server client ________________________________________________________________________ # authorization request FF FD 25 FF FB 01 FF FD 03 FF FD 1F FF FD 00 FF FB 00 # ready to authenticate myself FF FB 25 # ready to get NTLM auth FF FA 25 01 0F 00 FF F0 FF FD 01 FF FB 03 FF FB 1F FF FA 1F 00 50 00 19 FF F0 FF FB 00 FF FD 00 # authentication, NTLM FF FA 25 00 0F 00 --- 00 20 00 00 00 02 00 00 00 === 4E 54 4C 4D 53 53 50 00 01 00 00 00 97 82 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 === FF F0 # authorization response, NTLM ... FF FA 25 02 0F 00 --- 01 62 00 00 00 02 00 00 00 === 4E 54 4C 4D 53 53 50 00 02 00 00 00 # domain size and shift 06 00 06 00 30 00 00 00 95 82 82 C0 # nonce EB CD 1C 54 E3 E4 66 0A 00 00 00 00 00 00 00 00 # size and shift of info block after domain part 2C 00 2C 00 36 00 00 00 42 00 45 00 45 00 02 00 06 00 42 00 45 00 45 00 01 00 06 00 42 00 45 00 45 00 04 00 06 00 62 00 65 00 65 00 03 00 06 00 62 00 65 00 65 00 00 00 00 00 === FF F0 # authentication continue, NTLM ... FF FA 25 00 0F 00 --- 02 A6 00 00 00 02 00 00 00 === 4E 54 4C 4D 53 53 50 00 03 00 00 00 # LM part size and shift 18 00 18 00 66 00 00 00 # NT part size and shift 18 00 18 00 7E 00 00 00 # domain part size and shift 06 00 06 00 40 00 00 00 # user part size and shift 1A 00 1A 00 46 00 00 00 # host part size and shift 06 00 06 00 60 00 00 00 # additional info after NT and LM parts part size and shift 10 00 10 00 96 00 00 00 # flags 95 82 80 C0 # domain, user, host 42 00 45 00 45 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 42 00 45 00 45 00 # LM response C2 A0 52 5D 7A C5 66 B3 9E 58 B3 E3 09 EE 88 1B C8 65 B7 08 F2 F1 AD 54 # NT response 91 36 10 30 31 00 55 E2 82 0D 55 B4 98 BC 27 76 4B 36 BF 51 16 D0 FC 6A # unknown additional info 83 3D 88 20 F1 97 47 83 1F A1 39 9E C2 71 3B 2E === FF F0 # authorization info, NTLM ... FF FA 25 02 0F 00 --- 03 === === FF F0 # termianl type request FF FD 18 # ready to set terminal type FF FB 18 # ready to get terminal type FF FA 18 01 FF F0 # termial type is ANSI FF FA 18 00 41 4E 53 49 FF F0