Are we aware of NEGOEX?

[Richard Sharpe]

On Thu, Jun 28, 2012 at 6:44 AM, Richard Sharpe
<realrichardsharpe at gmail.com> wrote:
> Hi folks,
>
> In an SMB2 packet capture at Sharkfest I saw a new OID in the SPNEGO stuff.
>
> It turned out to be this:
> http://msdn.microsoft.com/en-us/library/gg567315%28v=PROT.10%29.aspx
>
> The Windows client was only offering NEGOEX and NTLMSSP.
>
> More info here: http://tools.ietf.org/id/draft-zhu-negoex-02.txt and
> here http://msdn.microsoft.com/en-us/library/cc247030%28v=PROT.13%29.aspx
>
> If I get the time soon I might implement a dissector for NEGOEX ...
> which will help with the implementation.

There is now a NEGOEX dissector for Wireshark. It should turn up in
released versions in a while.

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)