No. Time Source Destination Protocol Info 1 0.000000 1.1.1.1 2.2.2.2 SMB Negotiate Protocol Request Frame 1: 119 bytes on wire (952 bits), 119 bytes captured (952 bits) Arrival Time: Nov 22, 2010 15:48:47.422106000 Canada Central Standard Time Epoch Time: 1290462527.422106000 seconds [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 119 bytes (952 bits) Capture Length: 119 bytes (952 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:nbss:smb] [Coloring Rule Name: SMB] [Coloring Rule String: smb || nbss || nbns || nbipx || ipxsap || netbios] Ethernet II, Src: Vmware_d9:34:b6 (00:0c:29:d9:AA:BB), Dst: Vmware_25:25:6e (00:0c:29:25:XX:YY) Destination: Vmware_25:XX:YY (00:0c:29:25:XX:YY) Address: Vmware_25:XX:YY (00:0c:29:25:XX:YY) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Vmware_d9:AA:BB (00:0c:29:d9:AA:BB) Address: Vmware_d9:AA:BB (00:0c:29:d9:AA:BB) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 1.1.1.1 (1.1.1.1), Dst: 2.2.2.2 (2.2.2.2) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 105 Identification: 0x230d (8973) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0xf51c [correct] [Good: True] [Bad: False] Source: 1.1.1.1 (1.1.1.1) Destination: 2.2.2.2 (2.2.2.2) Transmission Control Protocol, Src Port: 48103 (48103), Dst Port: microsoft-ds (445), Seq: 1, Ack: 1, Len: 53 Source port: 48103 (48103) Destination port: microsoft-ds (445) [Stream index: 0] Sequence number: 1 (relative sequence number) [Next sequence number: 54 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgement: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set Window size: 46 Checksum: 0x6532 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 2240950081, TSecr 0 [SEQ/ACK analysis] [Number of bytes in flight: 53] NetBIOS Session Service Message Type: Session message Length: 49 SMB (Server Message Block Protocol) SMB Header Server Component: SMB [Response in: 2] SMB Command: Negotiate Protocol (0x72) NT Status: STATUS_SUCCESS (0x00000000) Flags: 0x18 0... .... = Request/Response: Message is a request to the server .0.. .... = Notify: Notify client only on open ..0. .... = Oplocks: OpLock not requested/granted ...1 .... = Canonicalized Pathnames: Pathnames are canonicalized .... 1... = Case Sensitivity: Path names are caseless .... ..0. = Receive Buffer Posted: Receive buffer has not been posted .... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported Flags2: 0x6845 0... .... .... .... = Unicode Strings: Strings are ASCII .1.. .... .... .... = Error Code Type: Error codes are NT error codes ..1. .... .... .... = Execute-only Reads: Permit reads if execute-only ...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs .... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported .... .... .1.. .... = Long Names Used: Path names in request are long file names .... .... .... .1.. = Security Signatures: Security signatures are supported .... .... .... ..0. = Extended Attributes: Extended attributes are not supported .... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response Process ID High: 0 Signature: 0000000000000000 Reserved: 0000 Tree ID: 0 Process ID: 12345 User ID: 0 Multiplex ID: 0 Negotiate Protocol Request (0x72) Word Count (WCT): 0 Byte Count (BCC): 14 Requested Dialects Dialect: NT LM 0.12 Buffer Format: Dialect (2) Name: NT LM 0.12 Dialect: Buffer Format: Dialect (2) Name: No. Time Source Destination Protocol Info 2 0.000300 2.2.2.2 1.1.1.1 SMB Negotiate Protocol Response Frame 2: 250 bytes on wire (2000 bits), 250 bytes captured (2000 bits) Arrival Time: Nov 22, 2010 15:48:47.422406000 Canada Central Standard Time Epoch Time: 1290462527.422406000 seconds [Time delta from previous captured frame: 0.000300000 seconds] [Time delta from previous displayed frame: 0.000300000 seconds] [Time since reference or first frame: 0.000300000 seconds] Frame Number: 2 Frame Length: 250 bytes (2000 bits) Capture Length: 250 bytes (2000 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:nbss:smb:gss-api:spnego] [Coloring Rule Name: SMB] [Coloring Rule String: smb || nbss || nbns || nbipx || ipxsap || netbios] Ethernet II, Src: Vmware_25:XX:YY (00:0c:29:25:XX:YY), Dst: Vmware_d9:AA:BB (00:0c:29:d9:AA:BB) Destination: Vmware_d9:AA:BB (00:0c:29:d9:AA:BB) Address: Vmware_d9:AA:BB (00:0c:29:d9:AA:BB) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Vmware_25:XX:YY (00:0c:29:25:XX:YY) Address: Vmware_25:XX:YY (00:0c:29:25:XX:YY) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 2.2.2.2 (2.2.2.2), Dst: 1.1.1.1 (1.1.1.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 236 Identification: 0x1fe9 (8169) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (6) Header checksum: 0xb7bd [correct] [Good: True] [Bad: False] Source: 2.2.2.2 (2.2.2.2) Destination: 1.1.1.1 (1.1.1.1) Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 48103 (48103), Seq: 1, Ack: 54, Len: 184 Source port: microsoft-ds (445) Destination port: 48103 (48103) [Stream index: 0] Sequence number: 1 (relative sequence number) [Next sequence number: 185 (relative sequence number)] Acknowledgement number: 54 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgement: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set Window size: 64187 Checksum: 0x2344 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3082205, TSecr 2240950081 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 1] [The RTT to ACK the segment was: 0.000300000 seconds] [Number of bytes in flight: 184] NetBIOS Session Service Message Type: Session message Length: 180 SMB (Server Message Block Protocol) SMB Header Server Component: SMB [Response to: 1] [Time from request: 0.000300000 seconds] SMB Command: Negotiate Protocol (0x72) NT Status: STATUS_SUCCESS (0x00000000) Flags: 0x98 1... .... = Request/Response: Message is a response to the client/redirector .0.. .... = Notify: Notify client only on open ..0. .... = Oplocks: OpLock not requested/granted ...1 .... = Canonicalized Pathnames: Pathnames are canonicalized .... 1... = Case Sensitivity: Path names are caseless .... ..0. = Receive Buffer Posted: Receive buffer has not been posted .... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported Flags2: 0x6845 0... .... .... .... = Unicode Strings: Strings are ASCII .1.. .... .... .... = Error Code Type: Error codes are NT error codes ..1. .... .... .... = Execute-only Reads: Permit reads if execute-only ...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs .... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported .... .... .1.. .... = Long Names Used: Path names in request are long file names .... .... .... .1.. = Security Signatures: Security signatures are supported .... .... .... ..0. = Extended Attributes: Extended attributes are not supported .... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response Process ID High: 0 Signature: 0000000000000000 Reserved: 0000 Tree ID: 0 Process ID: 12345 User ID: 0 Multiplex ID: 0 Negotiate Protocol Response (0x72) Word Count (WCT): 17 Dialect Index: 0: NT LM 0.12 Security Mode: 0x0f .... ...1 = Mode: USER security mode .... ..1. = Password: ENCRYPTED password. Use challenge/response .... .1.. = Signatures: Security signatures ENABLED .... 1... = Sig Req: Security signatures REQUIRED Max Mpx Count: 10 Max VCs: 1 Max Buffer Size: 4356 Max Raw Buffer: 65536 Session Key: 0x00000000 Capabilities: 0x8000e3fd .... .... .... .... .... .... .... ...1 = Raw Mode: Read Raw and Write Raw are supported .... .... .... .... .... .... .... ..0. = MPX Mode: Read Mpx and Write Mpx are not supported .... .... .... .... .... .... .... .1.. = Unicode: Unicode strings are supported .... .... .... .... .... .... .... 1... = Large Files: Large files are supported .... .... .... .... .... .... ...1 .... = NT SMBs: NT SMBs are supported .... .... .... .... .... .... ..1. .... = RPC Remote APIs: RPC remote APIs are supported .... .... .... .... .... .... .1.. .... = NT Status Codes: NT status codes are supported .... .... .... .... .... .... 1... .... = Level 2 Oplocks: Level 2 oplocks are supported .... .... .... .... .... ...1 .... .... = Lock and Read: Lock and Read is supported .... .... .... .... .... ..1. .... .... = NT Find: NT Find is supported .... .... .... .... ...0 .... .... .... = Dfs: Dfs is not supported .... .... .... .... ..1. .... .... .... = Infolevel Passthru: NT information level request passthrough is supported .... .... .... .... .1.. .... .... .... = Large ReadX: Large Read andX is supported .... .... .... .... 1... .... .... .... = Large WriteX: Large Write andX is supported .... .... 0... .... .... .... .... .... = UNIX: UNIX extensions are not supported .... ..0. .... .... .... .... .... .... = Reserved: Reserved ..0. .... .... .... .... .... .... .... = Bulk Transfer: Bulk Read and Bulk Write are not supported .0.. .... .... .... .... .... .... .... = Compressed Data: Compressed data transfer is not supported 1... .... .... .... .... .... .... .... = Extended Security: Extended security exchanges are supported System Time: Nov 22, 2010 15:48:47.418634500 Canada Central Standard Time Server Time Zone: 360 min from UTC Key Length: 0 Byte Count (BCC): 111 Server GUID: 3ca9593c3bfe2043ac2671eb380a3eaa Security Blob: 605d06062b0601050502a0533051a030302e06092a864882... GSS-API Generic Security Service Application Program Interface OID: 1.3.6.1.5.5.2 (SPNEGO - Simple Protected Negotiation) Simple Protected Negotiation negTokenInit mechTypes: 4 items MechType: 1.2.840.48018.1.2.2 (MS KRB5 - Microsoft Kerberos 5) MechType: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) MechType: 1.2.840.113554.1.2.2.3 (KRB5 - Kerberos 5 - User to User) MechType: 1.3.6.1.4.1.311.2.2.10 (NTLMSSP - Microsoft NTLM Security Support Provider) mechListMIC: 301ba0191b17697473642d73656375726974797870244046... principal: itsd-securityxp$@FCC.CA