# Concepts

### SMB

While analysing SMB pakcets in wireshark we can use filter \` `ntlmssp.challenge.target_name`&#x20;

NTLM (NT LAN Manager) is a Microsoft authentication protocol that uses a 3-step challenge-response mechanism:

1. **Negotiate (Type 1)**: Client → Server\
   Client proposes capabilities.
2. **Challenge (Type 2)**: Server → Client\
   Server responds with a challenge, including the `target_name`.
3. **Authenticate (Type 3)**: Client → Server\
   Client responds with credentials hashed using the challenge.

#### What is `ntlmssp.challenge.target_name`?

* **`ntlmssp.challenge`** refers to the Type 2 challenge message.
* **`target_name`** is a field within this message that indicates the **authentication realm or domain** that the server expects the client to authenticate against.

