<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.3527" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial size=2>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><SPAN class=840081005-26052009><FONT face=Arial
size=2>Hi,</FONT></SPAN></DIV>
<DIV><SPAN class=840081005-26052009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=840081005-26052009> <FONT face=Arial
size=2>I'm trying to use the mapitrace and am running into an issue w/
rpcextract.</FONT></SPAN></DIV>
<DIV><SPAN class=840081005-26052009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=840081005-26052009> <FONT face=Arial
size=2>I've install rpcextract 1.0 on my 32b x86 linux redhat enterprise
linux box and rpcextract in various ways (below). As you can see, I've tried
different capture files (netmon, ethereal, etc.) and they all fail to generate
any output.</FONT></SPAN></DIV>
<DIV><SPAN class=840081005-26052009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=840081005-26052009><FONT face=Arial size=2>
In all the attempts below, the MAPI_FOLDER is empty (nothing written out by
rpcextract). Hence I havent gotten to run mapitrace yet.</FONT></SPAN></DIV>
<DIV><SPAN class=840081005-26052009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=840081005-26052009><FONT face=Arial size=2>
<DIV><SPAN class=840081005-26052009><FONT face=Arial size=2> I
need to run mapitrace to analyze a ethereal cap file to extract a ROP level text
output. The <A
href="http://wiki.openchange.org/index.php/MAPITRACE">http://wiki.openchange.org/index.php/MAPITRACE</A> explains
this.</FONT></SPAN></DIV>
<DIV><SPAN class=840081005-26052009></SPAN> </DIV>
<DIV><SPAN class=840081005-26052009> Can you pl let me know
what I'm doing wrong?</SPAN></DIV>
<DIV><SPAN class=840081005-26052009></SPAN> </DIV>
<DIV><SPAN class=840081005-26052009> If you could send me an
updated set of instructions for doing this, that would be great.</SPAN></DIV>
<DIV><SPAN class=840081005-26052009></SPAN> </DIV>
<DIV><SPAN class=840081005-26052009>Thanks,</SPAN></DIV>
<DIV><SPAN class=840081005-26052009>_Sri</SPAN></DIV>
<DIV><SPAN class=840081005-26052009></SPAN> </DIV>
<DIV><SPAN class=840081005-26052009></SPAN> </DIV></FONT></SPAN></DIV>
<DIV><SPAN class=840081005-26052009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=840081005-26052009><FONT face=Arial size=2>rpcextract -v -d
MAPI-FOLDER -i /tmp/tville-674-2.cap <BR>3139 - Non Ip Packet.. Skiped..<BR>9204
- Non Ip Packet.. Skiped..<BR>13955 - Non Ip Packet.. Skiped..<BR>16716 - Non Ip
Packet.. Skiped..<BR></FONT></SPAN></DIV>
<DIV><SPAN class=840081005-26052009><FONT face=Arial size=2>rpcextract -v -d
MAPI-FOLDER -i /tmp/outlook2_00001_20081216105726.cap <BR>Got end of handshake
on packet 48<BR>Got endpoint mapper response on packet 76<BR>Segmentation
fault<BR></FONT></SPAN></DIV>
<DIV><SPAN class=840081005-26052009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=840081005-26052009><FONT face=Arial size=2>rpcextract -v -d
MAPI-FOLDER -i /tmp/outlook_00001_20081216105020.cap <BR>566 - Non Ip Packet..
Skiped..<BR>Got end of handshake on packet 3913<BR>Got endpoint mapper response
on packet 4077<BR>4298 - Non Ip Packet.. Skiped..<BR></FONT></SPAN></DIV>
<DIV><SPAN class=840081005-26052009><FONT face=Arial
size=2></FONT></SPAN> </DIV></FONT></DIV></BODY></HTML>