The following change, or something like it, will go into Wireshark in a short while

Volker Lendecke Volker.Lendecke at SerNet.DE
Fri Nov 10 09:09:59 UTC 2017

On Wed, Nov 08, 2017 at 08:17:44AM -0800, Richard Sharpe via samba-technical wrote:
> We will be putting something like the following (see the screen shot)
> change into Wireshark soon.
> If you want me to tweak the wording, let me know.

Please do that at a higher level. The initial SMB1 negotiate request
is perfectly legitimate. In you screenshot, you can see that the
server directly replies with a SMB2 packet. Please only print this
message in case it's not the very first full SMB packet in the TCP


SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
phone: +49-551-370000-0, fax: +49-551-370000-9
AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen, mailto:kontakt at

More information about the samba-technical mailing list