We're now a non-profit! Support open source packet analysis by making a donation.

Display Filter Reference: Exchange 5.5 EMSMDB

Protocol field name: mapi

Versions: 1.0.0 to 4.0.6

Back to Display Filter Reference

Field name Description Type Versions
mapi.DATA_BLOB.dataDataUnsigned integer (8 bits)1.2.0 to 4.0.6
mapi.DATA_BLOB.lengthLengthUnsigned integer (8 bits)1.2.0 to 4.0.6
mapi.decrypted.dataDecrypted dataByte sequence1.0.0 to 4.0.6
mapi.decrypted.data.lenLengthUnsigned integer (32 bits)1.0.0 to 1.0.16
mapi.decrypted.data.maxlenMax LengthUnsigned integer (32 bits)1.0.0 to 1.0.16
mapi.decrypted.data.offsetOffsetUnsigned integer (32 bits)1.0.0 to 1.0.16
mapi.EcDoConnect.alloc_spaceAlloc SpaceUnsigned integer (32 bits)1.2.0 to 4.0.6
mapi.EcDoConnect.code_pageCode PageUnsigned integer (32 bits)1.2.0 to 4.0.6
mapi.EcDoConnect.emsmdb_client_versionEmsmdb Client VersionUnsigned integer (16 bits)1.2.0 to 4.0.6
mapi.EcDoConnect.input_localeInput LocaleLabel1.2.0 to 4.0.6
mapi.EcDoConnect.nameNameCharacter string1.2.0 to 4.0.6
mapi.EcDoConnect.org_groupOrg GroupCharacter string1.2.0 to 4.0.6
mapi.EcDoConnect.session_nbSession NbUnsigned integer (16 bits)1.2.0 to 4.0.6
mapi.EcDoConnect.store_versionStore VersionUnsigned integer (16 bits)1.2.0 to 4.0.6
mapi.EcDoConnect.unknown1Unknown1Unsigned integer (32 bits)1.2.0 to 4.0.6
mapi.EcDoConnect.unknown2Unknown2Unsigned integer (32 bits)1.2.0 to 4.0.6
mapi.EcDoConnect.unknown3Unknown3Unsigned integer (16 bits)1.2.0 to 4.0.6
mapi.EcDoConnect.unknown4Unknown4Unsigned integer (32 bits)1.2.0 to 4.0.6
mapi.EcDoConnect.userUserCharacter string1.2.0 to 4.0.6
mapi.EcDoRpc.codepageCodepageUnsigned integer (32 bits)2.0.0 to 4.0.6
mapi.EcDoRpc.folder_idFolder IDUnsigned integer (64 bits)2.0.0 to 4.0.6
mapi.EcDoRpc.handle_indexHandle indexUnsigned integer (8 bits)2.0.0 to 4.0.6
mapi.EcDoRpc.layoutLayoutUnsigned integer (8 bits)2.0.0 to 4.0.6
mapi.EcDoRpc.lengthLengthUnsigned integer (16 bits)1.2.0 to 4.0.6
mapi.EcDoRpc.mailboxMailboxCharacter string2.0.0 to 4.0.6
mapi.EcDoRpc.mapi_flagsmapi_flagsUnsigned integer (8 bits)2.0.0 to 4.0.6
mapi.EcDoRpc.mapi_requestMapi RequestLabel1.2.0 to 4.0.6
mapi.EcDoRpc.mapi_responseMapi ResponseLabel1.2.0 to 4.0.6
mapi.EcDoRpc.mapi_tagMAPI tagUnsigned integer (32 bits)2.0.0 to 4.0.6
mapi.EcDoRpc.max_dataMax DataUnsigned integer (16 bits)1.2.0 to 4.0.6
mapi.EcDoRpc.offsetOffsetUnsigned integer (32 bits)1.2.0 to 4.0.6
mapi.EcDoRpc.paddingPaddingUnsigned integer (32 bits)2.0.0 to 4.0.6
mapi.EcDoRpc.prop_countProp countUnsigned integer (16 bits)2.0.0 to 4.0.6
mapi.EcDoRpc.rowRowUnsigned integer (8 bits)2.0.0 to 4.0.6
mapi.EcDoRpc.sizeSizeUnsigned integer (32 bits)1.2.0 to 4.0.6
mapi.EcDoRpc.str_lengthLengthUnsigned integer (16 bits)2.0.0 to 4.0.6
mapi.EcDoRpc.subcontextSubcontext lengthUnsigned integer (32 bits)1.12.2 to 4.0.6
mapi.EcDoRpc.subcontext_sizeSubcontext sizeUnsigned integer (32 bits)2.0.0 to 4.0.6
mapi.EcDoRpc.unknown1Unknown1Unsigned integer (16 bits)2.0.0 to 4.0.6
mapi.EcDoRpc.unknown2Unknown2Unsigned integer (8 bits)2.0.0 to 4.0.6
mapi.EcDoRpc.unknown3Unknown3Unsigned integer (32 bits)2.0.0 to 4.0.6
mapi.EcDoRpc_MAPI_REPL.opnumOpnumUnsigned integer (8 bits)2.0.0 to 4.0.6
mapi.EcDoRpc_MAPI_REPL_UNION.mapi_GetPropsMapi GetPropsLabel1.2.0 to 4.0.6
mapi.EcDoRpc_MAPI_REPL_UNION.mapi_OpenFolderMapi OpenFolderLabel1.2.0 to 4.0.6
mapi.EcDoRpc_MAPI_REPL_UNION.mapi_ReleaseMapi ReleaseLabel1.2.0 to 4.0.6
mapi.EcDoRpc_MAPI_REQ.opnumOpnumUnsigned integer (8 bits)1.2.0 to 1.12.13
mapi.EcDoRpc_MAPI_REQ_UNION.mapi_GetPropsMapi GetPropsLabel1.2.0 to 4.0.6
mapi.EcDoRpc_MAPI_REQ_UNION.mapi_OpenFolderMapi OpenFolderLabel1.2.0 to 4.0.6
mapi.EcDoRpc_MAPI_REQ_UNION.mapi_OpenMsgStoreMapi OpenMsgStoreLabel1.2.0 to 4.0.6
mapi.EcDoRpc_MAPI_REQ_UNION.mapi_ReleaseMapi ReleaseLabel1.2.0 to 4.0.6
mapi.EcRRegisterPushNotification.notif_lenNotif LenUnsigned integer (16 bits)1.2.0 to 4.0.6
mapi.EcRRegisterPushNotification.notifkeyNotifkeyUnsigned integer (8 bits)1.2.0 to 4.0.6
mapi.EcRRegisterPushNotification.retvalRetvalUnsigned integer (32 bits)1.2.0 to 4.0.6
mapi.EcRRegisterPushNotification.sockaddrSockaddrUnsigned integer (8 bits)1.2.0 to 4.0.6
mapi.EcRRegisterPushNotification.sockaddr_lenSockaddr LenUnsigned integer (16 bits)1.2.0 to 4.0.6
mapi.EcRRegisterPushNotification.ulEventMaskUlEventMaskUnsigned integer (16 bits)1.2.0 to 4.0.6
mapi.EcRRegisterPushNotification.unknown2Unknown2Unsigned integer (32 bits)1.2.0 to 4.0.6
mapi.EcRUnregisterPushNotification.unknownUnknownUnsigned integer (32 bits)1.2.0 to 4.0.6
mapi.encap_lenLengthUnsigned integer (16 bits)1.0.0 to 1.0.16
mapi.encrypted_dataEncrypted dataByte sequence1.0.0 to 1.0.16
mapi.FILETIME.dwHighDateTimeDwHighDateTimeUnsigned integer (32 bits)1.2.0 to 4.0.6
mapi.FILETIME.dwLowDateTimeDwLowDateTimeUnsigned integer (32 bits)1.2.0 to 4.0.6
mapi.handleHandleByte sequence1.2.0 to 4.0.6
mapi.hndContext HandleByte sequence1.0.0 to 1.0.16
mapi.input_locale.languageLanguageUnsigned integer (32 bits)1.2.0 to 4.0.6
mapi.input_locale.methodMethodUnsigned integer (32 bits)1.2.0 to 4.0.6
mapi.LPSTR.lppszALppszACharacter string1.2.0 to 4.0.6
mapi.mapi_handleMAPI handleUnsigned integer (32 bits)2.0.0 to 4.0.6
mapi.mapi_request.mapi_reqMapi ReqLabel1.2.0 to 4.0.6
mapi.mapi_response.mapi_replMapi ReplLabel1.2.0 to 4.0.6
mapi.MAPISTATUS_statusMAPISTATUSUnsigned integer (32 bits)1.2.0 to 4.0.6
mapi.notification_payloadNotification payloadByte sequence1.0.0 to 1.0.16
mapi.notification_portNotification portUnsigned integer (16 bits)1.0.0 to 1.0.16
mapi.OpenMessage_recipients.codepageCodepageUnsigned integer (32 bits)1.2.0 to 4.0.6
mapi.OpenMessage_recipients.RecipClassRecipClassUnsigned integer (8 bits)1.2.0 to 4.0.6
mapi.OpenMessage_recipients.recipients_headersRecipients HeadersLabel1.2.0 to 4.0.6
mapi.OpenMessage_recipients.subcontextSubcontext lengthUnsigned integer (16 bits)1.12.2 to 4.0.6
mapi.OpenMessage_req.folder_handle_idxFolder Handle IdxUnsigned integer (8 bits)1.2.0 to 4.0.6
mapi.OpenMessage_req.folder_idFolder IdUnsigned integer (64 bits)1.2.0 to 4.0.6
mapi.OpenMessage_req.max_dataMax DataUnsigned integer (16 bits)1.2.0 to 4.0.6
mapi.OpenMessage_req.message_idMessage IdUnsigned integer (64 bits)1.2.0 to 4.0.6
mapi.OpenMessage_req.message_permissionsMessage PermissionsUnsigned integer (8 bits)1.2.0 to 4.0.6
mapi.opnumOperationUnsigned integer (16 bits)1.0.0 to 4.0.6
mapi.pdu.lenLengthUnsigned integer (16 bits)1.0.0 to 4.0.6
mapi.rcReturn codeUnsigned integer (32 bits)1.0.0 to 1.0.16
mapi.RecipExchange.addr_typeAddr TypeUnsigned integer (8 bits)1.2.0 to 4.0.6
mapi.RecipExchange.organization_lengthOrganization LengthUnsigned integer (8 bits)1.2.0 to 4.0.6
mapi.recipient_displayname_7bit.lpszALpszACharacter string1.2.0 to 4.0.6
mapi.recipient_type.EXCHANGEEXCHANGELabel1.2.0 to 4.0.6
mapi.recipient_type.SMTPSMTPLabel1.2.0 to 4.0.6
mapi.recipients_headers.bitmaskBitmaskUnsigned integer (16 bits)1.2.0 to 4.0.6
mapi.recipients_headers.layoutLayoutUnsigned integer (8 bits)1.2.0 to 4.0.6
mapi.recipients_headers.prop_countProp CountUnsigned integer (16 bits)1.2.0 to 4.0.6
mapi.recipients_headers.prop_valuesProp ValuesLabel1.2.0 to 4.0.6
mapi.recipients_headers.typeRecipient TypeUnsigned integer (16 bits)1.2.0 to 4.0.6
mapi.recipients_headers.usernameUsernameLabel1.2.0 to 4.0.6
mapi.SPropValue.ulPropTagUlPropTagUnsigned integer (32 bits)1.2.0 to 4.0.6
mapi.SPropValue.valueValueUnsigned integer (32 bits)1.2.0 to 4.0.6
mapi.SPropValue_CTR.bBUnsigned integer (8 bits)1.2.0 to 4.0.6
mapi.SPropValue_CTR.dDSigned integer (64 bits)1.2.0 to 4.0.6
mapi.SPropValue_CTR.dblDblSigned integer (64 bits)1.2.0 to 4.0.6
mapi.SPropValue_CTR.errErrUnsigned integer (32 bits)1.2.0 to 4.0.6
mapi.SPropValue_CTR.ftFtLabel1.2.0 to 4.0.6
mapi.SPropValue_CTR.iIUnsigned integer (16 bits)1.2.0 to 4.0.6
mapi.SPropValue_CTR.lLUnsigned integer (32 bits)1.2.0 to 4.0.6
mapi.SPropValue_CTR.lpguidLpguidGlobally Unique Identifier1.2.0 to 4.0.6
mapi.SPropValue_CTR.lpszALpszACharacter string1.2.0 to 4.0.6
mapi.SPropValue_CTR.lpszWLpszWCharacter string1.2.0 to 4.0.6
mapi.SRow.ulRowFlagsUlRowFlagsUnsigned integer (8 bits)1.2.0 to 4.0.6
mapi.ulEventType.fnevCriticalErrorFnevCriticalErrorBoolean1.2.0 to 4.0.6
mapi.ulEventType.fnevExtendedFnevExtendedBoolean1.2.0 to 4.0.6
mapi.ulEventType.fnevNewMailFnevNewMailBoolean1.2.0 to 4.0.6
mapi.ulEventType.fnevObjectCopiedFnevObjectCopiedBoolean1.2.0 to 4.0.6
mapi.ulEventType.fnevObjectCreatedFnevObjectCreatedBoolean1.2.0 to 4.0.6
mapi.ulEventType.fnevObjectDeletedFnevObjectDeletedBoolean1.2.0 to 4.0.6
mapi.ulEventType.fnevObjectModifiedFnevObjectModifiedBoolean1.2.0 to 4.0.6
mapi.ulEventType.fnevObjectMovedFnevObjectMovedBoolean1.2.0 to 4.0.6
mapi.ulEventType.fnevReservedForMapiFnevReservedForMapiBoolean1.2.0 to 4.0.6
mapi.ulEventType.fnevSearchCompleteFnevSearchCompleteBoolean1.2.0 to 4.0.6
mapi.ulEventType.fnevStatusObjectModifiedFnevStatusObjectModifiedBoolean1.2.0 to 4.0.6
mapi.ulEventType.fnevTableModifiedFnevTableModifiedBoolean1.2.0 to 4.0.6
mapi.unknown_longUnknown longUnsigned integer (32 bits)1.0.0 to 1.0.16
mapi.unknown_shortUnknown shortUnsigned integer (16 bits)1.0.0 to 1.0.16
mapi.unknown_stringUnknown stringCharacter string1.0.0 to 1.0.16