Display LMNT tokens with the value 0xffff as "Windows NT Networking";

that's how Network Monitor displays them.  (What are they if they're not
0xffff?).

The PDC Startup announcement message, if not short, includes an LMNT
token between the NT version and LM20 token.

After the DB Count in an Announce change to UAS or SAM message there are
that number of DBChange Info Structures, according to Network Monitor;
dissect them.  After that, there is a domain SID size, and, if that size
is non-zero, a domain SID, and only then

In a SAM LOGON request, the domain SID size is a 4-byte quantity, not a
2-byte quantity, and is followed by a domain SID, an NT version, an LMNT
token, and an LM token, according to Network Monitor.

Display the NT version in decimal, as that's how Network Monitor
displays it.

svn path=/trunk/; revision=3666

0 files changed, 0 insertions, 0 deletions