Ethereal-users: [Ethereal-users] More info than frame size???

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Michael D. Berger" <m.d.berger@xxxxxxxx>
Date: Sat, 18 Jun 2005 09:56:19 -0400
On RH, I have been capturing http packets with tethereal
and examining them with ethereal.  In one obvious buffer
overflow attack I found:

   Frame size = 1506
   IP total length = 1492
   NTLMSSP data size = 1044

The hex dump shows the NTLMSSP to be in >addition< to the
ethernet frame size, which to me, does not make sense.
The tethereal filter is:
   tcp port 80
There are continuation packets, but they do not contain
the correct information.

Thanks for your help,
Mike.

--
Michael D. Berger
m.d.berger@xxxxxxxx