Ettercap/ettercap — pull request #584 by kholia (2014-08-28 14:45:10+00:00)
Title: O5LOGON dissector fixes for stealth mode scans

Sample file is at https://github.com/kholia/ctf/raw/master/ggyy-99b3ed3ed5e2a293c697784ac94ee8c6.pcap URL.

Without this patch, we only find 4 hashes. After applying the patch we find 168 hashes!

```
$ ettercap -Tqr ggyy-99b3ed3ed5e2a293c697784ac94ee8c6.pcap | grep o5logon | wc -l
168
```

Such stealth mode scans can be done using the https://svn.nmap.org/nmap/scripts/oracle-brute-stealth.nse script.

It has been a while ;(