2.2.4.14.1 NTLM_AUTH Structure

  • Article

The NTLM_AUTH structure is defined as follows:


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

Zero

One

Reserved1

NTLMTokenSize

Two

Reserved2

NTLMToken (variable)

...

Zero (4 bytes): A 32-bit field. This field MUST be set to 0x00000000.

One (4 bytes): An unsigned 32-bit integer. This field MUST be set to 0x00000001.

Reserved1 (4 bytes): A 32-bit field. This field is unused and MUST be ignored when parsing the message.

NTLMTokenSize (4 bytes): An unsigned 32-bit integer. This field specifies the size of the NTLMToken field, in bytes.

Two (4 bytes): An unsigned 32-bit integer. This field MUST be set to 0x00000002.

Reserved2 (4 bytes): A 32-bit field. This field is unused and MUST be ignored when parsing the message.

NTLMToken (variable): A variable size array of bytes. This field must be set to the NTLM challenge token or response token, as appropriate. These tokens are defined in [MS-NLMP].