diff --git a/src/analyzer/protocol/gssapi/gssapi-analyzer.pac b/src/analyzer/protocol/gssapi/gssapi-analyzer.pac
index e502fff923..a913441f1d 100644
--- a/src/analyzer/protocol/gssapi/gssapi-analyzer.pac
+++ b/src/analyzer/protocol/gssapi/gssapi-analyzer.pac
@@ -36,12 +36,11 @@ refine connection GSSAPI_Conn += {
 		%}
 }
 
-refine typeattr GSSAPI_NEG_TOKEN_INIT_Arg_Data += &let {
-	fwd: bool = $context.connection.forward_ntlm(mech_token, true) &if(index==2); 
+refine typeattr GSSAPI_NEG_TOKEN_MECH_TOKEN += &let {
+	fwd: bool = $context.connection.forward_ntlm(mech_token, is_orig);
 };
 
 refine typeattr GSSAPI_NEG_TOKEN_RESP_Arg += &let {
 	proc: bool = $context.connection.proc_gssapi_neg_result(this) &if(seq_meta.index==0);
-	fwd: bool = $context.connection.forward_ntlm(response_token, false) &if(seq_meta.index==2);
 };
 
diff --git a/src/analyzer/protocol/gssapi/gssapi-protocol.pac b/src/analyzer/protocol/gssapi/gssapi-protocol.pac
index 67a84ceb0b..024d480f35 100644
--- a/src/analyzer/protocol/gssapi/gssapi-protocol.pac
+++ b/src/analyzer/protocol/gssapi/gssapi-protocol.pac
@@ -30,7 +30,7 @@ type GSSAPI_NEG_TOKEN_INIT_Arg = record {
 type GSSAPI_NEG_TOKEN_INIT_Arg_Data(index: uint8) = case index of {
 	0 -> mech_type_list : ASN1Encoding;
 	1 -> req_flags      : ASN1Encoding;
-	2 -> mech_token     : bytestring &restofdata;
+	2 -> mech_token     : GSSAPI_NEG_TOKEN_MECH_TOKEN(true);
 	3 -> mech_list_mic  : ASN1OctetString;
 };
 
@@ -44,7 +44,12 @@ type GSSAPI_NEG_TOKEN_RESP_Arg = record {
 	args     : case seq_meta.index of {
 		0       -> neg_state      : ASN1Integer;
 		1       -> supported_mech : ASN1Encoding;
-		2       -> response_token : bytestring &restofdata;
+		2       -> response_token : GSSAPI_NEG_TOKEN_MECH_TOKEN(false);
 		3       -> mech_list_mic  : ASN1OctetString;
 	} &length=seq_meta.length;
 };
+
+type GSSAPI_NEG_TOKEN_MECH_TOKEN(is_orig: bool) = record {
+	meta       : ASN1EncodingMeta;
+	mech_token : bytestring &length=meta.length;
+};
diff --git a/src/analyzer/protocol/ntlm/ntlm-protocol.pac b/src/analyzer/protocol/ntlm/ntlm-protocol.pac
index 6f5fef29b9..471a124301 100644
--- a/src/analyzer/protocol/ntlm/ntlm-protocol.pac
+++ b/src/analyzer/protocol/ntlm/ntlm-protocol.pac
@@ -1,6 +1,5 @@
 
 type NTLM_SSP_Token(is_orig: bool) = record {
-	meta        : ASN1EncodingMeta;
 	signature   : bytestring &length=8;
 	msg_type    : uint32;
 	msg         : case msg_type of {