In my previous post I detailed the new features that are part of the July 2013 Lync Server update (CU2) in a series of screenshots and although that can make valuable posting material its time to actually dig into how the product works.
So the first feature we will look into is the Question & Answer feature. The thing that intrigues me the most about this new feature is that the Lync team is absolutely just taking advantage of platform. Essentially, they are leveraging the conversation window/stage and doing a custom addins. If we were doing custom development project, we would be leveraging the HKEY_CURRENT_USERSoftwareMicrosoftOffice15.0LyncAddins key to define our information. I went and checked that location for giggles but there was nothing there as I assumed.
Lets go ahead and dig into what we can find. We will use Fiddler as our primary tool for tracing. When we start a conference and then click Q&A, we see this:
The first thing you should realize is that this feature requires both the server side and client side patches to be applied to work. Now that we know where the location is we should go and look and see what other apps are in that directory, any other surprises?
The only new directory from CU1 to CU2 is the Qna directory so apparently no other secret features. A subject for another day will be to dig through each and everyone of these directories.
The next step of the investigation is to figure out how questions and answers to passed back and forth to the client. My first thought would have been we were using the same web services for this but that just isn’t the case. Creating multiple questions and answers there was only one web request to:
So we go to the server and do some tracing. The first thing that is interesting is to capture the C3P request to start Q&A which also stops group IM for everyone in the conference. And if we stop the Q&A and start IM’s again, we see more traffic.
Here we can see msci being modified from false to true and block to unblock. Fairly interesting stuff overall. As for the actual questions and answers, I have gotten Wireshark to play nice in my lab yet so I can decrypt the traffic, however I’m seeing PSOM/8057 traffic going back and forth when I ask/answer questions. So maybe its hiding in there. Will update as soon as I can get it to decrypt again.