Capturing network traffic between outlook client and exchange server (RPC over TCP)

Analysing network traffic between outlook client and exchange server will help you decide network requirements connecting your datacenters to your users (ie.. using RPC over TCP). Wireshark is a simple tool that we are going to use to capture network traffic [ Download Wireshark ].

Information you should know before hand:

- IP address of client using Outlook (eg: 1.2.3.4)
- IP address of your exchange server (eg: 1.2.3.5)
- Outlook able to connect to your exchange server

Now here is the step-by-step guide.

1. Open wireshark

2. click on the interface (see screenshot above). Now you should see wireshark capturing network traffic. sample screenshot can be viewed here

3. Now start outlook

4. perform you routine tasks with outlook and let wireshark capture do the capture (leave this running for 30 mins)
5. Now stop capturing using the button

6. Save your capture

7. Now specify your filter "ip.src == 1.2.3.4 and ip.dst == 1.2.3.5" (use your exchange server IP address), this should display network traffic netween outlook client and exchange server. Filtered data gets displayed

8. Now select Statistics -> Summary. "Wireshark: Summary" dialog displays some very useful traffic information such as :-

- Between first and last packet (time taken in secs)
- Avg. packets/secs (average packets per sec)
- Avg. packets size (average packet size)
- Bytes (total amount of bytes transfered)
- Avg. bytes/sec (average bytes per sec)

Note that "Displayed" column is what you are interested as it shows data based on your filter. "Captured" columns will show everything.

. Any sufficiently advanced technology is indistinguishable from magic. ~Arthur C. Clarke