Heterogeneous Environments. Paul Long/Microsoft

Transcription

1 Message PRESENTATION Analysis TITLE and GOES Visualization HERE in Heterogeneous Environments Paul Long/Microsoft

2 SNIA Legal Notice The material contained in this tutorial is copyrighted by the SNIA unless otherwise noted. Member companies and individual members may use this material in presentations and literature under the following conditions: Any slide or slides used must be reproduced in their entirety without modification The SNIA must be acknowledged as the source of any material used in the body of any document containing material from these presentations. This presentation is a project of the SNIA Education Committee. Neither the author nor the presenter is an attorney and nothing in this presentation is intended to be, or should be construed as legal advice or an opinion of counsel. If you need legal advice or a legal opinion please contact your attorney. The information presented herein represents the author's personal opinion and current understanding of the relevant issues involved. The author, the presenter, and the SNIA do not assume any responsibility or liability for damages arising out of any reliance on or use of this information. NO WARRANTIES, EXPRESS OR IMPLIED. USE AT YOUR OWN RISK. 2

3 Abstract Message Analysis and Visualization in Heterogeneous Environments Microsoft Message Analyzer is the next generation tool for analyzing messages from almost any source. Diagnosis of heterogeneous systems has continued to evolve as we explore new ways to visualize information for any type of trace data, be it a text log file, comma or tab separated data, network capture, or ETW component. Discover how to import Samba debug logs directly or define Text Log adapters, then inspect, filter, and organize as structured data. Learn how to analyze your file systems interoperability with Windows without having to read documentation. Expand your understanding of the interactions by including Windows component-specific information to gain insight into deep protocol and system behaviors. 3

4 Message Analyzer Activities Capture Analyze Share 4

5 Message Analyzer differences? Simulates protocol behavior Diagnosis messages for finding misbehavior 5

6 Message Analyzer differences? Coalesces network information Full defragmentation of messages High level performance info, like Server Response Times 6

7 Homogeneous Environments Different types of systems Windows Unix/Linux Apple Different kinds of traces and logs Text logs Network traces Events for Windows Traces (ETL) Different machines and parts of the world Time shifts Time zones 7

8 Sharing Create and save assets Filters, Trace Scenarios, Sequences, View Layouts, etc. Share assets through feeds Via network shares Later via service 8

9 PRESENTATION Sharing TITLE GOES Demo HERE 9

10 Capturing with Message Analyzer SMB Client/Server Very concise, no noise Runs forever No network related traffic like DNS, DHCP, ICMP, ARP Firewall Less overhead than capturing at the network layer Can capture Loopback Requires configuration 10

11 PRESENTATION Capture TITLE GOES Demo HERE

12 Analysis Importing Data Importing Homogeneous Data Text Logs, CAP, ETL, CSV, PCAP, PCAPNG Time Shifting By time zone or just a smidge 12

13 Import PRESENTATION Data TITLE GOES Demo HERE 13

14 Text Log Configuration RegEx expressions and OPN to parse a text log file Resources

15 Text Log Configuration Netlogon log Sample Netlogon.log 01/19 17:04:53 [MAILSLOT] Ping response 'Sam Logon Response Ex' (null) to \\mphewqtbx308.hew.us.ml.com Site: 1-NewYork-HUB on UDP LDAP 01/19 17:04:53 [LOGON] SamLogon: Transitive Network logon of CORP\NBKTIYN from B80C16EFD31D0 (via enycvc03dfs01) Entered 01/19 17:04:53 [LOGON] NlPickDomainWithAccount: CORP\NBKTIYN: Algorithm entered. UPN:0 Sam:1 Exp:0 Cross: 0 Root:0 DC:0 01/19 17:04:53 [LOGON] NlPickDomainWithAccount: Username CORP\NBKTIYN is in forest bankofamerica.com (found via LsaMatch) 01/19 17:04:53 [LOGON] SamLogon: Transitive Network logon of CORP\NBKTIYN from B80C16EFD31D0 (via enycvc03dfs01) Returns 0x0 15

16 Text Log Configuration file 01/19 17:04:53 [LOGON] SamLogon: Transitive Network logon of CORP\NBKTIYN from B80C16EFD31D0 (via enycvc03dfs01) Entered // // Message to capture Sam logon request. // message SamLogonRequest with EntryInfo { Regex \[(?<msgtype>[\s]+)\] SamLogon: Transitive Network logon of (?<UserName>[\S]+) (?<RemainingText>.*) Entered" } : BaseNetLogon { string UserName; string RemainingText; } { } override string ToString() return ("SamLogonRequest" + RemainingText); 16

17 Text Log Configuration file 17

18 Text PRESENTATION Log TITLE Adapter GOES HERE Demo 18

19 Analysis Analyzing Data Validating Implementation Diagnosis to understand adherence Viewpoints Hiding operations and exploring other network layers Sequence Expressions Describing complex patterns Visualizations Exposing patterns via pictures 19

20 Validation 20

21 Viewpoints Hide operations Remove operations so request/responses aren t grouped Alternate viewpoint Change your viewpoint to see traffic from a different layers perspective 21

22 Viewpoint: Default 22

23 Viewpoint: Link Layer 23

24 Viewpoint: Network 24

25 Viewpoint: Network 25

26 Viewpoint: SMB 26

27 Viewpoint PRESENTATION TITLE GOES Demo HERE

28 Sequence Expressions Like a filter, but over a set of messages 28

29 Sequence Expression Example using SMB2; scenario SequenceExpression = backtrack (SMB2.VirtualOperations.Create) ( SMB2.VirtualOperations.Create{FileId is SMB2.SMB2Fileid{Persistent is var myfileid }} -> ( SMB2.VirtualOperations.Read{FileId is SMB2.SMB2Fileid{Persistent == myfileid }} ) interleave [1,] until SMB2.VirtualOperations.Close{FileId is SMB2.SMB2Fileid{Persistent == myfileid }} ); 29

30 Sequence PRESENTATION TITLE GOES Demo HERE 30

31 Visualizations 31

32 Chart Editor Chart and editor to create visualizations 32

33 Visualization PRESENTATION TITLE GOES HERE Demo

34 PRESENTATION Questions? TITLE GOES HERE

35 References Message Analyzer Blog Message Analyzer Support Forums US/home?forum=messageanalyzer Message Analyzer Beta on Connect Message Analyzer Documentation 35