Help interpreting wireshark traces

[Rick van Rein]

Hi,

> Messing up the default keytabs would also silence my speakers immediately, since the music is served by kerberized NFS4.

Indeed, that sounds like the keytabs are fine.

> My question was about extracting the principal used for authentication from the SASL trace. This hopefully is not AD specific.

Nope.  You should be able to zoom in on the GSS-API exchange, I think I’ve done that before.  It’s loaded with OIDs that tag content, and that is actively used by WireShark.  You could compare the one that works and the one that doesn’t.  Is this failing for you?

-Rick