I have been asked to track MAPI traffic on a customers network.

According to Microsoft: "Microsoft Exchange Server includes several system services. When a MAPI client such as Microsoft Outlook connects to an Exchange server, the client first connects to the RPC endpoint mapper (the RPC Locator Service) on TCP port 135. The RPC endpoint mapper tells the client which ports to use to connect to the Exchange Server service, which are dynamically assigned."

With this info, I would assume that this would be something I would need to look at via layer 7. Can someone here perhaps post a sample of what might track this traffic?