From stephen fisher:

I have figured out one of the fields in the MAPI
EcRRegisterPushNotification packet.  The field is a UDP port number that
the client wants the Exchange server to send new mail notifications on.
These notifications are on a port > 1023 and are always 8 bytes long.

It looks like I would add the function name to the
dcerpc_mapi_dissectors[] for the register push notification.  What would
my new function need to do besides display the field?


Thanks,

Steve

Here is a patch to add this functionality.  It displays the notification
port and the notification payload (not sure what the payload itself
means yet).  It also dynamically registers each notification port found
with a new dissector (that I called newmail for lack of a better name -
I'm open to suggestions) that displays the notification payload.  This
is all undocumented by Microsoft in their usual fashion.

I also changed the code to always display the mapi.opnum field;
currently, the mapi.opnum is only displayed when the
dcerpc_mapi_dissector is null.


Steve




svn path=/trunk/; revision=19350

1 files changed, 2 insertions, 4 deletions

diff --git a/epan/dissectors/packet-dcerpc.c b/epan/dissectors/packet-dcerpc.c
index a651a9e47a..2a71aa71df 100644
--- a/epan/dissectors/packet-dcerpc.c
+++ b/epan/dissectors/packet-dcerpc.c
@@ -2192,18 +2192,16 @@ dcerpc_try_handoff (packet_info *pinfo, proto_tree *tree,
          * Put the operation number into the tree along with
          * the operation's name.
          */
-        if(sub_dissect == NULL) {
-	    if (sub_proto->opnum_hf != -1)
+	if (sub_proto->opnum_hf != -1)
                 proto_tree_add_uint_format(sub_tree, sub_proto->opnum_hf,
                                            tvb, 0, 0, info->call_data->opnum,
                                            "Operation: %s (%u)",
                                            name, info->call_data->opnum);
-            else
+	else
                 proto_tree_add_uint_format(sub_tree, hf_dcerpc_op, tvb,
                                            0, 0, info->call_data->opnum,
                                            "Operation: %s (%u)",
                                            name, info->call_data->opnum);
-	}
 
         if(info->ptype == PDU_REQ && info->call_data->rep_frame!=0) {
             pi = proto_tree_add_uint(sub_tree, hf_dcerpc_response_in,