Improved SPNEGO dissector available in Wireshark soon

Richard Sharpe realrichardsharpe at
Sat May 31 13:33:26 MDT 2014

Hi folks,

I fixed the SPNEGO dissector at long last and the fixes have been
merged into the Wireshark git repository.

They are two fold:

1. It now correctly handles the negHints field that MS added to a
negTokenInit coming from a server in a NegotiateProtocol response.

2. It also correctly handles the mechListMIC now so that we don't
double dissect it in some cases.

These changes should turn up in a version of Wireshark in the near future.

Thanks to Simo for providing a capture that showed the second problem.

Richard Sharpe

More information about the samba-technical mailing list