No. Time Source Destination Protocol Length Info 19 0.006333000 192.168.18.46 192.168.18.3 SMB 328 Session Setup AndX Request, NTLMSSP_AUTH, User: \ Frame 19: 328 bytes on wire (2624 bits), 328 bytes captured (2624 bits) on interface 0 Interface id: 0 Encapsulation type: Ethernet (1) Arrival Time: Aug 19, 2013 12:53:44.496665000 CEST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1376909624.496665000 seconds [Time delta from previous captured frame: 0.000594000 seconds] [Time delta from previous displayed frame: 0.000594000 seconds] [Time since reference or first frame: 0.006333000 seconds] Frame Number: 19 Frame Length: 328 bytes (2624 bits) Capture Length: 328 bytes (2624 bits) [Frame is marked: True] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:nbss:smb:gss-api:spnego:ntlmssp] [Number of per-protocol-data: 3] [GSS-API Generic Security Service Application Program Interface, key 0] [NTLM Secure Service Provider, key 0] [Simple Protected Negotiation, key 0] [Coloring Rule Name: SMB] [Coloring Rule String: smb || nbss || nbns || nbipx || ipxsap || netbios] Ethernet II, Src: CadmusCo_ae:8a:ef (08:00:27:ae:8a:ef), Dst: Intel_74:c3:d0 (00:0e:0c:74:c3:d0) Destination: Intel_74:c3:d0 (00:0e:0c:74:c3:d0) Address: Intel_74:c3:d0 (00:0e:0c:74:c3:d0) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: CadmusCo_ae:8a:ef (08:00:27:ae:8a:ef) Address: CadmusCo_ae:8a:ef (08:00:27:ae:8a:ef) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IP (0x0800) Internet Protocol Version 4, Src: 192.168.18.46 (192.168.18.46), Dst: 192.168.18.3 (192.168.18.3) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 314 Identification: 0x7058 (28760) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (6) Header checksum: 0xe3e3 [correct] [Good: True] [Bad: False] Source: 192.168.18.46 (192.168.18.46) Destination: 192.168.18.3 (192.168.18.3) [Source GeoIP: Unknown] [Destination GeoIP: Unknown] Transmission Control Protocol, Src Port: ams (1037), Dst Port: netbios-ssn (139), Seq: 450, Ack: 452, Len: 274 Source port: ams (1037) Destination port: netbios-ssn (139) [Stream index: 0] Sequence number: 450 (relative sequence number) [Next sequence number: 724 (relative sequence number)] Acknowledgment number: 452 (relative ack number) Header length: 20 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set Window size value: 63789 [Calculated window size: 63789] [Window size scaling factor: -2 (no window scaling used)] Checksum: 0xa589 [validation disabled] [Good Checksum: False] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 18] [The RTT to ACK the segment was: 0.000594000 seconds] [Bytes in flight: 274] NetBIOS Session Service Message Type: Session message (0x00) Length: 270 SMB (Server Message Block Protocol) SMB Header Server Component: SMB [Response in: 21] SMB Command: Session Setup AndX (0x73) NT Status: STATUS_SUCCESS (0x00000000) Flags: 0x18 0... .... = Request/Response: Message is a request to the server .0.. .... = Notify: Notify client only on open ..0. .... = Oplocks: OpLock not requested/granted ...1 .... = Canonicalized Pathnames: Pathnames are canonicalized .... 1... = Case Sensitivity: Path names are caseless .... ..0. = Receive Buffer Posted: Receive buffer has not been posted .... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported Flags2: 0xc807 1... .... .... .... = Unicode Strings: Strings are Unicode .1.. .... .... .... = Error Code Type: Error codes are NT error codes ..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only ...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs .... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported .... .0.. .... .... = Reparse Path: The request does not use a @GMT reparse path .... .... .0.. .... = Long Names Used: Path names in request are not long file names .... .... ...0 .... = Security Signatures Required: Security signatures are not required .... .... .... 0... = Compressed: Compression is not requested .... .... .... .1.. = Security Signatures: Security signatures are supported .... .... .... ..1. = Extended Attributes: Extended attributes are supported .... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response Process ID High: 0 Signature: 0000000000000000 Reserved: 0000 Tree ID: 0 Process ID: 65279 User ID: 100 Multiplex ID: 128 Session Setup AndX Request (0x73) Word Count (WCT): 12 AndXCommand: No further commands (0xff) Reserved: 00 AndXOffset: 270 Max Buffer: 65535 Max Mpx Count: 50 VC Number: 0 Session Key: 0x00000000 Security Blob Length: 109 Reserved: 00000000 Capabilities: 0xa00000d4 .... .... .... .... .... .... .... ...0 = Raw Mode: Read Raw and Write Raw are not supported .... .... .... .... .... .... .... ..0. = MPX Mode: Read Mpx and Write Mpx are not supported .... .... .... .... .... .... .... .1.. = Unicode: Unicode strings are supported .... .... .... .... .... .... .... 0... = Large Files: Large files are not supported .... .... .... .... .... .... ...1 .... = NT SMBs: NT SMBs are supported .... .... .... .... .... .... ..0. .... = RPC Remote APIs: RPC remote APIs are not supported .... .... .... .... .... .... .1.. .... = NT Status Codes: NT status codes are supported .... .... .... .... .... .... 1... .... = Level 2 Oplocks: Level 2 oplocks are supported .... .... .... .... .... ...0 .... .... = Lock and Read: Lock and Read is not supported .... .... .... .... .... ..0. .... .... = NT Find: NT Find is not supported .... .... .... .... ...0 .... .... .... = Dfs: Dfs is not supported .... .... .... .... ..0. .... .... .... = Infolevel Passthru: NT information level request passthrough is not supported .... .... .... .... .0.. .... .... .... = Large ReadX: Large Read andX is not supported .... .... .... .... 0... .... .... .... = Large WriteX: Large Write andX is not supported .... .... .... ...0 .... .... .... .... = LWIO: LWIO ioctl/fsctl is not supported .... .... 0... .... .... .... .... .... = UNIX: UNIX extensions are not supported .... ..0. .... .... .... .... .... .... = Compressed Data: Compressed data transfer is not supported ..1. .... .... .... .... .... .... .... = Dynamic Reauth: Dynamic Reauth is supported 1... .... .... .... .... .... .... .... = Extended Security: Extended security exchanges are supported Byte Count (BCC): 211 Security Blob: a16b3069a26704654e544c4d535350000300000001000100... GSS-API Generic Security Service Application Program Interface Simple Protected Negotiation negTokenTarg responseToken: 4e544c4d5353500003000000010001005400000000000000... NTLM Secure Service Provider NTLMSSP identifier: NTLMSSP NTLM Message Type: NTLMSSP_AUTH (0x00000003) Lan Manager Response: 00 Length: 1 Maxlen: 1 Offset: 84 NTLM Response: Empty Domain name: NULL User name: NULL Host name: ITW03V Length: 12 Maxlen: 12 Offset: 72 Session Key: 8740de01d1994cc9a326556ab1b178e2 Length: 16 Maxlen: 16 Offset: 85 Flags: 0xe2888a15 1... .... .... .... .... .... .... .... = Negotiate 56: Set .1.. .... .... .... .... .... .... .... = Negotiate Key Exchange: Set ..1. .... .... .... .... .... .... .... = Negotiate 128: Set ...0 .... .... .... .... .... .... .... = Negotiate 0x10000000: Not set .... 0... .... .... .... .... .... .... = Negotiate 0x08000000: Not set .... .0.. .... .... .... .... .... .... = Negotiate 0x04000000: Not set .... ..1. .... .... .... .... .... .... = Negotiate Version: Set .... ...0 .... .... .... .... .... .... = Negotiate 0x01000000: Not set .... .... 1... .... .... .... .... .... = Negotiate Target Info: Set .... .... .0.. .... .... .... .... .... = Request Non-NT Session: Not set .... .... ..0. .... .... .... .... .... = Negotiate 0x00200000: Not set .... .... ...0 .... .... .... .... .... = Negotiate Identify: Not set .... .... .... 1... .... .... .... .... = Negotiate Extended Security: Set .... .... .... .0.. .... .... .... .... = Target Type Share: Not set .... .... .... ..0. .... .... .... .... = Target Type Server: Not set .... .... .... ...0 .... .... .... .... = Target Type Domain: Not set .... .... .... .... 1... .... .... .... = Negotiate Always Sign: Set .... .... .... .... .0.. .... .... .... = Negotiate 0x00004000: Not set .... .... .... .... ..0. .... .... .... = Negotiate OEM Workstation Supplied: Not set .... .... .... .... ...0 .... .... .... = Negotiate OEM Domain Supplied: Not set .... .... .... .... .... 1... .... .... = Negotiate 0x00000800: Set .... .... .... .... .... .0.. .... .... = Negotiate NT Only: Not set .... .... .... .... .... ..1. .... .... = Negotiate NTLM key: Set .... .... .... .... .... ...0 .... .... = Negotiate 0x00000100: Not set .... .... .... .... .... .... 0... .... = Negotiate Lan Manager Key: Not set .... .... .... .... .... .... .0.. .... = Negotiate Datagram: Not set .... .... .... .... .... .... ..0. .... = Negotiate Seal: Not set .... .... .... .... .... .... ...1 .... = Negotiate Sign: Set .... .... .... .... .... .... .... 0... = Request 0x00000008: Not set .... .... .... .... .... .... .... .1.. = Request Target: Set .... .... .... .... .... .... .... ..0. = Negotiate OEM: Not set .... .... .... .... .... .... .... ...1 = Negotiate UNICODE: Set Version 5.1 (Build 2600); NTLM Current Revision 15 Major Version: 5 Minor Version: 1 Build Number: 2600 NTLM Current Revision: 15 Native OS: Windows 2002 Service Pack 2 2600 Native LAN Manager: Windows 2002 5.1 Primary Domain: No. Time Source Destination Protocol Length Info 93038 804.289666000 192.168.18.32 192.168.18.3 SMB 514 Session Setup AndX Request, NTLMSSP_AUTH, User: ITSERVER\admin Frame 93038: 514 bytes on wire (4112 bits), 514 bytes captured (4112 bits) on interface 0 Interface id: 0 Encapsulation type: Ethernet (1) Arrival Time: Aug 19, 2013 13:07:08.779998000 CEST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1376910428.779998000 seconds [Time delta from previous captured frame: 0.000087000 seconds] [Time delta from previous displayed frame: 0.000087000 seconds] [Time since reference or first frame: 804.289666000 seconds] Frame Number: 93038 Frame Length: 514 bytes (4112 bits) Capture Length: 514 bytes (4112 bits) [Frame is marked: True] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:nbss:smb:gss-api:ntlmssp] [Number of per-protocol-data: 1] [NTLM Secure Service Provider, key 0] [Coloring Rule Name: SMB] [Coloring Rule String: smb || nbss || nbns || nbipx || ipxsap || netbios] Ethernet II, Src: Internet_a0:67:1e (00:e0:4d:a0:67:1e), Dst: Intel_74:c3:d0 (00:0e:0c:74:c3:d0) Destination: Intel_74:c3:d0 (00:0e:0c:74:c3:d0) Address: Intel_74:c3:d0 (00:0e:0c:74:c3:d0) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: Internet_a0:67:1e (00:e0:4d:a0:67:1e) Address: Internet_a0:67:1e (00:e0:4d:a0:67:1e) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IP (0x0800) Internet Protocol Version 4, Src: 192.168.18.32 (192.168.18.32), Dst: 192.168.18.3 (192.168.18.3) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 500 Identification: 0x6349 (25417) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0x3047 [correct] [Good: True] [Bad: False] Source: 192.168.18.32 (192.168.18.32) Destination: 192.168.18.3 (192.168.18.3) [Source GeoIP: Unknown] [Destination GeoIP: Unknown] Transmission Control Protocol, Src Port: 34665 (34665), Dst Port: microsoft-ds (445), Seq: 297, Ack: 418, Len: 448 Source port: 34665 (34665) Destination port: microsoft-ds (445) [Stream index: 20] Sequence number: 297 (relative sequence number) [Next sequence number: 745 (relative sequence number)] Acknowledgment number: 418 (relative ack number) Header length: 32 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set Window size value: 131 [Calculated window size: 16768] [Window size scaling factor: 128] Checksum: 0xaa9f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) Timestamps: TSval 855056, TSecr 998532345 Kind: Timestamp (8) Length: 10 Timestamp value: 855056 Timestamp echo reply: 998532345 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 93037] [The RTT to ACK the segment was: 0.000087000 seconds] [Bytes in flight: 448] NetBIOS Session Service Message Type: Session message (0x00) Length: 444 SMB (Server Message Block Protocol) SMB Header Server Component: SMB [Response in: 93041] SMB Command: Session Setup AndX (0x73) NT Status: STATUS_SUCCESS (0x00000000) Flags: 0x00 0... .... = Request/Response: Message is a request to the server .0.. .... = Notify: Notify client only on open ..0. .... = Oplocks: OpLock not requested/granted ...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized .... 0... = Case Sensitivity: Path names are case sensitive .... ..0. = Receive Buffer Posted: Receive buffer has not been posted .... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported Flags2: 0xd801 1... .... .... .... = Unicode Strings: Strings are Unicode .1.. .... .... .... = Error Code Type: Error codes are NT error codes ..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only ...1 .... .... .... = Dfs: Resolve pathnames with Dfs .... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported .... .0.. .... .... = Reparse Path: The request does not use a @GMT reparse path .... .... .0.. .... = Long Names Used: Path names in request are not long file names .... .... ...0 .... = Security Signatures Required: Security signatures are not required .... .... .... 0... = Compressed: Compression is not requested .... .... .... .0.. = Security Signatures: Security signatures are not supported .... .... .... ..0. = Extended Attributes: Extended attributes are not supported .... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response Process ID High: 0 Signature: 0000000000000000 Reserved: 0000 Tree ID: 0 Process ID: 11443 User ID: 100 Multiplex ID: 3 Session Setup AndX Request (0x73) Word Count (WCT): 12 AndXCommand: No further commands (0xff) Reserved: 00 AndXOffset: 0 Max Buffer: 16468 Max Mpx Count: 50 VC Number: 0 Session Key: 0x00000000 Security Blob Length: 266 Reserved: 00000000 Capabilities: 0x8080d0dc .... .... .... .... .... .... .... ...0 = Raw Mode: Read Raw and Write Raw are not supported .... .... .... .... .... .... .... ..0. = MPX Mode: Read Mpx and Write Mpx are not supported .... .... .... .... .... .... .... .1.. = Unicode: Unicode strings are supported .... .... .... .... .... .... .... 1... = Large Files: Large files are supported .... .... .... .... .... .... ...1 .... = NT SMBs: NT SMBs are supported .... .... .... .... .... .... ..0. .... = RPC Remote APIs: RPC remote APIs are not supported .... .... .... .... .... .... .1.. .... = NT Status Codes: NT status codes are supported .... .... .... .... .... .... 1... .... = Level 2 Oplocks: Level 2 oplocks are supported .... .... .... .... .... ...0 .... .... = Lock and Read: Lock and Read is not supported .... .... .... .... .... ..0. .... .... = NT Find: NT Find is not supported .... .... .... .... ...1 .... .... .... = Dfs: Dfs is supported .... .... .... .... ..0. .... .... .... = Infolevel Passthru: NT information level request passthrough is not supported .... .... .... .... .1.. .... .... .... = Large ReadX: Large Read andX is supported .... .... .... .... 1... .... .... .... = Large WriteX: Large Write andX is supported .... .... .... ...0 .... .... .... .... = LWIO: LWIO ioctl/fsctl is not supported .... .... 1... .... .... .... .... .... = UNIX: UNIX extensions are supported .... ..0. .... .... .... .... .... .... = Compressed Data: Compressed data transfer is not supported ..0. .... .... .... .... .... .... .... = Dynamic Reauth: Dynamic Reauth is not supported 1... .... .... .... .... .... .... .... = Extended Security: Extended security exchanges are supported Byte Count (BCC): 385 Security Blob: 4e544c4d535350000300000000000000400000009e009e00... GSS-API Generic Security Service Application Program Interface NTLM Secure Service Provider NTLMSSP identifier: NTLMSSP NTLM Message Type: NTLMSSP_AUTH (0x00000003) Lan Manager Response: Empty NTLM Response: 96ab0e2fa547a5e06056c5a62b6c48780101000000000000... Length: 158 Maxlen: 158 Offset: 64 NTLMv2 Response: 96ab0e2fa547a5e06056c5a62b6c48780101000000000000... HMAC: 96ab0e2fa547a5e06056c5a62b6c4878 Header: 0x00000101 Reserved: 0x00000000 Time: Aug 19, 2013 13:07:08.777145500 CEST Client challenge: 3cad3cd40080f076 Unknown: 0x00000000 Attribute: NetBIOS domain name: ITSERVER NTLMV2 Response Item Type: NetBIOS domain name (0x0002) NTLMV2 Response Item Length: 16 NetBIOS Domain Name: ITSERVER Attribute: NetBIOS computer name: ITSERVER NTLMV2 Response Item Type: NetBIOS computer name (0x0001) NTLMV2 Response Item Length: 16 NetBIOS Computer Name: ITSERVER Attribute: DNS domain name: localdomain NTLMV2 Response Item Type: DNS domain name (0x0004) NTLMV2 Response Item Length: 22 DNS Domain Name: localdomain Attribute: DNS computer name: itserver.localdomain NTLMV2 Response Item Type: DNS computer name (0x0003) NTLMV2 Response Item Length: 40 DNS Computer Name: itserver.localdomain Attribute: End of list NTLMV2 Response Item Type: End of list (0x0000) NTLMV2 Response Item Length: 0 NTLM Client Challenge: 3cad3cd40080f076 Domain name: ITSERVER Length: 16 Maxlen: 16 Offset: 222 User name: admin Length: 10 Maxlen: 10 Offset: 238 Host name: NULL Session Key: 5aaf45848f4afb5314e50c613f15e71f Length: 16 Maxlen: 16 Offset: 250 Flags: 0xa0880205 1... .... .... .... .... .... .... .... = Negotiate 56: Set .0.. .... .... .... .... .... .... .... = Negotiate Key Exchange: Not set ..1. .... .... .... .... .... .... .... = Negotiate 128: Set ...0 .... .... .... .... .... .... .... = Negotiate 0x10000000: Not set .... 0... .... .... .... .... .... .... = Negotiate 0x08000000: Not set .... .0.. .... .... .... .... .... .... = Negotiate 0x04000000: Not set .... ..0. .... .... .... .... .... .... = Negotiate Version: Not set .... ...0 .... .... .... .... .... .... = Negotiate 0x01000000: Not set .... .... 1... .... .... .... .... .... = Negotiate Target Info: Set .... .... .0.. .... .... .... .... .... = Request Non-NT Session: Not set .... .... ..0. .... .... .... .... .... = Negotiate 0x00200000: Not set .... .... ...0 .... .... .... .... .... = Negotiate Identify: Not set .... .... .... 1... .... .... .... .... = Negotiate Extended Security: Set .... .... .... .0.. .... .... .... .... = Target Type Share: Not set .... .... .... ..0. .... .... .... .... = Target Type Server: Not set .... .... .... ...0 .... .... .... .... = Target Type Domain: Not set .... .... .... .... 0... .... .... .... = Negotiate Always Sign: Not set .... .... .... .... .0.. .... .... .... = Negotiate 0x00004000: Not set .... .... .... .... ..0. .... .... .... = Negotiate OEM Workstation Supplied: Not set .... .... .... .... ...0 .... .... .... = Negotiate OEM Domain Supplied: Not set .... .... .... .... .... 0... .... .... = Negotiate 0x00000800: Not set .... .... .... .... .... .0.. .... .... = Negotiate NT Only: Not set .... .... .... .... .... ..1. .... .... = Negotiate NTLM key: Set .... .... .... .... .... ...0 .... .... = Negotiate 0x00000100: Not set .... .... .... .... .... .... 0... .... = Negotiate Lan Manager Key: Not set .... .... .... .... .... .... .0.. .... = Negotiate Datagram: Not set .... .... .... .... .... .... ..0. .... = Negotiate Seal: Not set .... .... .... .... .... .... ...0 .... = Negotiate Sign: Not set .... .... .... .... .... .... .... 0... = Request 0x00000008: Not set .... .... .... .... .... .... .... .1.. = Request Target: Set .... .... .... .... .... .... .... ..0. = Negotiate OEM: Not set .... .... .... .... .... .... .... ...1 = Negotiate UNICODE: Set Native OS: Linux version 3.10-0.bpo.2-amd64 Native LAN Manager: CIFS VFS Client for Linux