From stephen fisher:

I have figured out one of the fields in the MAPI
EcRRegisterPushNotification packet.  The field is a UDP port number that
the client wants the Exchange server to send new mail notifications on.
These notifications are on a port > 1023 and are always 8 bytes long.

It looks like I would add the function name to the
dcerpc_mapi_dissectors[] for the register push notification.  What would
my new function need to do besides display the field?


Thanks,

Steve

Here is a patch to add this functionality.  It displays the notification
port and the notification payload (not sure what the payload itself
means yet).  It also dynamically registers each notification port found
with a new dissector (that I called newmail for lack of a better name -
I'm open to suggestions) that displays the notification payload.  This
is all undocumented by Microsoft in their usual fashion.

I also changed the code to always display the mapi.opnum field;
currently, the mapi.opnum is only displayed when the
dcerpc_mapi_dissector is null.


Steve




svn path=/trunk/; revision=19350

1 files changed, 1 insertions, 0 deletions

diff --git a/AUTHORS b/AUTHORS
index bf914ae1c8..35d36d80d3 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -2500,6 +2500,7 @@ Balint Reczey		<balint.reczey [AT] ericsson.com> {
 Stephen Fisher		<stephentfisher [AT] yahoo.com> {
 	REXEC support
 	Veritas Low Latency Transport support
+	MAPI new mail protocol support
 }
 
 Krzysztof Burghardt	<krzysztof [AT] burghardt.pl> {