Trace dcerpc conversation
I'm trying to trace an rpc conversation with Wireshark and for the most part I get it, but there's one piece I can't seem to figure out. I'm trying to see where the host server's endpoint mapper responds with the dynamic IP the client should use for the given service. I see the IOXIDResolver response, but nowhere do I see a port to be used. The conversation just continues on the correct port.
This is just curiosity in wanting to see where in the response the port is specified, but I cannot identify it anywhere.
(Disclaimer: not a Windows DCOM guy)
Sample capture attached to 15646: DCOM Dissection of ITypeInfo Interface
Looks like the port number is returned by
ISystemActivatorprotocol.See MS: 3.2.4.1.1.2 Issuing the Activation Request