Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I often use openssl s_client to test and debug SSL connections (to LDAPS or HTTPS services). It allows me to isolate the problem down to SSL, without anything getting in the way.

I want to do something similar with Kerberos. I would like to use a small test, which would show :

  1. The initial machine logon (the computer account)
  2. The initial AS request from the user requesting a service
  3. The kerberos exchange of the user getting a ticket
  4. (optional) the request being sent to the service

I can do steps 1, 2 and 3 if I run Wireshark on a KDC, but it is usually not an option. I can manage to capture steps 2, 3 and 4 if I monitor trafic on the client.

Is there tool that would allow me to capture the every Kerberos login steps starting with the computer account, without running Wireshark on the KDC ?

share|improve this question
I'm sorry but I don't understand what you expect to see in Wireshark if you don't actually send the request. – Ryan Ries Dec 14 '12 at 2:34
The exchange with the KDC – ixe013 Dec 14 '12 at 2:35
So run Wireshark. Purge your tickets. Reauthenticate. Stop your Wireshark trace. Profit. – Ryan Ries Dec 14 '12 at 2:38
I read the question as being about a tool to initiate an authentication from the command line. – rackandboneman Dec 14 '12 at 2:45
net stop netlogon & net start netlogon. That will do it. – Ryan Ries Dec 14 '12 at 2:52
up vote 3 down vote accepted

I'll go ahead and submit my previous comments as an answer. I hope it's what the OP wanted.

As you already know, you can use klist.exe to purge your Kerberos tickets.

So fire up Wireshark and start a trace. Then purge your Kerberos tickets. Then in a command prompt, type net stop netlogon & net start netlogon. (Or do something like try to access a network file share.) That will cause the computer to request new Kerberos tickets from the KDC/Domain Controller. Now stop your Wireshark trace. You have successfully captured a network trace containing the interaction between domain member and domain controller.

share|improve this answer
That is what I was looking for. It never occurred to me that I could restart the netlogon service. From server_A, I use net view \\server_B I get the trace I need. – ixe013 Dec 14 '12 at 4:00

Update: this answer is *nix specific and the question is about windows. Leaving it in for future reference, just in case.

You can use:

  • kdestroy to wipe out your old tickets
  • kinit to request a TGT
  • kvno to request a ticket for a service, e.g. kvno host/$(hostname -f)

Oh, and klist does not let you purge the cache. It shows what tickets you have obtained.

share|improve this answer
The question should be clearer, but the asker is talking about a Windows host (windows-server-2008 tag), not a Unix-like. Klist.exe certainly does allow you to purge the cache. – jgoldschrafe Dec 14 '12 at 4:40
Haha, sorry, didn't notice the tag. I thought something doesn't add up. – chutz Dec 14 '12 at 4:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.