This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Malformed NTLM packet

0

Hey all!

I'm receiving a Malformed Packet (Exception Occurred) error while trying to do an NTLMSSP AUTH over SMB2 using Wireshark 2.0.1 (see capture below).

I do not receive the malformed packet error on Wireshark 1.12.1 despite the data being identical. In either case, however, I receive an NT STATUS INVALID PARAMETER from the server I'm trying to authenticate anonymously with, and I think that sorting out the Wireshark issue will help me diagnose and fix that problem!

Here's the capture with the malformed error (packet 4) on Wireshark 2.0.1: https://www.cloudshark.org/captures/aa9cb95e985a

And here is the same capture on Wireshark 1.12.1. This shows the correct structure for the packet (number 4) (though it is still rejected by the server): https://www.cloudshark.org/captures/7aa8a2eea803

I'd really appreciate any help!

asked 02 Feb '16, 11:12

matthewbird's gravatar image

matthewbird
6113
accept rate: 0%

edited 02 Feb '16, 11:16