Count the credential bytes
02The request carries two length-prefixed byte strings. Each length counts the following field’s octets, not the whole request or the number of displayed characters.
All five fields now fill offsets 0–16. Each length covers only its following payload, and the password remains cleartext.
Source for this drawing: RFC 1929 · Read RFC section 2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Read VER, ULEN, exactly ULEN username octets, PLEN, then exactly PLEN password octets.
- An octet is an eight-bit byte. The request fields in order are VER(1 octet), ULEN(1), UNAME(1–255), PLEN(1), PASSWD(1–255). VER is hexadecimal 01 (§2). There is no total-length field in this request.
- ULEN counts only the following username field; PLEN counts only the following password field. UNAME is the username as known to the source operating system, and PASSWD is its associated password. The RFC does not prescribe a universal text encoding or Unicode normalization.
- The fictional ASCII example uses username picnic (6 octets) and password blanket! (8 octets): 01 06 70 69 63 6E 69 63 08 62 6C 61 6E 6B 65 74 21. The complete request has 3+6+8=17 octets, offsets 0–16.
- ULEN is at offset 1; username is offsets 2–7; PLEN is at 2+ULEN=8; password is offsets 9–16. ASCII values are a chosen example, not a required character set. No terminator or delimiter byte is inserted between these fields.
- Field widths in this chapter are proportional to actual example octet counts. Longer examples later use explicitly labeled size schematics. These request bytes include a readable password: encoding the fields does not encrypt them.
All data is fictional. Offsets are zero-based. The drawing progressively reveals the same 17-octet request, rather than sending four copies.
Read the RFC section ↗