Wireshark
the world's foremost network protocol analyzer
Display Filter Reference: NTLM Secure Service Provider
Protocol field name: ntlmssp
Versions: 1.0.0 to 1.6.5
Back to Display Filter Reference
| Field name | Type | Description | Versions |
|---|---|---|---|
| ntlmssp.auth.domain | Character string | Domain name | 1.0.0 to 1.6.5 |
| ntlmssp.auth.hostname | Character string | Host name | 1.0.0 to 1.6.5 |
| ntlmssp.auth.lmresponse | Sequence of bytes | Lan Manager Response | 1.0.0 to 1.6.5 |
| ntlmssp.auth.ntresponse | Sequence of bytes | NTLM Response | 1.0.0 to 1.6.5 |
| ntlmssp.auth.sesskey | Sequence of bytes | Session Key | 1.0.0 to 1.6.5 |
| ntlmssp.auth.username | Character string | User name | 1.0.0 to 1.6.5 |
| ntlmssp.authenticate.mic | Sequence of bytes | MIC | 1.4.1 to 1.6.5 |
| ntlmssp.blob.length | Unsigned integer, 2 bytes | Length | 1.0.0 to 1.6.5 |
| ntlmssp.blob.maxlen | Unsigned integer, 2 bytes | Maxlen | 1.0.0 to 1.6.5 |
| ntlmssp.blob.offset | Unsigned integer, 4 bytes | Offset | 1.0.0 to 1.6.5 |
| ntlmssp.challenge.addresslist | Label | Address List | 1.0.0 to 1.4.11 |
| ntlmssp.challenge.addresslist.domaindns | Character string | Domain DNS Name | 1.0.0 to 1.4.11 |
| ntlmssp.challenge.addresslist.domainnb | Character string | Domain NetBIOS Name | 1.0.0 to 1.4.11 |
| ntlmssp.challenge.addresslist.item.content | Character string | Target item Content | 1.0.0 to 1.4.11 |
| ntlmssp.challenge.addresslist.item.length | Unsigned integer, 2 bytes | Target item Length | 1.0.0 to 1.4.11 |
| ntlmssp.challenge.addresslist.length | Unsigned integer, 2 bytes | Length | 1.0.0 to 1.4.11 |
| ntlmssp.challenge.addresslist.maxlen | Unsigned integer, 2 bytes | Maxlen | 1.0.0 to 1.4.11 |
| ntlmssp.challenge.addresslist.offset | Unsigned integer, 4 bytes | Offset | 1.0.0 to 1.4.11 |
| ntlmssp.challenge.addresslist.serverdns | Character string | Server DNS Name | 1.0.0 to 1.4.11 |
| ntlmssp.challenge.addresslist.servernb | Character string | Server NetBIOS Name | 1.0.0 to 1.4.11 |
| ntlmssp.challenge.addresslist.terminator | Label | List Terminator | 1.0.0 to 1.4.11 |
| ntlmssp.challenge.domain | Character string | Domain | 1.0.0 to 1.4.0 |
| ntlmssp.challenge.target_info | Label | Target Info | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_info.channel_bindings | Sequence of bytes | Channel Bindings | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_info.dns_computer_name | Character string | DNS Computer Name | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_info.dns_domain_name | Character string | DNS Domain Name | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_info.dns_tree_name | Character string | DNS Tree Name | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_info.end | Label | List End | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_info.flags | Unsigned integer, 4 bytes | Flags | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_info.item.length | Unsigned integer, 2 bytes | Target Info Item Length | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_info.item.type | Unsigned integer, 2 bytes | Target Info Item Type | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_info.length | Unsigned integer, 2 bytes | Length | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_info.maxlen | Unsigned integer, 2 bytes | Maxlen | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_info.nb_computer_name | Character string | NetBIOS Computer Name | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_info.nb_domain_name | Character string | NetBIOS Domain Name | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_info.offset | Unsigned integer, 4 bytes | Offset | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_info.restrictions | Sequence of bytes | Restrictions | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_info.target_name | Character string | Target Name | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_info.timestamp | Date and time | Timestamp | 1.6.0 to 1.6.5 |
| ntlmssp.challenge.target_name | Character string | Target Name | 1.4.1 to 1.6.5 |
| ntlmssp.decrypted_payload | Sequence of bytes | NTLM Decrypted Payload | 1.0.0 to 1.6.5 |
| ntlmssp.identifier | Character string | NTLMSSP identifier | 1.0.0 to 1.6.5 |
| ntlmssp.messagetype | Unsigned integer, 4 bytes | NTLM Message Type | 1.0.0 to 1.6.5 |
| ntlmssp.negotiate.callingworkstation | Character string | Calling workstation name | 1.0.0 to 1.6.5 |
| ntlmssp.negotiate.callingworkstation.buffer | Unsigned integer, 4 bytes | Calling workstation name buffer | 1.0.0 to 1.6.5 |
| ntlmssp.negotiate.callingworkstation.maxlen | Unsigned integer, 2 bytes | Calling workstation name max length | 1.0.0 to 1.6.5 |
| ntlmssp.negotiate.callingworkstation.strlen | Unsigned integer, 2 bytes | Calling workstation name length | 1.0.0 to 1.6.5 |
| ntlmssp.negotiate.domain | Character string | Calling workstation domain | 1.0.0 to 1.6.5 |
| ntlmssp.negotiate.domain.buffer | Unsigned integer, 4 bytes | Calling workstation domain buffer | 1.0.0 to 1.6.5 |
| ntlmssp.negotiate.domain.maxlen | Unsigned integer, 2 bytes | Calling workstation domain max length | 1.0.0 to 1.6.5 |
| ntlmssp.negotiate.domain.strlen | Unsigned integer, 2 bytes | Calling workstation domain length | 1.0.0 to 1.6.5 |
| ntlmssp.negotiate00000008 | Boolean | Request 0x00000008 | 1.0.0 to 1.6.5 |
| ntlmssp.negotiate00000100 | Boolean | Negotiate 0x00000100 | 1.2.0 to 1.6.5 |
| ntlmssp.negotiate00000400 | Boolean | Negotiate 0x00000400 | 1.0.0 to 1.0.16 |
| ntlmssp.negotiate00000800 | Boolean | Negotiate 0x00000800 | 1.2.0 to 1.6.5 |
| ntlmssp.negotiate00004000 | Boolean | Negotiate 0x00004000 | 1.2.0 to 1.6.5 |
| ntlmssp.negotiate128 | Boolean | Negotiate 128 | 1.0.0 to 1.6.5 |
| ntlmssp.negotiate56 | Boolean | Negotiate 56 | 1.0.0 to 1.6.5 |
| ntlmssp.negotiatealwayssign | Boolean | Negotiate Always Sign | 1.0.0 to 1.6.5 |
| ntlmssp.negotiateanonymous | Boolean | Negotiate Anonymous | 1.0.0 to 1.0.16 |
| ntlmssp.negotiatechallengeacceptresponse | Boolean | Negotiate Challenge Accept Response | 1.0.0 to 1.0.16 |
| ntlmssp.negotiatechallengeinitresponse | Boolean | Negotiate Challenge Init Response | 1.0.0 to 1.0.16 |
| ntlmssp.negotiatechallengenonntsessionkey | Boolean | Negotiate Challenge Non NT Session Key | 1.0.0 to 1.0.16 |
| ntlmssp.negotiatedatagram | Boolean | Negotiate Datagram | 1.2.0 to 1.6.5 |
| ntlmssp.negotiatedatagramstyle | Boolean | Negotiate Datagram Style | 1.0.0 to 1.0.16 |
| ntlmssp.negotiatedomainsupplied | Boolean | Negotiate Domain Supplied | 1.0.0 to 1.0.16 |
| ntlmssp.negotiateflags | Unsigned integer, 4 bytes | Flags | 1.0.0 to 1.6.5 |
| ntlmssp.negotiateidentify | Boolean | Negotiate Identify | 1.2.0 to 1.6.5 |
| ntlmssp.negotiatekeyexch | Boolean | Negotiate Key Exchange | 1.0.0 to 1.6.5 |
| ntlmssp.negotiatelmkey | Boolean | Negotiate Lan Manager Key | 1.0.0 to 1.6.5 |
| ntlmssp.negotiatenetware | Boolean | Negotiate Netware | 1.0.0 to 1.0.16 |
| ntlmssp.negotiatent00100000 | Boolean | Negotiate 0x00100000 | 1.0.0 to 1.0.16 |
| ntlmssp.negotiatent00200000 | Boolean | Negotiate 0x00200000 | 1.0.0 to 1.6.5 |
| ntlmssp.negotiatent00400000 | Boolean | Negotiate 0x00400000 | 1.0.0 to 1.0.16 |
| ntlmssp.negotiatent01000000 | Boolean | Negotiate 0x01000000 | 1.0.0 to 1.6.5 |
| ntlmssp.negotiatent02000000 | Boolean | Negotiate 0x02000000 | 1.0.0 to 1.0.16 |
| ntlmssp.negotiatent04000000 | Boolean | Negotiate 0x04000000 | 1.0.0 to 1.6.5 |
| ntlmssp.negotiatent08000000 | Boolean | Negotiate 0x08000000 | 1.0.0 to 1.6.5 |
| ntlmssp.negotiatent10000000 | Boolean | Negotiate 0x10000000 | 1.0.0 to 1.6.5 |
| ntlmssp.negotiatentlm | Boolean | Negotiate NTLM key | 1.0.0 to 1.6.5 |
| ntlmssp.negotiatentlm2 | Boolean | Negotiate Extended Security | 1.0.0 to 1.6.5 |
| ntlmssp.negotiatentonly | Boolean | Negotiate NT Only | 1.2.0 to 1.6.5 |
| ntlmssp.negotiateoem | Boolean | Negotiate OEM | 1.0.0 to 1.6.5 |
| ntlmssp.negotiateoemdomainsupplied | Boolean | Negotiate OEM Domain Supplied | 1.2.0 to 1.6.5 |
| ntlmssp.negotiateoemworkstationsupplied | Boolean | Negotiate OEM Workstation Supplied | 1.2.0 to 1.6.5 |
| ntlmssp.negotiateseal | Boolean | Negotiate Seal | 1.0.0 to 1.6.5 |
| ntlmssp.negotiatesign | Boolean | Negotiate Sign | 1.0.0 to 1.6.5 |
| ntlmssp.negotiatetargetinfo | Boolean | Negotiate Target Info | 1.0.0 to 1.6.5 |
| ntlmssp.negotiatethisislocalcall | Boolean | Negotiate This is Local Call | 1.0.0 to 1.0.16 |
| ntlmssp.negotiateunicode | Boolean | Negotiate UNICODE | 1.0.0 to 1.6.5 |
| ntlmssp.negotiateversion | Boolean | Negotiate Version | 1.2.0 to 1.6.5 |
| ntlmssp.negotiateworkstationsupplied | Boolean | Negotiate Workstation Supplied | 1.0.0 to 1.0.16 |
| ntlmssp.ntlmchallenge | Sequence of bytes | NTLM Challenge | 1.0.0 to 1.2.18 |
| ntlmssp.ntlmclientchallenge | Sequence of bytes | NTLM Client Challenge | 1.4.0 to 1.6.5 |
| ntlmssp.ntlmserverchallenge | Sequence of bytes | NTLM Server Challenge | 1.4.0 to 1.6.5 |
| ntlmssp.ntlmv2_response | Sequence of bytes | NTLMv2 Response | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.chal | Sequence of bytes | Client challenge | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.channel_bindings | Sequence of bytes | Channel Bindings | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.dns_computer_name | Character string | DNS Computer Name | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.dns_domain_name | Character string | DNS Domain Name | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.dns_tree_name | Character string | DNS Tree Name | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.end | Label | List End | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.flags | Unsigned integer, 4 bytes | Flags | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.header | Unsigned integer, 4 bytes | Header | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.hmac | Sequence of bytes | HMAC | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.item.length | Unsigned integer, 2 bytes | NTLMV2 Response Item Length | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.item.type | Unsigned integer, 2 bytes | NTLMV2 Response Item Type | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.nb_computer_name | Character string | NetBIOS Computer Name | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.nb_domain_name | Character string | NetBIOS Domain Name | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.reserved | Unsigned integer, 4 bytes | Reserved | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.restrictions | Sequence of bytes | Restrictions | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.target_name | Character string | Target Name | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.time | Date and time | Time | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.timestamp | Date and time | Timestamp | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2_response.unknown | Unsigned integer, 4 bytes | Unknown | 1.6.0 to 1.6.5 |
| ntlmssp.ntlmv2response | Sequence of bytes | NTLMv2 Response | 1.0.0 to 1.4.11 |
| ntlmssp.ntlmv2response.chal | Sequence of bytes | Client challenge | 1.0.0 to 1.4.11 |
| ntlmssp.ntlmv2response.client_time | Date and time | Client Time | 1.0.0 to 1.4.11 |
| ntlmssp.ntlmv2response.header | Unsigned integer, 4 bytes | Header | 1.0.0 to 1.4.11 |
| ntlmssp.ntlmv2response.hmac | Sequence of bytes | HMAC | 1.0.0 to 1.4.11 |
| ntlmssp.ntlmv2response.name | Character string | Attribute | 1.0.0 to 1.4.11 |
| ntlmssp.ntlmv2response.name.len | Unsigned integer, 4 bytes | Value len | 1.0.0 to 1.4.11 |
| ntlmssp.ntlmv2response.name.restrictions | Sequence of bytes | Encoding restrictions | 1.4.0 to 1.4.11 |
| ntlmssp.ntlmv2response.name.type | Unsigned integer, 4 bytes | Attribute type | 1.0.0 to 1.4.11 |
| ntlmssp.ntlmv2response.reserved | Unsigned integer, 4 bytes | Reserved | 1.0.0 to 1.4.11 |
| ntlmssp.ntlmv2response.time | Date and time | Time | 1.0.0 to 1.4.11 |
| ntlmssp.ntlmv2response.unknown | Unsigned integer, 4 bytes | Unknown | 1.0.0 to 1.4.11 |
| ntlmssp.requestnonntsession | Boolean | Request Non-NT Session | 1.2.0 to 1.6.5 |
| ntlmssp.requesttarget | Boolean | Request Target | 1.0.0 to 1.6.5 |
| ntlmssp.reserved | Sequence of bytes | Reserved | 1.0.0 to 1.6.5 |
| ntlmssp.string.length | Unsigned integer, 2 bytes | Length | 1.0.0 to 1.6.5 |
| ntlmssp.string.maxlen | Unsigned integer, 2 bytes | Maxlen | 1.0.0 to 1.6.5 |
| ntlmssp.string.offset | Unsigned integer, 4 bytes | Offset | 1.0.0 to 1.6.5 |
| ntlmssp.targetitemtype | Unsigned integer, 2 bytes | Target item type | 1.0.0 to 1.4.11 |
| ntlmssp.targettypedomain | Boolean | Target Type Domain | 1.2.0 to 1.6.5 |
| ntlmssp.targettypeserver | Boolean | Target Type Server | 1.2.0 to 1.6.5 |
| ntlmssp.targettypeshare | Boolean | Target Type Share | 1.2.0 to 1.6.5 |
| ntlmssp.verf | Label | NTLMSSP Verifier | 1.0.0 to 1.6.5 |
| ntlmssp.verf.body | Sequence of bytes | Verifier Body | 1.0.0 to 1.6.5 |
| ntlmssp.verf.crc32 | Unsigned integer, 4 bytes | Verifier CRC32 | 1.0.0 to 1.6.5 |
| ntlmssp.verf.hmacmd5 | Sequence of bytes | HMAC MD5 | 1.4.0 to 1.6.5 |
| ntlmssp.verf.randompad | Unsigned integer, 4 bytes | Random Pad | 1.4.0 to 1.6.5 |
| ntlmssp.verf.sequence | Sequence of bytes | Sequence | 1.0.0 to 1.6.5 |
| ntlmssp.verf.unknown1 | Unsigned integer, 4 bytes | Unknown 1 | 1.0.0 to 1.2.18 |
| ntlmssp.verf.vers | Unsigned integer, 4 bytes | Version Number | 1.0.0 to 1.6.5 |
| ntlmssp.version | Label | Version | 1.6.0 to 1.6.5 |
| ntlmssp.version.build_number | Unsigned integer, 2 bytes | Build Number | 1.4.1 to 1.6.5 |
| ntlmssp.version.major | Unsigned integer, 1 byte | Major Version | 1.4.1 to 1.6.5 |
| ntlmssp.version.minor | Unsigned integer, 1 byte | Minor Version | 1.4.1 to 1.6.5 |
| ntlmssp.version.ntlm_current_revision | Unsigned integer, 1 byte | NTLM Current Revision | 1.4.1 to 1.6.5 |