@@ -55,30 +55,30 @@ The issue is related to getting Kerberos Tickets for a Server Message Block (SMB
5555Here's an example of a network trace:
5656
5757``` output
58- 1534 CLIENT1 DC1.ADATUM.COM TCP TCP:Flags=......S., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=0, Seq=1299628969, Ack=0
59- 1537 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A..S., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785282675, Ack=1299628970
60- 1538 CLIENT1 DC1.ADATUM.COM TCP TCP:Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=0, Seq=1299628970, Ack=2785282676
61- 1539 CLIENT1 DC1.ADATUM.COM KerberosV5 KerberosV5:TGS Request Realm: ADATUM.COM Sname: cifs/DC1.ADATUM.COM
62- 1540 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785282676, Ack=1299628970
63- 1541 CLIENT1 DC1.ADATUM.COM TCP TCP:[ReTransmit #1539]Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=1460, Seq=1299628970 - 1299630430, Ack=2785282676
64- 1542 CLIENT1 DC1.ADATUM.COM TCP TCP:[ReTransmit #1539]Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=1460, Seq=1299628970 - 1299630430, Ack=2785282676
65- 1545 CLIENT1 DC1.ADATUM.COM TCP TCP:[ReTransmit #1539]Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=536, Seq=1299628970 - 1299629506, Ack=2785282676
66- 1546 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785282676, Ack=1299629506
67- 1547 CLIENT1 DC1.ADATUM.COM TCP TCP:[Continuation to #0]Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=536, Seq=1299629506 - 1299630042, Ack=2785282676
68- 1548 CLIENT1 DC1.ADATUM.COM TCP TCP:[Continuation to #0]Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=536, Seq=1299630042 - 1299630578, Ack=2785282676
69- 1549 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785282676, Ack=1299630042
70- 1550 CLIENT1 DC1.ADATUM.COM TCP TCP:[Continuation to #0]Flags=...AP..., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=536, Seq=1299630578 - 1299631114, Ack=2785282676
71- 1551 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785282676, Ack=1299630738
72- 1552 CLIENT1 DC1.ADATUM.COM KerberosV5 KerberosV5: {TCP:267, IPv4:5}
73- 1553 DC1.ADATUM.COM CLIENT1 TCP TCP:[Continuation to #0]Flags=...AP..., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=290, Seq=2785284136 - 2785284426, Ack=1299630738
74- 1554 CLIENT1 DC1.ADATUM.COM TCP TCP:Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=0, Seq=1299632186, Ack=2785282676
75- 1555 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785284426, Ack=1299631114
76- 1556 CLIENT1 DC1.ADATUM.COM TCP TCP:[Continuation to #1552]Flags=...AP..., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=320, Seq=1299632186 - 1299632506, Ack=2785282676
77- 1557 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785284426, Ack=1299632186
78- 1558 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785284426, Ack=1299632506
79- 1559 CLIENT1 DC1.ADATUM.COM TCP TCP:Flags=...A...F, SrcPort=59259, DstPort=Kerberos(88), PayloadLen=0, Seq=1299632506, Ack=2785282676
80- 1563 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785284136, Ack=1299632507
81- 1564 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A.R.., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785284136, Ack=1299632507
58+ 1534 CLIENT1 DC1.ADATUM.COM TCP TCP:Flags=......S., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=0, Seq=1299628969, Ack=0, Win=8192 ( ) = 8192 {TCP:267, IPv4:5}
59+ 1537 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A..S., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785282675, Ack=1299628970, Win=8192 ( Scale factor not supported ) = 8192 {TCP:267, IPv4:5}
60+ 1538 CLIENT1 DC1.ADATUM.COM TCP TCP:Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=0, Seq=1299628970, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
61+ 1539 CLIENT1 DC1.ADATUM.COM KerberosV5 KerberosV5:TGS Request Realm: ADATUM.COM Sname: cifs/DC1.ADATUM.COM {TCP:267, IPv4:5}
62+ 1540 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785282676, Ack=1299628970, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
63+ 1541 CLIENT1 DC1.ADATUM.COM TCP TCP:[ReTransmit #1539]Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=1460, Seq=1299628970 - 1299630430, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
64+ 1542 CLIENT1 DC1.ADATUM.COM TCP TCP:[ReTransmit #1539]Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=1460, Seq=1299628970 - 1299630430, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
65+ 1545 CLIENT1 DC1.ADATUM.COM TCP TCP:[ReTransmit #1539]Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=536, Seq=1299628970 - 1299629506, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
66+ 1546 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785282676, Ack=1299629506, Win=63704 (scale factor 0x0) = 63704 {TCP:267, IPv4:5}
67+ 1547 CLIENT1 DC1.ADATUM.COM TCP TCP:[Continuation to #0]Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=536, Seq=1299629506 - 1299630042, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
68+ 1548 CLIENT1 DC1.ADATUM.COM TCP TCP:[Continuation to #0]Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=536, Seq=1299630042 - 1299630578, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
69+ 1549 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785282676, Ack=1299630042, Win=63168 (scale factor 0x0) = 63168 {TCP:267, IPv4:5}
70+ 1550 CLIENT1 DC1.ADATUM.COM TCP TCP:[Continuation to #0]Flags=...AP..., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=536, Seq=1299630578 - 1299631114, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
71+ 1551 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785282676, Ack=1299630738, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
72+ 1552 CLIENT1 DC1.ADATUM.COM KerberosV5 KerberosV5: {TCP:267, IPv4:5}
73+ 1553 DC1.ADATUM.COM CLIENT1 TCP TCP:[Continuation to #0]Flags=...AP..., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=290, Seq=2785284136 - 2785284426, Ack=1299630738, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
74+ 1554 CLIENT1 DC1.ADATUM.COM TCP TCP:Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=0, Seq=1299632186, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
75+ 1555 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785284426, Ack=1299631114, Win=63864 (scale factor 0x0) = 63864 {TCP:267, IPv4:5}
76+ 1556 CLIENT1 DC1.ADATUM.COM TCP TCP:[Continuation to #1552]Flags=...AP..., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=320, Seq=1299632186 - 1299632506, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
77+ 1557 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785284426, Ack=1299632186, Win=62792 (scale factor 0x0) = 62792 {TCP:267, IPv4:5}
78+ 1558 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785284426, Ack=1299632506, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
79+ 1559 CLIENT1 DC1.ADATUM.COM TCP TCP:Flags=...A...F, SrcPort=59259, DstPort=Kerberos(88), PayloadLen=0, Seq=1299632506, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
80+ 1563 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785284136, Ack=1299632507, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
81+ 1564 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A.R.., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785284136, Ack=1299632507, Win=0 (scale factor 0x0) = 0 {TCP:267, IPv4:5}
8282```
8383
8484From the trace, you can find the DC doesn't respond to the Ticket Granting Service (TGS) request from the client for the Service Principal Name (SPN) ` CIFS/DC1.ADATUM.COM ` . It sends back a TCP acknowledgment, which suggests the DC received the TGS request. However, it doesn't reply with a valid TGS response. Finally, the client terminates the TCP connection.
0 commit comments