Message Analyzer Parsers for SQL

Lin Dong

SQL OIPI Test Development Team

Agenda

Message Analyzer Overview

Exploring the Message Analyzer UI

Message Analyzer Parser Overview

SQL Parsers with Message Analyzer

Resource

1

2

3

4

5

▅ Can be used to capture, display, analyze protocol

messaging traffic

▅ Captured info can be:

▪ Used for network diagnostics, protocol validation/analysis

etc.

▪ Saved for later processing

▅ Can save traffic info as .MATP or a .CAP

▅ Can track local traffic, or traffic to and from remote

machines

Message Analyzer Overview

Message Analyzer Overview

Supported Input Source

.cap .pcap .log .evtx

SQL Azure Blob Powershell

And more!

Message Analyzer Overview

Network Administrator

Network troubleshooting and analysis.

Network Support Analyst

Help Desk scenarios: capture data for

clients or to aggregate log and trace data

from multiple sources and different time

zones for analysis.

Protocol Developer

Generates network protocol code and uses

Message Analyzer as a validator of

protocol behavior, architecture, message

field values, and state.

Event Tracing Developer

Instruments applications with ETW

technology and uses Message Analyzer to

capture the events from ETW providers.

Tracer

Typically a client who is experiencing issues

in some area and is requested to take a

trace for in-depth analysis by a Network

Administrator or Support Analyst.

Message

Analyzer

User Roles

Message Analyzer Overview

https://www.microsoft.com/en-us/download/details.aspx?id=44226

Exploring the Message Analyzer UI

Exploring the Message Analyzer UI

Exploring the Message Analyzer UI

Exploring the Message Analyzer UI

TCP.Port == 80

TCP.Port != 3389 // Remove RDP

*PayloadLength > 1000

(TCP.Port == 1234 and HTTP) or SMB

IPv4.Address == 192.168.1.1

Message Analyzer Parser Overview

OPN Parser

Saved Message Capture File

Message Analyzer Parser Overview

Parsing the raw data based on the message syntax defined in Microsoft open

specification.

Recognize those messages belong to Specific protocols.

Value definition MappingShowing not only the parsed data in UI, but also the definition behind the data

which is defined in Microsoft open specification.

Reassemble packets in to a long message.

Decoding encoded stream to make it human-readable.

Beyond the message syntax validation, parsers can also provide the protocol level

restriction validation.

Value definition Mapping

Message Analyzer Parser Overview

Parsing the raw data based on the message syntax defined in Microsoft open

specification.

Recognize those messages belong to Specific protocols.

Value definition

MappingShowing not only the parsed data in UI, but also the definition behind the data

which is defined in Microsoft open specification.

Reassemble packets in to a long message. Length = 0x07

Name=

0x4C697361Age = 0x10

E4074C69736110

E4 07 4C697361 10

Decoding encoded stream to make it human-readable.

Type = Person

Length = 6

Name = Lisa

Age = 16

Beyond the message syntax validation, parsers can also provide the protocol level

restriction validation.

Value definition Mapping

Type = 0xE4

Message Analyzer Parser Overview

Windows Parsers

Office and SharePoint

Parsers

Exchange, SkypeParsers

SQL Parsers

Core and Common Parsers

Microsoft Message Analyzer (MMA)

What SQL Protocol Parsers does MA provide?

Network Connectivity and Application Development parser package

covers 1 protocol （was released in Microsoft Common）◼ MS-TDS

Analysis Services parser package covers 2 protocols (Newly Released)◼ MS-SSAS

◼ MS-SSAS-T

SQL Parsers with Message Analyzer

SQL Parsers with Message Analyzer

▅ Get MA SQL parsers

Windows Parsers

Core and Common Parsers

Microsoft Message Analyzer (MA)

MS-TDS Parser

SQL Parsers with Message Analyzer

▅ Get MA SQL parsers

Windows Parsers

Core and Common Parsers

Microsoft Message Analyzer (MA)

MS-TDS Parser

SQL Parsers

SQL Parsers with Message Analyzer

▅ Get MA SQL parsers

SQL Parsers with Message Analyzer

▅ Get MA SQL parsers

SQL Parsers with Message Analyzer

▅ Get MA SQL parsers

C:> Users > [UserName] > AppData > Local > Microsoft > MessageAnalyzer > OPNAndConfiguration > OPNs

Demo

See the difference comparing parsing result with and without MSSSAS OPN.

Demo

Demo

Without SQL Parser

Demo

WithSQL Parser

Resources

Microsoft Message Analyzer Operating Guide

Microsoft Message Analyzer download

Message Analyzer Tutorial

SQL Server Technical Documents

Interop Events website

→

→

→

→

→