Capturing network traffic between outlook client and exchange server (RPC over HTTP)

My previous article show how to capture network traffic between outlook client and exchange server with RPC over TCP. Now lets look at how to capture network traffic with RPC over HTTP.

1. Enable "Outlook Anywhere" on your Exchange server. Follow this link Enable Outlook Anywhere.

2. Now enable your outlook to use HTTP. Follow this link Setting Up Email (RPC over HTTPS).

Since all prep has now completed just follow the steps in my previous article Capturing network traffic between outlook client and exchange server (RPC over TCP).

I am sorry to say that there is too much point to the wisecrack that life is extinct on other planets because their scientists were more advanced than ours. ~John F. Kennedy

Continue Reading

Capturing network traffic between outlook client and exchange server (RPC over TCP)

Analysing network traffic between outlook client and exchange server will help you decide network requirements connecting your datacenters to your users (ie.. using RPC over TCP). Wireshark is a simple tool that we are going to use to capture network traffic [ Download Wireshark ].

Information you should know before hand:

- IP address of client using Outlook (eg: 1.2.3.4)
- IP address of your exchange server (eg: 1.2.3.5)
- Outlook able to connect to your exchange server

Now here is the step-by-step guide.

1. Open wireshark

2. click on the interface (see screenshot above). Now you should see wireshark capturing network traffic. sample screenshot can be viewed here

3. Now start outlook

4. perform you routine tasks with outlook and let wireshark capture do the capture (leave this running for 30 mins)
5. Now stop capturing using the button

6. Save your capture

7. Now specify your filter "ip.src == 1.2.3.4 and ip.dst == 1.2.3.5" (use your exchange server IP address), this should display network traffic netween outlook client and exchange server. Filtered data gets displayed

8. Now select Statistics -> Summary. "Wireshark: Summary" dialog displays some very useful traffic information such as :-

- Between first and last packet (time taken in secs)
- Avg. packets/secs (average packets per sec)
- Avg. packets size (average packet size)
- Bytes (total amount of bytes transfered)
- Avg. bytes/sec (average bytes per sec)

Note that "Displayed" column is what you are interested as it shows data based on your filter. "Captured" columns will show everything.

. Any sufficiently advanced technology is indistinguishable from magic. ~Arthur C. Clarke

Continue Reading