Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are experiencing user reported slowness with our Exchange 2007 server. We thought it was associated with a new application that we're testing. (This application uses MAPI to look at all of the mailboxes, in sequence, and do some basic operations.)

We used wireshark to capture the communication going on for several seconds and one thing that stood out is that we see hundreds of lines that read "Protocol: MAPI; Info: Unknown?! request" which is followed by "Protocol: MAPI; Info: Unknown?! response".

We did a capture on another machine (without the application we were testing on the other box) and just opened Outlook. We saw the same behavior.

I'm not familiar with this exchange and it is alarming to me that it is happening so very much.

Can someone point me in the direction of an explanation?

Thanks much!

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Can someone point me in the direction of an explanation?

One explanation is that the dissector for MAPI, in your version of Wireshark, might not fully understand MAPI; "Unknown?!" means that a DCE RPC request or response (MAPI is based on Microsoft's RPC mechanism, which is a derivative of DCE RPC) that the protocol dissector doesn't understand was seen.

What version of Wireshark are you using?

share|improve this answer
    
Thanks for your time, Guy. Using version 1.8.7. –  Kevin Buchan May 31 '13 at 11:19
    
[Darn 5 minute limitation on editing comments] Thanks for your time, Guy. Using version 1.8.7. The trace also shows "[Protocols in frame: eth:ip:tcp:dcerpc:spnego-krb5:spnego-krb5]" and in a dozen random samples throughout the hundreds of lines, I see this same thing. "SPNEGO" is associated with an authentication request, right? Could "krb5" be associated with "Kerberos"? I know very little about network protocols, packets, frames, etc., but I am inquisitive. Again, thanks for your time. –  Kevin Buchan May 31 '13 at 11:26
    
That's a fairly recent version of Wireshark, so I'm a little surprised that it doesn't understand those calls, but perhaps they're recent additions to MAPI. –  Guy Harris May 31 '13 at 18:29
    
And, yes, SPNEGO is associated with authentication, and "krb5" means Kerberos version 5. –  Guy Harris May 31 '13 at 18:31
    
If you look at the packet details, it should show what the operation number (open up the MAPI entry and look for "Operation:"). What number is that? (I've checked in a change that shows that number and "Unknown operation" rather than just "Unknown?!"; that should end up in the 1.10 release when it comes out.) –  Guy Harris May 31 '13 at 19:06
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.