> It is generally the case that Kerberos clients fetch service > tickets before attempting to connect to the services, after all. ??!?? I have not found this to be the case with the common clients. They either do a rudimentary negotiation (telnet, ftp) or other test (r-commands) before going to the KDC.