SPNEGO tokens are used only for the Client-Server Authentication Exchange (the AP_REQ and AP_REP Kerberos messages) between the client and service. The AP_REP the Kerberos client sends to the Kerberos service contains a service ticket encrypted with the service’s secret key. To view this data decrypted, you must import the service’s keytab to Wireshark. The messages sent between the client and the KDC to acquire TGTs and service tickets are not covered by SPNEGO. If you do not yet have a keytab file for your Kerberos service, create one by running the following command on the Windows Domain Controller: ktpass -princ -pass ****** -out wireshark.keytab -ptype KRB5_NT_PRINCIPALįor example: ktpass -princ -pass ****** -out wireshark.keytab -ptype KRB5_NT_PRINCIPAL Import a Kerberos service keytab file into Wireshark #Wireshark search for string how to#įor information on how to view these messages in Wireshark, see Use Wireshark to trace Authentication Service Exchange and Ticket-Granting Service Exchange. In Wireshark, click Edit > Preferences > Protocols > KRB5.Ĭlick Browse, and select the keytab file of your Kerberos service. Select Try to decrypt Kerberos blobs, and click Apply.

Start a Wireshark capture with the following filter: ip.addr= and kerberosįor example: ip.addr=10.142.9.178 and kerberos If you have the Kerberos client and Kerberos service running on separate machines, run Wireshark on the same machine as the Kerberos client. Send a message from the Kerberos client to the Kerberos service. The Kerberos client calls the Kerberos service on the configured path (for example, POST /service in the Wireshark trace details). Select one of the POST / lines in the top panel, and open the Hypertext Transfer Protocol in the lower panel.