The Microsoft® Platform SDK CD-ROM provides two sample protocol parser DLLs for Network Monitor. The source for these DLLs is in the \MSSDK\SAMPLES\SYSMGMT\SMS\NETMON directory.
The first sample, BROWSER, is an example of a shipping parser. In a Microsoft Network, when you NET VIEW, or (in Microsoft® Windows® 95) when you look at the Network Neighborhood, the information displayed is acquired through use of the Browser protocol. The Browser protocol follows the SMB protocol; the SMB protocol "hands off" or "packages" the Browser protocol.
The Browser protocol sample is a good place to start building your own protocol parser because it is a complete, high-quality program. The code calls almost every parser API exposed in the SDK, and it uses many of the data types defined for parser writers. It is an especially good source to see how a parser should acquire and format data.
The Browser parser DLL (BROWSER.DLL) is installed by the SMS setup program when you install the Network Monitor product. To use the parser, start Network Monitor and capture at least one buffer. To view the acquired data, set up a display filter for packets that contain the Browser protocol.
The second sample, REMAPI, is for parsing SMB Remote APIs. This sample provides all of the files needed to make a parser, and it demonstrates the five standard entry points that every parser must implement; however, it uses very few of the parser APIs. This sample could be used as a shell to build your own parser.
For more information see Writing a Protocol Parser DLL for Network Monitor.