Setup: I have a simple test setup: PC (Win7) and Server (Win Server 2008) and I open a VPN tunnel between the two of them via PPTP (encrypted with MPPE 128). The server has a shared folder that the client can access and manipulate.
Scenario: I now eavesdropped on the resulting communication via Wireshark and expected the data to be encrypted. However, I was able to see both, the shared folder access requests/responses (that for example contained the files name in the folder) as well as the actual file content, when I for example changed the content and saved it.
Question: Are the contents actually transfered in plaintext within SMB2 despite the encrypted VPN tunnel or can I simply see the contents because the client that is editing the files is also the one running Wireshark and an external attacker could not?