | blogs |
Network Monitor was replaced by Microsoft Message Analyzer (MMA was discontinued in 2019[1]).
History
editThe LAN Manager development team had one shared hardware-based analyzer at the time. Netmon was conceived when the hardware analyzer was taken during a test to reproduce a networking bug, and the first Windows prototype was coded over the Christmas holiday. The first 4 bytes of the Netmon capture file format were used to validate the file. The values were 'RTSS' for Ray, Tom, Steve, and Steve - the first four members of the team. The code was originally written for OS/2 and had no user interface; a symbol was placed in the device driver where the packet buffers were kept so received data could be dumped in hex from within the kernel debugger.
Netmon caused a bit of a stir for Microsoft IT since networks and e-mail were not encrypted at the time. Only a few software engineers had access to hardware analyzers due to their cost, but with Netmon many engineers around the company had access to network traffic for free. At the request of Microsoft IT, two simple identification features were added - a non-cryptographic password and an identification protocol named the Bloodhound-Oriented Network Entity (BONE) (created and named by Raymond Patch as a play on the codename Bloodhound).
Network Monitor 3 is a complete overhaul of the earlier Network Monitor 2.x version. Originally, versions of Network Monitor were only available through other Microsoft products, such as Systems Management Server (SMS). But now the fully featured product with public parsers is available as a free download.
Microsoft Network Monitor was superseded by Microsoft Message Analyzer [2] Microsoft Message Analyzer was retired in 2019 [3]
Features
editSome key features of Network Monitor 3.4 include the following:
- Process tracking
- Grouping by network conversation
- Support for over 300 public and Microsoft proprietary protocols
- Simultaneous capture sessions
- Wireless Monitor Mode with supported wireless NICs
- Real-time capture and display of frames
- Reassembly of fragmented data
- Sniffing of promiscuous mode traffic
- Can read libpcap capture files
- API to access capture and parsing engine
References
edit- ^ "[MS-WININTBLOGLP]: Microsoft Message Analyzer Blog". Microsoft Docs. November 25, 2019.
- ^ Paul E Long (17 September 2012). "Meet the successor to Microsoft Network Monitor!". Microsoft TechNet.
- ^ greggigwg. "Microsoft Message Analyzer Operating Guide - Message Analyzer". docs.microsoft.com. Retrieved 2021-08-26.
External links
edit- Microsoft Network Monitor:
- Download 3.4 (archive)
- (Download) Windows and SQL Server Network Monitor Parsers
- Blog
- Forum Support for 3
- "Information about Network Monitor 3". KB Article. MS Support. June 21, 2014. 933741.
- Experts at CodePlex
- Open Source Parsers at CodePlex
- "How to Monitor Network Traffic on Windows Server 2008". ITT Systems.
- Microsoft Message Analyzer:
- Download 1.1
- "Microsoft Message Analyzer Blog". Microsoft TechNet. Archived from the original on June 12, 2019.
- Long, Paul E (Sep 17, 2012). "Meet the successor to Microsoft Network Monitor!". Blog. Archived from the original on September 23, 2012.
- Forum Support for 1.1
- Message Analyzer (Network Monitor's successor) on Microsoft Connect