Monitoring Kerberos Authentication Traffic

Question

I had developed an application that uses Windows Authentication in order to authenticate users in single hop. Then I developed this application in order to authenticate users again with Windows Authentication but being able for multi hop.

The multi hop scenario is working well. I have a computer A (client app), a computer B (IIS server) and a computer C (OLAP server).

When I am trying to monitor the network packages with Microsoft Network Monitor v3.4 in computer A (client server), I do not see any Kerberos v5 protocol packages. I see some GSSAPI Authentication in some other HTTP and TCP connection protocols though the monitor. So when may I see the Kerberos v5 protocol in monitoring tool?

To make the question more complex, does Kerberos v5 protocol used for exchange tickets beside client - KCD in Domain Controller and then the client uses this ticket though HTTP or TCP, is this what is happening?

Answer 1

So when may I see the Kerberos v5 protocol in monitoring tool?

Take a closer look at the GSSAPI traffic.

GSSAPI provides an interface to Generic Security Services. Kerberos v5 is one of the Security Services supported by GSSAPI. While it is possible to write code that directly exchanges Kerberos v5 traffic, it is common for systems that use "Kerberos v5" to implement it via GSSAPI.

This is in agreement with the Kerberos documentation, which says (in the Developing with GSSAPI chapter): "We recommend using the GSSAPI [...] for secure network communication over using the libkrb5 API directly."

Summary: we can't be 100% sure without seeing your traffic, but probably the GSSAPI traffic you see is handling the Kerberos 5 mechanism.