Architectural Question ...

[Tony Cowan]

All good suggestions.
Apparently the packets were going back to the KDC (I assume AS) not
some other registry or service, so I'm thinking maybe it wasn't
another service. I'm leaning towards a broken implementation as the
explanation.
I'll try to have a look at the sniffed packets to see what it's trying
to do.
Are there any tools around that I might be able to use to interepret
the captured packets (I have a hex editor, but I was hoping for
something a little more "high level").
Thanks
Tc.