Microsoft Message Analyzer

Microsoft Message Analyzer (MMA) is an advanced network protocol analyzer built for a wide range of protocol analysis tasks. MMA, the successor of Microsoft Network Monitor, is a powerful tool for analyzing and troubleshooting network communication issues. It provides a comprehensive view of the network traffic, including the underlying protocols, message headers, and payloads, and it also handles Windows event (ETW) messages and system or application logs.

Microsoft retired Message Analyzer on November 25, 2019 and removed its download packages from microsoft.com sites. The last version, 1.4, was released in October 2016, and the program is no longer developed. Existing installations keep working with the OPN parsers that were already downloaded, and Microsoft suggests third-party analyzers such as Wireshark for similar work.

Message Analyzer provides an intuitive graphical interface for capturing, displaying, and analyzing protocol messaging traffic, events, and other system or application messages in real time.

Features

• Capture and analyze network traffic
MMA offers integrated live capture of events and messages at various system levels and endpoints. The captured traffic is shown in a summarized grid whose top level displays operations, that is, requests matched with their responses.

• Protocol parsing and validation
MMA parses and validates protocol messages and sequences with its OPN parsers, automatically re-assembles fragmented data and renders payloads. This allows you to view the underlying messages, headers, and payloads.

• Message filtering
MMA enables you to filter messages based on criteria such as source, destination, protocol, message type, and payload. This makes it easy to focus on the messages that are relevant to your analysis.

• Grouping
Messages can be grouped by their attributes under user control. This makes it easy to organize large traces and to find related traffic.

• ETW event parsing
MMA automatically parses event messages described by ETW manifests, so the output of Windows components can be analyzed together with the network traffic.

• Log import
Archived traces and logs in formats such as .cap, .etl and .txt can be opened for analysis. Text logs are parsed into key/value pairs.

• Visualization
MMA offers selectable graphical views that use grids, charts, and timeline visualizer components to help you better understand the traffic.

• Trace Scenarios
Trace scenarios combine message providers, filters, and views, for example Local Network Interfaces (Windows 8.1 and later) and Loopback and Unencrypted IPSEC. Favorite scenarios are available on the Start Page.

• Asset management
Parsers, views, and other assets were updated through the Asset Manager in the Tools menu. After the retirement, the online asset feed is no longer available.