Wireshark · Ethereal-users: [Ethereal-users] More info than frame size???

["Michael D. Berger" <m.d.berger@xxxxxxxx>]

On RH, I have been capturing http packets with tethereal
and examining them with ethereal.  In one obvious buffer
overflow attack I found:

   Frame size = 1506
   IP total length = 1492
   NTLMSSP data size = 1044

The hex dump shows the NTLMSSP to be in >addition< to the
ethernet frame size, which to me, does not make sense.
The tethereal filter is:
   tcp port 80
There are continuation packets, but they do not contain
the correct information.

Thanks for your help,
Mike.

--
Michael D. Berger
m.d.berger@xxxxxxxx