Ethereal: More Info Than Frame Size???

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

On RH, I have been capturing http packets with tethereal
and examining them with ethereal.  In one obvious buffer
overflow attack I found:

   Frame size = 1506
   IP total length = 1492
   NTLMSSP data size = 1044

The hex dump shows the NTLMSSP to be in >addition< to the
ethernet frame size, which to me, does not make sense.
The tethereal filter is:
   tcp port 80
There are continuation packets, but they do not contain
the correct information.

Thanks for your help,

Site Timeline