X-CACHECONF in cache type 0504

[Greg Hudson]

On Fri, 2010-11-19 at 12:14 -0500, Tim Alsop wrote:
> So, above looks normal. There is no padata seen suggesting that the KDC
> supports FAST, but when I look at the ticket cache I see:

The padata would be in a separate area called "encrypted
padata" (originally a Microsoft extension) which is part of the
encrypted part of the reply.  Wireshark won't be able to see it unless
it has a keytab it can use to decrypt the reply, and even then it may or
may not know how to use encrypted padata.  You may need to step through
the code to see what's going on.