Microsoft Network Monitor is probably the only free network and protocol analysis tool that is a match for Wireshark. It still lacks a few features when it comes analyzing stored network traces and that's where the Network Monitor Experts comes in. At the moment, there are three available Open Source extensions: TCP Analyzer, Simple Search, and Top Users.
- Pip install Boto3 - Thu, Mar 24 2022
- Install Boto3 (AWS SDK for Python) in Visual Studio Code (VS Code) on Windows - Wed, Feb 23 2022
- Automatically mount an NVMe EBS volume in an EC2 Linux instance using fstab - Mon, Feb 21 2022
These extensions are separate tools that require Network Monitor 3.3. After you have installed them, you will find them in the Experts menu. This menu is only displayed when you open a previously stored file. Today, I will introduce Simple Search and in the next two posts, I will discuss Top Users and TCP Analyzer.
Network Monitor has its own search function. It is a powerful tool because you can leverage Network Monitor's filters. However, this also makes it a bit complicated to use for those who use the tool only every now and then. For example, if you want to search for a string in the TCP payload, you have to use this command: property: TCPPayload contains ("search string").
With Simple Search, it is easier and also much more convenient to search for a specific search string than it is with Network Monitor's integrated search function. To search for a string, you can just enter it as is. If you want it a bit more complicated, then you can also use regular expressions.
The feature l like most, however, is Simple Search's ability to jump directly to the position where the string was found. If you enable "Record Raw Data" in the search options in the lower pane, then a new tab named Hex Details will appear. Enabling "Automatically Display Raw Data" will open this tab whenever you click on "Find Next" and it will highlight the search string in the text column. Simple Search can also select the corresponding frame in Network Monitor. However, like Network Monitor's search tool, it can't highlight the search string there.
The option "Automatically Discover Search File" allows you to use Simple Search for another capture file instead of the original file; i.e., the one you selected when you launched Simple Search. Unfortunately, you can't use Simple Search to search in multiple capture files. Moreover, it is not possible to search within a Capture tab; that is, you always have to save the captured data to a capture file and then open the file with Network Monitor, before you can use Simple Search. This makes using the tool a bit unsuitable for quick and dirty searches, but this is a problem with all Network Monitor Experts. All of them can only be applied to a capture file but not to the current Capture tab.
I tested Simple Search v2.1. In one of my next posts, I will introduce the Top Users Experts, a Network Monitor extension that allows you to analyze the bandwidth consumption on a host.