Monitoring DirectPlay Network Traffic with Netmon

During game development, you might find it useful to monitor Microsoft® DirectPlay® network traffic, especially when trying to understand bugs. The network monitor (Netmon) is a standard utility for analyzing network traffic. DirectPlay includes a set of parsers, that allow you to use Netmon to analyze four components of DirectPlay messaging: the service provider layer, the transport layer, the session layer, and the voice layer.

How Netmon Works With DirectPlay

The DirectPlay protocol stack has three basic layers.

• The voice and session layers share the top level of the stack. Normal messaging passes through the session layer, and voice-related messaging passes through the voice layer.
• The transport layer is the middle of the stack. Both voice and session traffic passes through this layer, which is responsible for such tasks as fragmentation and reassembly of messages and retransmission of lost packets.
• The service provider layer is at the bottom of the stack. All messaging is handled by this layer, which is responsible for communicating with the network. For example, for TCP/IP networking, the service provider uses the Winsock API to communicate with the network stack. Netmon can only parse network traffic that is carried on an IP or IPX service provider.

By installing the DirectPlay parsers, you can use Netmon to analyze the network traffic as it passes through any of these four layers. You can see all DirectPlay traffic by selecting the service provider parser. However, by selecting one of the higher level parsers, you can filter out traffic that might not be of interest.

With the transport layer parser, you see all voice and session traffic, but not low-level traffic such as connection handshaking. Be aware that the transport layer breaks messages that are longer than the network's Maximum Transfer Unit (MTU) into one or more fragments.

The session and voice layer parsers allow you to analyze session and voice-related traffic separately. Both of these parsers are aware of fragmentation, and notify the user, but cannot parse fragmented packets.

Configuring Netmon for DirectPlay

If you have a Windows 2000 Server system, Netmon is already installed. For Windows 2000 Professional, you must purchase a copy of Systems Management Server (SMS). See the Netmon documentation for a general discussion of how to use Netmon. To configure Netmon to handle DirectPlay traffic:

1. Copy Dp8parse.dll from (SDK root)\bin\DXUtils to the appropriate folder. The Netmon root folder is normally installed in the \Winnt\System32 folder. If you have installed SMS, the root folder will be called NetMonFull. For Windows 2000 Server, the root folder will be called NetMon. Depending on which version of Netmon you are using, copy the parser DLL to either the ...\NetMonFull\Parsers, or ...\NetMon\parsers folder.
2. Start Netmon
3. Set the adapter to capture from (Capture|Networks...|Local Computer). Be sure to choose the adapter with the "Dial-up Connection" property set to FALSE.

You are now ready to start capturing traffic.

Capturing DirectPlay Network Traffic

To start the capture process, click the Start Capture button on the Netmon toolbar to open the capture view. Initially, you will see all the traffic that is passing through your adapter. You can filter that raw traffic stream to focus on only those packets that are of interest. By installing the DirectPlay parsers, you essentially add four filters to Netmon oriented to DirectPlay, which allow you to filter everything but DirectPlay traffic from your capture view.

To select a filter:

1. Click the Edit Display Filter button on the Netmon toolbar.
2. Double-click "Protocol == Any".
3. Click "Disable All".
4. Under "Disabled Protocols", double-click DPLAYSESSION, DPLAYSP, DPLAYTRANSPORT, and DPLAYVOICE.

Click OK twice to return to the capture view, and you are ready to start viewing DirectPlay traffic.

You can also apply a filter to the capture process itself, rather than to the capture view. This allows you, for instance, to capture only IP packets with specified source and destination ports. See the Netmon documentation for details.

Tips for Using Netmon with DirectPlay

Here are a few tips to using Netmon with DirectPlay :

• By default, Netmon only captures 1MB of the most recent traffic. You will probably want to increase this value to at least 10-20 MB.
• Netmon doesn't stream to the hard drive, so all you can see is what is in the capture buffer. To stream captured traffic to a hard drive, you will need to implement your own capturer. See MSDN for details.
• By default, DirectPlay parsing uses the [2302,2400]U{6073} port/socket range to filter IP and IPX packets. To parse ports other than the default DirectPlay ports, create two new DWORD values under the HKEY_CURRENT_USER\Microsoft\DirectPlay\Parsers key, as shown in the following example.

  MinUserPort = x
  MaxUserPort = y
  

  The x and y data values define the range to parse in addition to the default DirectPlay ports. They can be the same value if you only need one custom port.

• Because the DirectPlay and RTP protocols are both layered on top of the UDP protocol, their parsers might conflict. You should disable the RTP parser when analyzing DirectPlay traffic, and vice versa.