The following change, or something like it, will go into Wireshark in a short while

Fri Nov 10 09:11:28 UTC 2017

On Fri, Nov 10, 2017 at 07:02:30PM +1000, ronnie sahlberg via samba-technical wrote:
> LGTM

The message as such of course. Please see my comment about this being
perfectly legitimate. This is NOT a dangerous condition, it only is if
SMB1 is actually negotiated.

Or is this first packet also considered to be dangerous?

Volker

-- 
SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
phone: +49-551-370000-0, fax: +49-551-370000-9
AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen
http://www.sernet.de, mailto:kontakt at sernet.de