Microsoft Message Analyzer

~ the obit ~

Microsoft's own documentation says what killed this one. The retirement notice at the head of the Message Analyzer operating guide records that the tool was retired and its download packages removed from microsoft.com on 25 November 2019. The same notice adds that there is no Microsoft replacement in development and that anyone wanting similar functionality should consider a third party network protocol analyzer such as Wireshark.

Message Analyzer captured live network traffic and also read log files and Windows event tracing output, decoding the protocols inside each of them. The selling point was the single pane: one tool for the wire and for the logs, instead of a packet capture in one window and an event log in another.

It arrived as the replacement for Network Monitor, which Microsoft had shipped in one form or another since the LAN Manager era. The public beta opened in September 2012 and version 1.0 reached the Download Center in late September 2013. Version 1.2 landed in January 2015 and the numbering got at least as far as 1.3. Then Microsoft stopped.

I am a computer engineer and this is squarely my category of software, so the honest version goes like this. When I have needed to look at packets, the tool has been Wireshark, and Ethereal before that. Microsoft's analyzer was what you reached for when the thing being debugged was Windows-shaped and the protocol was Microsoft's own. Outside that narrow case, the open-source tool had more parsers and a vastly bigger install base.

~ the rap sheet ~

~ the bloodhound years ~

The ancestor is better documented than the product. Network Monitor 1.0 was codenamed Bloodhound and was written by Raymond Patch, a transport protocol and device driver engineer on the LAN Manager team, after the team's single hardware analyzer got carried off during a bug hunt. He coded the first Windows prototype over a Christmas holiday. The first four bytes of the capture file format were the letters RTSS, for Ray, Tom, Steve and Steve, the first four members of the team.

Then Microsoft IT got nervous, for a sound reason. Company networks and company email were unencrypted in that era, and Netmon handed a free packet analyzer to every engineer in a building where hardware analyzers had been expensive enough that almost nobody had one.

What got added at IT's request was a non-cryptographic password and an identification protocol called BONE, the Bloodhound-Oriented Network Entity, named by Patch as a joke on his own codename. It was not security. It was a way of knowing who was listening.

~ what the notice does not do ~

The unusual thing about this retirement is the missing successor. Microsoft normally retires a tool into another tool and tells you where to go. Here the notice names no Microsoft product at all and points at Wireshark, which was the thing that had already won the category.

The notice also says that if you already have it installed you may carry on using it. That is true of any local binary and means less than it sounds, because the value of a protocol analyzer lives in its parsers, and parsers go stale as protocols move. A 2019 build reading 2026 traffic will still show you the bytes and will tell you steadily less about what they are.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »