Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.
Wireshark logo

Display Filter Reference: NTLM Secure Service Provider

Protocol field name: ntlmssp

Versions: 1.0.0 to 4.2.4

Back to Display Filter Reference

Field name Description Type Versions
ntlmssp.auth.domainDomain nameCharacter string1.0.0 to 4.2.4
ntlmssp.auth.hostnameHost nameCharacter string1.0.0 to 4.2.4
ntlmssp.auth.lmresponseLan Manager ResponseByte sequence1.0.0 to 4.2.4
ntlmssp.auth.ntresponseNTLM ResponseByte sequence1.0.0 to 4.2.4
ntlmssp.auth.sesskeySession KeyByte sequence1.0.0 to 4.2.4
ntlmssp.auth.usernameUser nameCharacter string1.0.0 to 4.2.4
ntlmssp.authenticate.micMICByte sequence1.4.1 to 4.2.4
ntlmssp.authenticatedAuthenticated NTHASHLabel3.4.0 to 4.2.4
ntlmssp.blob.lengthLengthUnsigned integer (16 bits)1.0.0 to 4.2.4
ntlmssp.blob.length.too_longSession blob length too longLabel1.12.0 to 4.2.4
ntlmssp.blob.maxlenMaxlenUnsigned integer (16 bits)1.0.0 to 4.2.4
ntlmssp.blob.offsetOffsetUnsigned integer (32 bits)1.0.0 to 4.2.4
ntlmssp.challenge.addresslistAddress ListLabel1.0.0 to 1.4.15
ntlmssp.challenge.addresslist.domaindnsDomain DNS NameCharacter string1.0.0 to 1.4.15
ntlmssp.challenge.addresslist.domainnbDomain NetBIOS NameCharacter string1.0.0 to 1.4.15
ntlmssp.challenge.addresslist.item.contentTarget item ContentCharacter string1.0.0 to 1.4.15
ntlmssp.challenge.addresslist.item.lengthTarget item LengthUnsigned integer (16 bits)1.0.0 to 1.4.15
ntlmssp.challenge.addresslist.lengthLengthUnsigned integer (16 bits)1.0.0 to 1.4.15
ntlmssp.challenge.addresslist.maxlenMaxlenUnsigned integer (16 bits)1.0.0 to 1.4.15
ntlmssp.challenge.addresslist.offsetOffsetUnsigned integer (32 bits)1.0.0 to 1.4.15
ntlmssp.challenge.addresslist.serverdnsServer DNS NameCharacter string1.0.0 to 1.4.15
ntlmssp.challenge.addresslist.servernbServer NetBIOS NameCharacter string1.0.0 to 1.4.15
ntlmssp.challenge.addresslist.terminatorList TerminatorLabel1.0.0 to 1.4.15
ntlmssp.challenge.domainDomainCharacter string1.0.0 to 1.4.0
ntlmssp.challenge.target_infoTarget InfoLabel1.6.0 to 4.2.4
ntlmssp.challenge.target_info.channel_bindingsChannel BindingsByte sequence1.6.0 to 4.2.4
ntlmssp.challenge.target_info.dns_computer_nameDNS Computer NameCharacter string1.6.0 to 4.2.4
ntlmssp.challenge.target_info.dns_domain_nameDNS Domain NameCharacter string1.6.0 to 4.2.4
ntlmssp.challenge.target_info.dns_tree_nameDNS Tree NameCharacter string1.6.0 to 4.2.4
ntlmssp.challenge.target_info.endList EndLabel1.6.0 to 4.2.4
ntlmssp.challenge.target_info.flagsFlagsUnsigned integer (32 bits)1.6.0 to 4.2.4
ntlmssp.challenge.target_info.item.lengthTarget Info Item LengthUnsigned integer (16 bits)1.6.0 to 4.2.4
ntlmssp.challenge.target_info.item.typeTarget Info Item TypeUnsigned integer (16 bits)1.6.0 to 4.2.4
ntlmssp.challenge.target_info.lengthLengthUnsigned integer (16 bits)1.6.0 to 4.2.4
ntlmssp.challenge.target_info.maxlenMaxlenUnsigned integer (16 bits)1.6.0 to 4.2.4
ntlmssp.challenge.target_info.nb_computer_nameNetBIOS Computer NameCharacter string1.6.0 to 4.2.4
ntlmssp.challenge.target_info.nb_domain_nameNetBIOS Domain NameCharacter string1.6.0 to 4.2.4
ntlmssp.challenge.target_info.offsetOffsetUnsigned integer (32 bits)1.6.0 to 4.2.4
ntlmssp.challenge.target_info.restrictionsRestrictionsByte sequence1.6.0 to 4.2.4
ntlmssp.challenge.target_info.target_nameTarget NameCharacter string1.6.0 to 4.2.4
ntlmssp.challenge.target_info.timestampTimestampDate and time1.6.0 to 4.2.4
ntlmssp.challenge.target_nameTarget NameCharacter string1.4.1 to 4.2.4
ntlmssp.decrypted_payloadNTLM Decrypted PayloadByte sequence1.0.0 to 1.8.15
ntlmssp.identifierNTLMSSP identifierCharacter string1.0.0 to 4.2.4
ntlmssp.messagetypeNTLM Message TypeUnsigned integer (32 bits)1.0.0 to 4.2.4
ntlmssp.messagetype.unknownUnrecognized NTLMSSP MessageLabel2.0.0 to 4.2.4
ntlmssp.negotiate.callingworkstationCalling workstation nameCharacter string1.0.0 to 4.2.4
ntlmssp.negotiate.callingworkstation.bufferCalling workstation name bufferUnsigned integer (32 bits)1.0.0 to 1.8.15
ntlmssp.negotiate.callingworkstation.maxlenCalling workstation name max lengthUnsigned integer (16 bits)1.0.0 to 1.8.15
ntlmssp.negotiate.callingworkstation.strlenCalling workstation name lengthUnsigned integer (16 bits)1.0.0 to 1.8.15
ntlmssp.negotiate.domainCalling workstation domainCharacter string1.0.0 to 4.2.4
ntlmssp.negotiate.domain.bufferCalling workstation domain bufferUnsigned integer (32 bits)1.0.0 to 1.8.15
ntlmssp.negotiate.domain.maxlenCalling workstation domain max lengthUnsigned integer (16 bits)1.0.0 to 1.8.15
ntlmssp.negotiate.domain.strlenCalling workstation domain lengthUnsigned integer (16 bits)1.0.0 to 1.8.15
ntlmssp.negotiate00000008Request 0x00000008Boolean1.0.0 to 4.0.14
ntlmssp.negotiate00000100Negotiate 0x00000100Boolean1.2.0 to 4.0.14
ntlmssp.negotiate00000400Negotiate 0x00000400Boolean1.0.0 to 1.0.16
ntlmssp.negotiate00000800Negotiate 0x00000800Boolean1.2.0 to 1.10.14
ntlmssp.negotiate00004000Negotiate 0x00004000Boolean1.2.0 to 4.0.14
ntlmssp.negotiate128Negotiate 128Boolean1.0.0 to 4.2.4
ntlmssp.negotiate56Negotiate 56Boolean1.0.0 to 4.2.4
ntlmssp.negotiatealwayssignNegotiate Always SignBoolean1.0.0 to 4.2.4
ntlmssp.negotiateanonymousNegotiate AnonymousBoolean1.0.0 to 1.0.16, 1.12.0 to 4.2.4
ntlmssp.negotiatechallengeacceptresponseNegotiate Challenge Accept ResponseBoolean1.0.0 to 1.0.16
ntlmssp.negotiatechallengeinitresponseNegotiate Challenge Init ResponseBoolean1.0.0 to 1.0.16
ntlmssp.negotiatechallengenonntsessionkeyNegotiate Challenge Non NT Session KeyBoolean1.0.0 to 1.0.16
ntlmssp.negotiatedatagramNegotiate DatagramBoolean1.2.0 to 4.2.4
ntlmssp.negotiatedatagramstyleNegotiate Datagram StyleBoolean1.0.0 to 1.0.16
ntlmssp.negotiatedomainsuppliedNegotiate Domain SuppliedBoolean1.0.0 to 1.0.16
ntlmssp.negotiateextendedsessionsecurityNegotiate Extended Session SecurityBoolean4.2.0 to 4.2.4
ntlmssp.negotiateflagsNegotiate FlagsUnsigned integer (32 bits)1.0.0 to 4.2.4
ntlmssp.negotiateidentifyNegotiate IdentifyBoolean1.2.0 to 4.2.4
ntlmssp.negotiatekeyexchNegotiate Key ExchangeBoolean1.0.0 to 4.2.4
ntlmssp.negotiatelmkeyNegotiate Lan Manager KeyBoolean1.0.0 to 4.2.4
ntlmssp.negotiatenetwareNegotiate NetwareBoolean1.0.0 to 1.0.16
ntlmssp.negotiatent00100000Negotiate 0x00100000Boolean1.0.0 to 1.0.16
ntlmssp.negotiatent00200000Negotiate 0x00200000Boolean1.0.0 to 4.0.14
ntlmssp.negotiatent00400000Negotiate 0x00400000Boolean1.0.0 to 1.0.16
ntlmssp.negotiatent01000000Negotiate 0x01000000Boolean1.0.0 to 4.0.14
ntlmssp.negotiatent02000000Negotiate 0x02000000Boolean1.0.0 to 1.0.16
ntlmssp.negotiatent04000000Negotiate 0x04000000Boolean1.0.0 to 4.0.14
ntlmssp.negotiatent08000000Negotiate 0x08000000Boolean1.0.0 to 4.0.14
ntlmssp.negotiatent10000000Negotiate 0x10000000Boolean1.0.0 to 4.0.14
ntlmssp.negotiatentlmNegotiate NTLM keyBoolean1.0.0 to 4.2.4
ntlmssp.negotiatentlm2Negotiate Extended SecurityBoolean1.0.0 to 4.0.14
ntlmssp.negotiatentonlyNegotiate NT OnlyBoolean1.2.0 to 4.0.14
ntlmssp.negotiateoemNegotiate OEMBoolean1.0.0 to 4.2.4
ntlmssp.negotiateoemdomainsuppliedNegotiate OEM Domain SuppliedBoolean1.2.0 to 4.2.4
ntlmssp.negotiateoemworkstationsuppliedNegotiate OEM Workstation SuppliedBoolean1.2.0 to 4.2.4
ntlmssp.negotiatesealNegotiate SealBoolean1.0.0 to 4.2.4
ntlmssp.negotiatesignNegotiate SignBoolean1.0.0 to 4.2.4
ntlmssp.negotiatetargetinfoNegotiate Target InfoBoolean1.0.0 to 4.2.4
ntlmssp.negotiatethisislocalcallNegotiate This is Local CallBoolean1.0.0 to 1.0.16
ntlmssp.negotiateunicodeNegotiate UNICODEBoolean1.0.0 to 4.2.4
ntlmssp.negotiateversionNegotiate VersionBoolean1.2.0 to 4.2.4
ntlmssp.negotiateworkstationsuppliedNegotiate Workstation SuppliedBoolean1.0.0 to 1.0.16
ntlmssp.NTLM_REMOTE_SUPPLEMENTAL_CREDENTIALNTLM_REMOTE_SUPPLEMENTAL_CREDENTIALLabel3.6.0 to 4.2.4
ntlmssp.NTLM_REMOTE_SUPPLEMENTAL_CREDENTIAL.CredentialKeyCredentialKeyByte sequence3.6.0 to 4.2.4
ntlmssp.NTLM_REMOTE_SUPPLEMENTAL_CREDENTIAL.CredentialKeyTypeCredentialKeyTypeUnsigned integer (32 bits)3.6.0 to 4.2.4
ntlmssp.NTLM_REMOTE_SUPPLEMENTAL_CREDENTIAL.CREDKEY_PRESENTcredkey_presentBoolean3.6.0 to 4.2.4
ntlmssp.NTLM_REMOTE_SUPPLEMENTAL_CREDENTIAL.EncryptedCredsEncryptedCredsByte sequence3.6.0 to 4.2.4
ntlmssp.NTLM_REMOTE_SUPPLEMENTAL_CREDENTIAL.EncryptedCredsSizeEncryptedCredsSizeUnsigned integer (32 bits)3.6.0 to 4.2.4
ntlmssp.NTLM_REMOTE_SUPPLEMENTAL_CREDENTIAL.FlagsFlagsUnsigned integer (32 bits)3.6.0 to 4.2.4
ntlmssp.NTLM_REMOTE_SUPPLEMENTAL_CREDENTIAL.LM_PRESENTlm_presentBoolean3.6.0 to 4.2.4
ntlmssp.NTLM_REMOTE_SUPPLEMENTAL_CREDENTIAL.NT_PRESENTnt_presentBoolean3.6.0 to 4.2.4
ntlmssp.NTLM_REMOTE_SUPPLEMENTAL_CREDENTIAL.REMOVEDremovedBoolean3.6.0 to 4.2.4
ntlmssp.NTLM_REMOTE_SUPPLEMENTAL_CREDENTIAL.SHA_PRESENTsha_presentBoolean3.6.0 to 4.2.4
ntlmssp.NTLM_REMOTE_SUPPLEMENTAL_CREDENTIAL.VersionVersionUnsigned integer (32 bits)3.6.0 to 4.2.4
ntlmssp.ntlmchallengeNTLM ChallengeByte sequence1.0.0 to 1.2.18
ntlmssp.ntlmclientchallengeLMv2 Client ChallengeByte sequence1.4.0 to 4.2.4
ntlmssp.ntlmserverchallengeNTLM Server ChallengeByte sequence1.4.0 to 4.2.4
ntlmssp.ntlmv2_responseNTLMv2 ResponseByte sequence1.6.0 to 4.2.4
ntlmssp.ntlmv2_response.chalNTLMv2 Client ChallengeByte sequence1.6.0 to 4.2.4
ntlmssp.ntlmv2_response.channel_bindingsChannel BindingsByte sequence1.6.0 to 4.2.4
ntlmssp.ntlmv2_response.dns_computer_nameDNS Computer NameCharacter string1.6.0 to 4.2.4
ntlmssp.ntlmv2_response.dns_domain_nameDNS Domain NameCharacter string1.6.0 to 4.2.4
ntlmssp.ntlmv2_response.dns_tree_nameDNS Tree NameCharacter string1.6.0 to 4.2.4
ntlmssp.ntlmv2_response.endList EndLabel1.6.0 to 4.2.4
ntlmssp.ntlmv2_response.flagsFlagsUnsigned integer (32 bits)1.6.0 to 4.2.4
ntlmssp.ntlmv2_response.headerHeaderUnsigned integer (32 bits)1.6.0 to 1.10.14
ntlmssp.ntlmv2_response.hirversionHi Response VersionUnsigned integer (8 bits)1.12.0 to 4.2.4
ntlmssp.ntlmv2_response.hmacHMACByte sequence1.6.0 to 1.10.14
ntlmssp.ntlmv2_response.item.lengthNTLMV2 Response Item LengthUnsigned integer (16 bits)1.6.0 to 4.2.4
ntlmssp.ntlmv2_response.item.typeNTLMV2 Response Item TypeUnsigned integer (16 bits)1.6.0 to 4.2.4
ntlmssp.ntlmv2_response.nb_computer_nameNetBIOS Computer NameCharacter string1.6.0 to 4.2.4
ntlmssp.ntlmv2_response.nb_domain_nameNetBIOS Domain NameCharacter string1.6.0 to 4.2.4
ntlmssp.ntlmv2_response.ntproofstrNTProofStrByte sequence1.12.0 to 4.2.4
ntlmssp.ntlmv2_response.padpaddingByte sequence1.12.0 to 4.2.4
ntlmssp.ntlmv2_response.reservedReservedUnsigned integer (32 bits)1.6.0 to 1.10.14
ntlmssp.ntlmv2_response.restrictionsRestrictionsByte sequence1.6.0 to 4.2.4
ntlmssp.ntlmv2_response.rversionResponse VersionUnsigned integer (8 bits)1.12.0 to 4.2.4
ntlmssp.ntlmv2_response.target_nameTarget NameCharacter string1.6.0 to 4.2.4
ntlmssp.ntlmv2_response.timeTimeDate and time1.6.0 to 4.2.4
ntlmssp.ntlmv2_response.timestampTimestampDate and time1.6.0 to 4.2.4
ntlmssp.ntlmv2_response.unknownUnknownUnsigned integer (32 bits)1.6.0 to 1.10.14
ntlmssp.ntlmv2_response.zZByte sequence1.12.0 to 4.2.4
ntlmssp.ntlmv2responseNTLMv2 ResponseByte sequence1.0.0 to 1.4.15
ntlmssp.ntlmv2response.chalClient challengeByte sequence1.0.0 to 1.4.15
ntlmssp.ntlmv2response.client_timeClient TimeDate and time1.0.0 to 1.4.15
ntlmssp.ntlmv2response.headerHeaderUnsigned integer (32 bits)1.0.0 to 1.4.15
ntlmssp.ntlmv2response.hmacHMACByte sequence1.0.0 to 1.4.15
ntlmssp.ntlmv2response.nameAttributeCharacter string1.0.0 to 1.4.15
ntlmssp.ntlmv2response.name.lenValue lenUnsigned integer (32 bits)1.0.0 to 1.4.15
ntlmssp.ntlmv2response.name.restrictionsEncoding restrictionsByte sequence1.4.0 to 1.4.15
ntlmssp.ntlmv2response.name.typeAttribute typeUnsigned integer (32 bits)1.0.0 to 1.4.15
ntlmssp.ntlmv2response.reservedReservedUnsigned integer (32 bits)1.0.0 to 1.4.15
ntlmssp.ntlmv2response.timeTimeDate and time1.0.0 to 1.4.15
ntlmssp.ntlmv2response.unknownUnknownUnsigned integer (32 bits)1.0.0 to 1.4.15
ntlmssp.requestnonntsessionRequest Non-NT SessionBoolean1.2.0 to 4.0.14
ntlmssp.requestnonntsessionkeyRequest Non-NT Session KeyBoolean4.2.0 to 4.2.4
ntlmssp.requesttargetRequest TargetBoolean1.0.0 to 4.2.4
ntlmssp.reservedReservedByte sequence1.0.0 to 4.2.4
ntlmssp.sessionbasekeySessionBaseKeyLabel3.4.0 to 4.2.4
ntlmssp.sessionkeySessionKeyLabel3.4.0 to 4.2.4
ntlmssp.string.lengthLengthUnsigned integer (16 bits)1.0.0 to 4.2.4
ntlmssp.string.maxlenMaxlenUnsigned integer (16 bits)1.0.0 to 4.2.4
ntlmssp.string.offsetOffsetUnsigned integer (32 bits)1.0.0 to 4.2.4
ntlmssp.target_info_attr.invalidInvalid NTLMSSP Target Info AvPairsLabel3.6.2 to 4.2.4
ntlmssp.target_info_attr.unknownUnknown NTLMSSP Target Info AttributeLabel1.12.0 to 4.2.4
ntlmssp.targetitemtypeTarget item typeUnsigned integer (16 bits)1.0.0 to 1.4.15
ntlmssp.targettypedomainTarget Type DomainBoolean1.2.0 to 4.2.4
ntlmssp.targettypeserverTarget Type ServerBoolean1.2.0 to 4.2.4
ntlmssp.targettypeshareTarget Type ShareBoolean1.2.0 to 4.0.14
ntlmssp.unused00000008Request 0x00000008Boolean4.2.0 to 4.2.4
ntlmssp.unused00000100Negotiate 0x00000100Boolean4.2.0 to 4.2.4
ntlmssp.unused00000400Negotiate 0x00000400Boolean4.2.0 to 4.2.4
ntlmssp.unused00004000Negotiate 0x00004000Boolean4.2.0 to 4.2.4
ntlmssp.unused00040000Negotiate 0x00040000Boolean4.2.0 to 4.2.4
ntlmssp.unused00200000Negotiate 0x00200000Boolean4.2.0 to 4.2.4
ntlmssp.unused01000000Negotiate 0x01000000Boolean4.2.0 to 4.2.4
ntlmssp.unused04000000Negotiate 0x04000000Boolean4.2.0 to 4.2.4
ntlmssp.unused08000000Negotiate 0x08000000Boolean4.2.0 to 4.2.4
ntlmssp.unused10000000Negotiate 0x10000000Boolean4.2.0 to 4.2.4
ntlmssp.v2_key_too_longNTLM v2 key is too longLabel1.12.0 to 4.2.4
ntlmssp.verfNTLMSSP VerifierLabel1.0.0 to 4.2.4
ntlmssp.verf.bodyVerifier BodyByte sequence1.0.0 to 4.2.4
ntlmssp.verf.crc32Verifier CRC32Unsigned integer (32 bits)1.0.0 to 4.2.4
ntlmssp.verf.hmacmd5HMAC MD5Byte sequence1.4.0 to 4.2.4
ntlmssp.verf.randompadRandom PadUnsigned integer (32 bits)1.4.0 to 4.2.4
ntlmssp.verf.sequenceSequenceByte sequence1.0.0 to 4.2.4
ntlmssp.verf.unknown1Unknown 1Unsigned integer (32 bits)1.0.0 to 1.2.18
ntlmssp.verf.versVersion NumberUnsigned integer (32 bits)1.0.0 to 4.2.4
ntlmssp.versionVersionLabel1.6.0 to 4.2.4
ntlmssp.version.build_numberBuild NumberUnsigned integer (16 bits)1.4.1 to 4.2.4
ntlmssp.version.majorMajor VersionUnsigned integer (8 bits)1.4.1 to 4.2.4
ntlmssp.version.minorMinor VersionUnsigned integer (8 bits)1.4.1 to 4.2.4
ntlmssp.version.ntlm_current_revisionNTLM Current RevisionUnsigned integer (8 bits)1.4.1 to 4.2.4

Wireshark logo footer

© Wireshark Foundation · Privacy Policy

Facebook·Mastodon·Twitter·YouTube