NTLM over a Server Message Block (SMB) transport is one of the most common uses of NTLM authentication and encryption.

I noticed that our XP based network was running NTLMv1 that is considered unsecure. In this article I was looking at SMB and NTLM traffic in a windows environment. It has saved the day for me a couple of times by giving me information that is only retrieved by looking at packet level. 12 * 13 * Wireshark - Network traffic analyzer 14 * By Gerald Combs 15 * Copyright 1998 Gerald Combs 16 * 17 * SPDX-License-Identifier: GPL-2.0-or-later 18 */ 19 20 #include 'config.h' 21 22 #include 23 #include 24 #include 25 #include 26 #include 27 #include 28 #include 29 #include 30 #include 31 #include 32 #include 33 #include 34 35 #include 'packet-smb2.h' 36 #include 'packet-ntlmssp.h' 37 #include 'packet-kerberos.h' 38 #include 'packet-windows-common.h' 39 #include 'packet-dcerpc-nt.h' 40 41 #include 'read_keytab_file.h' 42 43 #include 44 #include 45 46 #ifdef _WIN32 47 #include 48 #else 49 /* Defined in winnt.h */ 50 #define OWNER_SECURITY_INFORMATION 0x00000001 51 #define GROUP_SECURITY_INFORMATION 0x00000002 52 #define DACL_SECURITY_INFORMATION 0x00000004 53 #define SACL_SECURITY_INFORMATION 0x00000008 54 #define LABEL_SECURITY_INFORMATION 0x00000010 55 #define ATTRIBUTE_SECURITY_INFORMATION 0x00000020 56 #define SCOPE_SECURITY_INFORMATION 0x00000040 57 #define BACKUP_SECURITY_INFORMATION 0x00010000 58 #endif 59 60 //#define DEBUG_SMB2 61 #ifdef DEBUG_SMB2 62 #define DEBUG(.The last few days I am playing around with wireshark and I must say I enjoy working with this program.

As a special service 'Fossies' has tried to format the requested source page into HTML format using (guessed) C and C++ source code syntax highlighting (style: standard) with prefixed line numbers and code folding option.Īlternatively you can here view or download the uninterpreted source code file.įor more information about 'packet-smb2.c' see the Fossies 'Dox' file reference documentation and the latest Fossies 'Diffs' side-by-side code changes reports: 3.7.2_vs_4.0.0 or 3.6.8_vs_4.0.0.ġ /* packet-smb2.c 2 * Routines for smb2 packet dissection 3 * Ronnie Sahlberg 2005 4 * 5 * For documentation of this protocol, see: 6 * 7 * 8 * 9 * 10 * 11 * If you edit this file, keep the wiki updated as well.

Smb2 wireshark display filter