Please apply this patch (made against Wireshark 0.99.4). It defines the
NTLMSSP_NEGOTIATE_ANONYMOUS flag as described in
<http://davenport.sourceforge.net/ntlm.html>.
-marc
--- ./epan/dissectors/packet-ntlmssp.c 2006-10-31 09:58:59.000000000 -0800
+++ ./epan/dissectors/packet-ntlmssp.c.new 2006-11-29 19:24:31.765216500 -0800
@@ -95,7 +95,7 @@
#define NTLMSSP_NEGOTIATE_NETWARE 0x00000100
#define NTLMSSP_NEGOTIATE_NTLM 0x00000200
#define NTLMSSP_NEGOTIATE_00000400 0x00000400
-#define NTLMSSP_NEGOTIATE_00000800 0x00000800
+#define NTLMSSP_NEGOTIATE_ANONYMOUS 0x00000800
#define NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED 0x00001000
#define NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED 0x00002000
#define NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 0x00004000
@@ -1589,7 +1589,7 @@
{ &hf_ntlmssp_negotiate_flags_400,
{ "Negotiate 0x00000400", "ntlmssp.negotiate00000400", FT_BOOLEAN, 32,
TFS (&flags_set_truth), NTLMSSP_NEGOTIATE_00000400, "", HFILL }},
{ &hf_ntlmssp_negotiate_flags_800,
- { "Negotiate 0x00000800", "ntlmssp.negotiate00000800", FT_BOOLEAN, 32,
TFS (&flags_set_truth), NTLMSSP_NEGOTIATE_00000800, "", HFILL }},
+ { "Negotiate Anonymous", "ntlmssp.negotiateanonymous", FT_BOOLEAN, 32,
TFS (&flags_set_truth), NTLMSSP_NEGOTIATE_ANONYMOUS, "", HFILL }},
{ &hf_ntlmssp_negotiate_flags_1000,
{ "Negotiate Domain Supplied", "ntlmssp.negotiatedomainsupplied",
FT_BOOLEAN, 32, TFS (&flags_set_truth), NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED, "",
HFILL }},
{ &hf_ntlmssp_negotiate_flags_2000,