Data Collection - How to use Microsoft Message Analyzer to capture SQL Server traffic for analysis.

[PadmaPriya]

Traffic to and from a Microsoft SQL Server is encapsulated in Tabular Data Stream (TDS) packets, which make it hard to analyze using common tools such as Wireshark. Instead, you can use the Microsoft Message Analyzer (MMA) to capture and analyze this traffic.

Microsoft retired MMA in November 2019, and it can no longer be downloaded from Microsoft. But if you already have a copy available, you can continue to use it with the following advice below.

On the system where you want to capture traffic:

1. To start capturing traffic, run MMA.
2. At the initial screen, start a new trace:
   • If you want to capture loopback traffic, for example, if Qlik server and SQL are on the same system, select Loopback and Unencrypted IPsec from the Favorite Scenarios menu.
   • If Qlik server and SQL are on separate systems, select Local Network Interfaces from the Favorite Scenarios menu.

MMA now captures traffic. After the traffic has been captured, stop, and save the MMA capture as a .matp file.

Environment

• Microsoft Message Analyzer (MMA)
• Any Qlik Software