using the Linux mount.cifs commands to mount remote smb shares uses ntlm as default.
Since samba 3.6 the default for smbclient has changed to ntlmv2 as default.
This shlould also be the case with mount.cifs
The auth method to use when one isn't specified is decided by the kernel.
NTLMv2 encapsulated within NTLMSSP wrapper has been the default since v3.8. Are you running an earlier kernel than that?
Client defaults to NTLMv2 (in ntlmssp usually) - we don't send in ntlm unless specifically requested on mount.