none
Can't get netmon to work, because of Paser error RRS feed

  • Question

  • hi

    I have installed net monitor 3.3 onto a vista client machine and this is being used to test some exchange problems with autodiscover (as per MS engineer request).

    the problem is the after the install and following the runas administrator for vista users I ge the foloowing errors.
     
    Failed to load file "my_sparser.npl": The parameter is incorrect. (WinStatusCode=0x00000057).

    "One or more erros were found while building parsers.
    You may be bale to capture fromes and save them but you cannot view them until the parsers are successfully built without erros.
    Do you want to fix the error(s) now?"

    Then after I try and start a capture it fails to. and I get a "Invalid capture filter" error and nothing I do seems to allow capture of data.

    so I'm thinking that the failed parsers load is affecting the net mon 3.3 program.


    any help is welcomed.

    Cheers and Regards
    Brent
    Thursday, May 21, 2009 9:43 PM

Answers

  • I had the same error when installing Network Monitor 3.3.1641.0 on Windows. We have recently migrated to a different server while my romaing profile was somewhat compromised and the My Documents redirection (and consequently my home folder) was not correctly working. In the article KB221837 a solution to this problem is explained that permits access to the folder. This also resolves the error as the file is stored in the home folder, and the redirection error was silently preventing the program from building the parser database sparser.npb. I'm now able to run the program without errors and capture traffic for later review.
    • Marked as answer by Paul E Long Friday, September 25, 2009 5:43 PM
    Thursday, September 24, 2009 6:48 PM

All replies

  • my_sparser.npl should exist in your local documents folder under "Network Monitor 3\parsers".  Please let me know if you don't see the file there.  You might be able to just create one there.

    I'm not sure why this wasn't created by default, but perhaps something happened during install. 

    You could also capture using the command line utility instead.  It should not require the parsers for capturing.  For instance

    NMCap /network * /capture /file out.cap:50M

    This will create a 50 meg circular capture.

    Thanks,

    Paul
    Friday, May 22, 2009 1:18 PM
  • Hi Paul

    The file "my_sparser.npl" has been created and is in the location you mentioned above. I checked that before posting the question, like you I thought that may have been the problem, I now wonder if permissions to that location may be wrong? 

    I have run the capture as per your command line sample, thanks for this, I noted that after the capture I tried to open it in net mon and this wouldn't open.

    Cheers
    Brent
    Friday, May 22, 2009 9:24 PM
  • You should be able to take that trace to another machine where NM3.3 installed properly, but we can continue to t-shoot the problem on this install.

    It seems as though the installation did not complete correctly.  Can you run the following command and tell me what it returns?

    nmcap /DisplayNplPath


    You could also check Control Panel, Program, and verify you see the "Microsoft Network Monitor: Microsoft Parsers 3.3" installed.  If it's there, you could try to repair the install.  If it's not there, then I would do a re-install.  You could also just download the lates parsers from http://www.codeplex.com/nmparsers instead.

    Paul
    Tuesday, May 26, 2009 1:35 PM
  • Hi paul

    I have run the nmcap command and the results are below.

    C:\Windows\system32>nmcap /displaynplpath
    Netmon Command Line Capture (nmcap) 3.3.1641.0
    NplIncludePath = C:\Users\brentm\AppData\Local\Microsoft\Network Monitor 3;C:\Pr
    ogramData\Microsoft\Network Monitor 3\NPL\Microsoft Parsers;C:\ProgramData\Micro
    soft\Network Monitor 3\NPL\Microsoft Parsers\Core;C:\ProgramData\Microsoft\Netwo
    rk Monitor 3\NPL\Microsoft Parsers\Common;C:\ProgramData\Microsoft\Network Monit
    or 3\NPL\Microsoft Parsers\Windows\Stubs

    I also did the re-install on NM3.3 and had the same results, interestingly I had installed nm3.2 and also got the same result.

    I downloaded the latest parsers from codeplex, after this I started up nm and got the same errors, I am going to try this on a different PC now and see what happens.

    I did send the output trace to MS engineer and he could'nt find any data in the trace. so I'm going to try another PC for NM.

    Cheers
    Brent
    Tuesday, May 26, 2009 9:07 PM
  • If the NMCap command line did not provide a capture with data, then the parser problem might be unrelated to the ability to capture data.  I would be interested to know what "Nmcap /displaynetworks" returns.  Also, when you run the NMCap /network *... command to capture data, does the update say that it has Saved or Received any frames.  For instance, mine looks like this.

    Capturing   | Received: 79 Pending: 0 Saved: 79 Dropped: 0 | Time: 3 seconds.

    For the parsing problem, I seems you are missing a directory.  You should have "C:\Users\brentm\Documents\Network Monitor 3\Parsers" in your path.  This is where the my_sparser.npl would normally exist.  I'm not sure why this wasn't added by the install, but we could add it manually.

    To do this, go to Tools, Options, and select the Parser tab.  Then hit the New button and select the path to the Parsers directory above.

    Thanks,

    Paul
    Wednesday, May 27, 2009 1:36 PM
  • Thanks for your help...

    I pretty much gave up on that computer and used another one tand it worked fine, so must be a profile/computer problem.

    got the output I needed.

    Cheers
    Brent
    Friday, May 29, 2009 3:14 AM
  • I had the same parser error for the first time today.   This isn't a fresh install, it worked last week.  I installed Vista SP2 last Friday, I'm wondering if that might be the cause.
    Monday, June 1, 2009 3:30 PM
  • I suppose that's possible if Vista SP2 changed some of the directory structures.

    What do you get if you type the following at a command prompt:

    nmcap /displaynplpath

    Thanks,

    Paul
    Monday, June 1, 2009 4:00 PM
  • Netmon Command Line Capture (nmcap) 3.3.1641.0
    NplIncludePath = C:\Users\Net\Documents\Network Monitor 3\Parsers;C:\Users\rjb\AppData\Local\Microsoft\Network Monitor 3;C:\ProgramData\Microsoft\Network Monitor 3\NPL\Microsoft Parsers\;C:\ProgramData\Microsoft\Network Monitor 3\NPL\Microsoft Parsers\Core;C:\ProgramData\Microsoft\Network Monitor 3\NPL\Microsoft Parsers\Common;C:\ProgramData\Microsoft\Network Monitor 3\NPL\Microsoft Parsers\Windows\Stubs
    Monday, June 1, 2009 5:18 PM
  • You first path, C:\Users\Net\Documents\Network Monitor 3\Parsers, is strange.  Do you have any files in this directory?


    What are the first few errors you see in the parser tab?  That will help me understand what the potential problems are.

    Thanks,

    Paul
    Monday, June 1, 2009 6:29 PM
  • I thought that was strange, too.  No "Net" directory under C:\Users at all.

    sparser.npb, line 1, Col 0, NPB Version mismatch
    sparser.npb, line 1, Col 0, Failed to unserialize binary npl
    madcap.npl, 154/16 Incomplete or unrecognized variable name 'UDP'
    udp.npl, 149/8 Data field 'SQLBrowser' is referencing unknown data type 'SQLBrowser'

    Hope this helps.  I did reinstall, still doesn't work.
    Monday, June 1, 2009 6:50 PM
  • OK, so let first remove this path from the netmon UI.  Goto Tools, Options, Parsers and select this path (should be the top one), and remove it.

    The error messages above lead me to beleive it's installing old parsers.  Lets check the next directory, "C:\Users\rjb\AppData\Local\Microsoft\Network Monitor 3" for files.  If there are any NPL files there, please copy them to a subdirectory for now.  Also inspect my_sparser.npl and make sure it has no include statements in it.

    If there were files or lines in this directory, restart NM3 and let me know the same or different error messages show up.

    Paul
    Tuesday, June 2, 2009 2:35 PM
  • I had the same error when installing Network Monitor 3.3.1641.0 on Windows. We have recently migrated to a different server while my romaing profile was somewhat compromised and the My Documents redirection (and consequently my home folder) was not correctly working. In the article KB221837 a solution to this problem is explained that permits access to the folder. This also resolves the error as the file is stored in the home folder, and the redirection error was silently preventing the program from building the parser database sparser.npb. I'm now able to run the program without errors and capture traffic for later review.
    • Marked as answer by Paul E Long Friday, September 25, 2009 5:43 PM
    Thursday, September 24, 2009 6:48 PM
  • Hi Brent,

    i had this problem as well.

    solved it by :
    1) create folder "C:\Users\it_support\Documents\Network Monitor 3\Parsers"
    2) open folder "C:\Users\it_support\AppData\Local\Microsoft\Network Monitor 3"
    3) copy existing npl and npb files into new directory
    4) open "C:\Users\it_support\Documents\Network Monitor 3\Parsers\sparser.npl" in notepad
    5) comment out the last line where it says include "my_sparser.npl"

    hope this works for you too!

    - fatfingers
    • Proposed as answer by William Wee Friday, May 14, 2010 6:49 AM
    Tuesday, February 9, 2010 6:46 PM
  • This resolved my issue.
    Friday, May 14, 2010 6:49 AM
  • There's better support for roaming profiles in 3.4.

    You can download the Beta here.


    Michael Hawker | Program Manager | Network Monitor
    Friday, May 14, 2010 5:14 PM
    Moderator
  • Hi,

    I have similar problem.

    I installed MS Network Monitor 3.4 and WDK for win 10 build 1803, as per this manual: https://docs.microsoft.com/en-us/windows-hardware/drivers/usbcon/how-to-install-netmon-and-the-netmon-usb-parser

    When launched netmon I got parsers errors in usb\etl_usb3npl.:

    Failed to load file "etl_mausb.npl": The parameter is incorrect. (WinStatusCode = 0x00000057)

    --//-- "etl_PalInTransfer.npl"

    --//-- "etl_PalOutTransfer.npl"

    --//-- "etlPalSession.npl"

    --//-- "etl_UiEndpoint.npl"

    Searched for these files on disk and search didn't found them. Tried to google these files, but this forum is one of few items google found.

    etl_usb3.npl is from C:\Program Files (x86)\Windows Kits\10\Tools\x86\Network Monitor Parsers\usb

    Wednesday, May 8, 2019 3:54 PM