I have figured out one of the fields in the MAPI EcRRegisterPushNotification packet. The field is a UDP port number that the client wants the Exchange server to send new mail notifications on. These notifications are on a port > 1023 and are always 8 bytes long.
It looks like I would add the function name to the dcerpc_mapi_dissectors[] for the register push notification. What would my new function need to do besides display the field? Thanks, Steve _______________________________________________ Wireshark-dev mailing list Wireshark-dev@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-dev
