Import a Kerberos service keytab file into Wireshark For information on how to view these messages in Wireshark, see Use Wireshark to trace Authentication Service Exchange and Ticket-Granting Service Exchange.

The messages sent between the client and the KDC to acquire TGTs and service tickets are not covered by SPNEGO. To view this data decrypted, you must import the service’s keytab to Wireshark. The AP_REP the Kerberos client sends to the Kerberos service contains a service ticket encrypted with the service’s secret key.

SPNEGO tokens are used only for the Client-Server Authentication Exchange (the AP_REQ and AP_REP Kerberos messages) between the client and service. Use Wireshark to trace authentication between the client and service Wireshark can parse, decrypt, and view the content of these tokens.īecause Wireshark can trace any application acting either as the Kerberos client or service, the information in this section is applicable for both API Gateway and third-party applications. In SPNEGO Kerberos authentication, Kerberos tokens are sent between the client and service using the Authorization HTTP header. For more details on Wireshark and to download and install the program, go to Wireshark web page. You can use Wireshark, a third-party trace tool, to view the SPNEGO token data sent between a Kerberos client and service when the client authenticates to the service. Use Wireshark to view the SPNEGO token data sent between a Kerberos client and service when the client authenticates to the service.

Wireshark search for string in packets