On Mon, 15 Mar 2004, Alan Pinstein wrote:

> Then, the machines do respond differently:
>
> < Server: Microsoft-IIS/5.0
> < WWW-Authenticate: NTLM
> TlRMTVNTUAACAAAAAAAAADAAAAACAgAA0m1iYUfWTwsAAAAAAAAAAAAAAAAwAAAA
> ---
> > Server: Microsoft-IIS/6.0
> > WWW-Authenticate: NTLM
> TlRMTVNTUAACAAAAAAAAADgAAAACAgACW+BHzM0t6zkAAAAAAAAAAAAAAAA4AAAABQLODgAA
> AA8=

This is the NTLM "type2" message from the server, and it contains a
"challange" which is a supposedly unique/random number in each response from
a server. So it is supposed to differ. Repeated requests to the same server
will show different responses too. (Further details here:
http://davenport.sourceforge.net/ntlm.html#theType2Message)

(It could be interesting to investigate how the 'Flags' field of this differ
between these two type2 messages.)

Other than that, I have no further clues to offer!

-- 
    Daniel Stenberg -- http://curl.haxx.se/ -- http://daniel.haxx.se/
   [[ Do not send mails to this email address. They won't reach me. ]]