Wireshark · Ethereal-users: [Ethereal-users] Re: More info than frame size???

[ronnie sahlberg <ronniesahlberg@xxxxxxxxx>]

Can you send an example capture that displays this issue.


On 6/18/05, Michael D. Berger <m.d.berger@xxxxxxxx> wrote:
> On RH, I have been capturing http packets with tethereal
> and examining them with ethereal.  In one obvious buffer
> overflow attack I found:
> 
>    Frame size = 1506
>    IP total length = 1492
>    NTLMSSP data size = 1044
> 
> The hex dump shows the NTLMSSP to be in >addition< to the
> ethernet frame size, which to me, does not make sense.
> The tethereal filter is:
>    tcp port 80
> There are continuation packets, but they do not contain
> the correct information.
> 
> Thanks for your help,
> Mike.
> 
> --
> Michael D. Berger
> m.d.berger@xxxxxxxx 
> 
> 
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>