Heterogeneous Environments. Paul Long/Microsoft

(1)

Heterogeneous Environments

(2)

SNIA Legal Notice

The material contained in this tutorial is copyrighted by the SNIA unless

otherwise noted.

Member companies and individual members may use this material in

presentations and literature under the following conditions:

Any slide or slides used must be reproduced in their entirety without modification

The SNIA must be acknowledged as the source of any material used in the body of

any document containing material from these presentations.

This presentation is a project of the SNIA Education Committee.

Neither the author nor the presenter is an attorney and nothing in this

presentation is intended to be, or should be construed as legal advice or an

opinion of counsel. If you need legal advice or a legal opinion please

contact your attorney.

The information presented herein represents the author's personal opinion

and current understanding of the relevant issues involved. The author, the

presenter, and the SNIA do not assume any responsibility or liability for

damages arising out of any reliance on or use of this information.

NO WARRANTIES, EXPRESS OR IMPLIED. USE AT YOUR OWN RISK.

(3)

Message Analysis and Visualization in Heterogeneous

Environments

Microsoft Message Analyzer is the next generation tool for

analyzing messages from almost any source. Diagnosis of

heterogeneous systems has continued to evolve as we explore

new ways to visualize information for any type of trace data, be it

a text log file, comma or tab separated data, network capture, or

ETW component. Discover how to import Samba debug logs

directly or define Text Log adapters, then inspect, filter, and

organize as structured data. Learn how to analyze your file

systems interoperability with Windows without having to read

documentation. Expand your understanding of the interactions

by including Windows component-specific information to gain

insight into deep protocol and system behaviors.

(4)

Message Analyzer Activities

4 Capture

Analyze

Share

(5)

Simulates protocol behavior

Diagnosis messages for finding misbehavior

(6)

Message Analyzer differences?

Coalesces network information

Full defragmentation of messages

High level performance info, like Server Response Times

(7)

Different types of systems

Windows

Unix/Linux

Apple

Different kinds of traces and logs

Text logs

Network traces

Events for Windows Traces (ETL)

Different machines and parts of the world

Time shifts

Time zones

(8)

Sharing

Create and save assets

Filters, Trace Scenarios, Sequences, View Layouts, etc.

Share assets through feeds

Via network shares

Later via service

(9)

Sharing Demo

(10)

Capturing with Message Analyzer

SMB Client/Server

Very concise, no noise

Runs forever

No network related traffic like DNS, DHCP, ICMP, ARP

Firewall

Less overhead than capturing at the network layer

Can capture Loopback

Requires configuration

(11)

(12)

Analysis – Importing Data

Importing Homogeneous Data

Text Logs, CAP, ETL, CSV, PCAP, PCAPNG

Time Shifting

By time zone or just a smidge

(13)

Import Data Demo

(14)

Text Log Configuration

RegEx expressions and OPN to parse a text log file

Resources

http://msdn.microsoft.com/en-us/library/az24scfc.aspx

http://derekslager.com/blog/posts/2007/09/a-better-dotnet-regular-expression-tester.ashx

(15)

15 01/19 17:04:53 [MAILSLOT] Ping response 'Sam Logon Response Ex' (null) to

\\mphewqtbx308.hew.us.ml.com Site: 1-NewYork-HUB on UDP LDAP

01/19 17:04:53 [LOGON] SamLogon: Transitive Network logon of CORP\NBKTIYN from B80C16EFD31D0

(via enycvc03dfs01) Entered

01/19 17:04:53 [LOGON] NlPickDomainWithAccount: CORP\NBKTIYN: Algorithm entered. UPN:0 Sam:1

Exp:0 Cross: 0 Root:0 DC:0

01/19 17:04:53 [LOGON] NlPickDomainWithAccount: Username CORP\NBKTIYN is in forest

bankofamerica.com (found via LsaMatch)

01/19 17:04:53 [LOGON] SamLogon: Transitive Network logon of CORP\NBKTIYN from B80C16EFD31D0

(via enycvc03dfs01) Returns 0x0

(16)

Text Log Configuration file

16 //

// Message to capture Sam logon request.

//

message SamLogonRequest with

EntryInfo { Regex = @"

(?<nlts>[/0-9]+\s[/:0-9]+) \[(?<msgtype>[\S]+)\] SamLogon:

**Transitive Network logon of (?<UserName>[\S]+) (?<RemainingText>.*) Entered**

"

}

: BaseNetLogon

{

string UserName;

string RemainingText;

override string ToString()

{

return ("SamLogonRequest" + RemainingText);

}

01/19 17:04:53 [LOGON] SamLogon: Transitive Network logon of CORP\NBKTIYN from B80C16EFD31D0

(via enycvc03dfs01) Entered

(17)

17

(18)

PRESENTATION TITLE GOES HERE

Text Log Adapter

Demo

(19)

Validating Implementation

Diagnosis to understand adherence

Viewpoints

Hiding operations and exploring other network layers

Sequence Expressions

Describing complex patterns

Visualizations

Exposing patterns via pictures

(20)

Validation

(21)

Hide operations

Remove operations so request/responses aren’t grouped

Alternate viewpoint

Change your viewpoint to see traffic from a different layers

perspective

(22)

Viewpoint: Default

(23)

23

(24)

Viewpoint: Network

(25)

25

(26)

Viewpoint: SMB

(27)

(28)

Sequence Expressions

Like a filter, but over a set of messages

(29)

29 using

SMB2;

scenario

SequenceExpression =

backtrack

(SMB2.VirtualOperations.Create)

(

SMB2.VirtualOperations.Create{FileId

is

SMB2.SMB2Fileid{Persistent

is

var

myFileId }} ->

(

SMB2.VirtualOperations.Read{FileId

is

SMB2.SMB2Fileid{Persistent == myFileId }}

)

interleave

[1,]

until

SMB2.VirtualOperations.Close{FileId

is

SMB2.SMB2Fileid{Persistent == myFileId }}

);

(30)

PRESENTATION TITLE GOES HERE

Sequence Demo

(31)

31

(32)

Chart Editor

Chart and editor to create visualizations

(33)

(34)

PRESENTATION TITLE GOES HERE

(35)

Message Analyzer Blog

http://blogs.technet.com/MessageAnalyzer

Message Analyzer Support Forums

http://social.technet.microsoft.com/Forums/en-US/home?forum=messageanalyzer

Message Analyzer Beta on Connect

http://connect.Microsoft.com/site216

Message Analyzer Documentation

http://technet.microsoft.com/en-us/library/jj649776.aspx