0

We are experiencing user reported slowness with our Exchange 2007 server. We thought it was associated with a new application that we're testing. (This application uses MAPI to look at all of the mailboxes, in sequence, and do some basic operations.)

We used wireshark to capture the communication going on for several seconds and one thing that stood out is that we see hundreds of lines that read "Protocol: MAPI; Info: Unknown?! request" which is followed by "Protocol: MAPI; Info: Unknown?! response".

We did a capture on another machine (without the application we were testing on the other box) and just opened Outlook. We saw the same behavior.

I'm not familiar with this exchange and it is alarming to me that it is happening so very much.

Can someone point me in the direction of an explanation?

Thanks much!

Improve this question

1 Answer 1

Reset to default
0

Can someone point me in the direction of an explanation?

One explanation is that the dissector for MAPI, in your version of Wireshark, might not fully understand MAPI; "Unknown?!" means that a DCE RPC request or response (MAPI is based on Microsoft's RPC mechanism, which is a derivative of DCE RPC) that the protocol dissector doesn't understand was seen.

What version of Wireshark are you using?

Improve this answer
7
  • [Darn 5 minute limitation on editing comments] Thanks for your time, Guy. Using version 1.8.7. The trace also shows "[Protocols in frame: eth:ip:tcp:dcerpc:spnego-krb5:spnego-krb5]" and in a dozen random samples throughout the hundreds of lines, I see this same thing. "SPNEGO" is associated with an authentication request, right? Could "krb5" be associated with "Kerberos"? I know very little about network protocols, packets, frames, etc., but I am inquisitive. Again, thanks for your time.
    – Kevin Buchan
    May 31, 2013 at 11:26
  • That's a fairly recent version of Wireshark, so I'm a little surprised that it doesn't understand those calls, but perhaps they're recent additions to MAPI.
    – user137177
    May 31, 2013 at 18:29
  • And, yes, SPNEGO is associated with authentication, and "krb5" means Kerberos version 5.
    – user137177
    May 31, 2013 at 18:31
  • If you look at the packet details, it should show what the operation number (open up the MAPI entry and look for "Operation:"). What number is that? (I've checked in a change that shows that number and "Unknown operation" rather than just "Unknown?!"; that should end up in the 1.10 release when it comes out.)
    – user137177
    May 31, 2013 at 19:06
  • I checked about 20 entries. One was a 10, one was a 14, and the rest were all operation number 11.
    – Kevin Buchan
    Jun 3, 2013 at 12:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .