Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are experiencing user reported slowness with our Exchange 2007 server. We thought it was associated with a new application that we're testing. (This application uses MAPI to look at all of the mailboxes, in sequence, and do some basic operations.)

We used wireshark to capture the communication going on for several seconds and one thing that stood out is that we see hundreds of lines that read "Protocol: MAPI; Info: Unknown?! request" which is followed by "Protocol: MAPI; Info: Unknown?! response".

We did a capture on another machine (without the application we were testing on the other box) and just opened Outlook. We saw the same behavior.

I'm not familiar with this exchange and it is alarming to me that it is happening so very much.

Can someone point me in the direction of an explanation?

Thanks much!

share|improve this question
up vote 0 down vote accepted

Can someone point me in the direction of an explanation?

One explanation is that the dissector for MAPI, in your version of Wireshark, might not fully understand MAPI; "Unknown?!" means that a DCE RPC request or response (MAPI is based on Microsoft's RPC mechanism, which is a derivative of DCE RPC) that the protocol dissector doesn't understand was seen.

What version of Wireshark are you using?

share|improve this answer
Thanks for your time, Guy. Using version 1.8.7. – Kevin Buchan May 31 '13 at 11:19
[Darn 5 minute limitation on editing comments] Thanks for your time, Guy. Using version 1.8.7. The trace also shows "[Protocols in frame: eth:ip:tcp:dcerpc:spnego-krb5:spnego-krb5]" and in a dozen random samples throughout the hundreds of lines, I see this same thing. "SPNEGO" is associated with an authentication request, right? Could "krb5" be associated with "Kerberos"? I know very little about network protocols, packets, frames, etc., but I am inquisitive. Again, thanks for your time. – Kevin Buchan May 31 '13 at 11:26
That's a fairly recent version of Wireshark, so I'm a little surprised that it doesn't understand those calls, but perhaps they're recent additions to MAPI. – user137177 May 31 '13 at 18:29
And, yes, SPNEGO is associated with authentication, and "krb5" means Kerberos version 5. – user137177 May 31 '13 at 18:31
If you look at the packet details, it should show what the operation number (open up the MAPI entry and look for "Operation:"). What number is that? (I've checked in a change that shows that number and "Unknown operation" rather than just "Unknown?!"; that should end up in the 1.10 release when it comes out.) – user137177 May 31 '13 at 19:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.