Frame Number: 5

geninfo General information
- num Number
- len Frame Length
- caplen Captured Length
- timestamp Captured Time
frame Frame 5: 1253 bytes on wire (10024 bits), 1253 bytes captured (10024 bits)
- frame.encap_type Encapsulation type: Ethernet (1)
- frame.time Arrival Time: Aug 16, 2005 05:41:06.779388000 Eastern Daylight Time
- frame.offset_shift Time shift for this packet: 0.000000000 seconds
- frame.time_epoch Epoch Time: 1124185266.779388000 seconds
- frame.time_delta Time delta from previous captured frame: 0.008034000 seconds
- frame.time_delta_displayed Time delta from previous displayed frame: 0.008034000 seconds
- frame.time_relative Time since reference or first frame: 0.036011000 seconds
- frame.number Frame Number: 5
- frame.len Frame Length: 1253 bytes (10024 bits)
- frame.cap_len Capture Length: 1253 bytes (10024 bits)
- frame.marked Frame is marked: False
- frame.ignored Frame is ignored: False
- frame.protocols Protocols in frame: eth:ip:udp:kerberos
- frame.coloring_rule.name Coloring Rule Name: UDP
- frame.coloring_rule.string Coloring Rule String: udp
eth Ethernet II, Src: Microsof_a7:ab:0c (00:03:ff:a7:ab:0c), Dst: Microsof_a6:ab:0c (00:03:ff:a6:ab:0c)
- eth.dst Destination: Microsof_a6:ab:0c (00:03:ff:a6:ab:0c)
  - eth.addr Address: Microsof_a6:ab:0c (00:03:ff:a6:ab:0c)
  - eth.lg .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  - eth.ig .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- eth.src Source: Microsof_a7:ab:0c (00:03:ff:a7:ab:0c)
  - eth.addr Address: Microsof_a7:ab:0c (00:03:ff:a7:ab:0c)
  - eth.lg .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  - eth.ig .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- eth.type Type: IP (0x0800)
ip Internet Protocol Version 4, Src: 10.1.12.2 (10.1.12.2), Dst: 10.5.3.1 (10.5.3.1)
- ip.version Version: 4
- ip.hdr_len Header length: 20 bytes
- ip.dsfield Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  - ip.dsfield.dscp 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  - ip.dsfield.ecn .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- ip.len Total Length: 1239
- ip.id Identification: 0x0095 (149)
- ip.flags Flags: 0x00
  - ip.flags.rb 0... .... = Reserved bit: Not set
  - ip.flags.df .0.. .... = Don't fragment: Not set
  - ip.flags.mf ..0. .... = More fragments: Not set
- ip.frag_offset Fragment offset: 0
- ip.ttl Time to live: 128
- ip.proto Protocol: UDP (17)
- ip.checksum Header checksum: 0x1279 [validation disabled]
  - ip.checksum_good Good: False
  - ip.checksum_bad Bad: False
- ip.src Source: 10.1.12.2 (10.1.12.2)
- ip.addr Source or Destination Address: 10.1.12.2 (10.1.12.2)
- ip.src_host Source Host: 10.1.12.2
- ip.host Source or Destination Host: 10.1.12.2
- ip.dst Destination: 10.5.3.1 (10.5.3.1)
- ip.addr Source or Destination Address: 10.5.3.1 (10.5.3.1)
- ip.dst_host Destination Host: 10.5.3.1
- ip.host Source or Destination Host: 10.5.3.1
- Source GeoIP: Unknown
- Destination GeoIP: Unknown
udp User Datagram Protocol, Src Port: kiosk (1061), Dst Port: kerberos (88)
- udp.srcport Source port: kiosk (1061)
- udp.dstport Destination port: kerberos (88)
- udp.port Source or Destination Port: 1061
- udp.port Source or Destination Port: 88
- udp.length Length: 1219
- udp.checksum_coverage Checksum coverage: 1219
- udp.checksum Checksum: 0x85c7 [validation disabled]
  - udp.checksum_good Good Checksum: False
  - udp.checksum_bad Bad Checksum: False
kerberos Kerberos TGS-REQ
- kerberos.pvno Pvno: 5
- kerberos.msg.type MSG Type: TGS-REQ (12)
- kerberos.padata padata: PA-TGS-REQ
  - kerberos.padata.type Type: PA-TGS-REQ (1)
    - kerberos.padata.value Value: 6e82041830820414a003020105a10302010ea20703050000... AP-REQ
      - kerberos.pvno Pvno: 5
      - kerberos.msg.type MSG Type: AP-REQ (14)
      - ber.bitstring.padding Padding: 0
      - kerberos.apoptions APOptions: 00000000
        
        kerberos.apoptions.reserved 0... .... .... .... .... .... .... .... = reserved: RESERVED bit off
        
        kerberos.apoptions.use_session_key .0.. .... .... .... .... .... .... .... = Use Session Key: Do NOT use the session key to encrypt the ticket
        
        kerberos.apoptions.mutual_required ..0. .... .... .... .... .... .... .... = Mutual required: Mutual authentication is NOT required
      - kerberos.ticket Ticket
        
        kerberos.tkt_vno Tkt-vno: 5
        
        kerberos.realm Realm: DENYDC.COM
        
        kerberos.sname Server Name (Service and Instance): krbtgt/DENYDC.COM
        
        kerberos.name_type Name-type: Service and Instance (2)
        
        kerberos.name_string Name: krbtgt
        
        kerberos.name_string Name: DENYDC.COM
        
        kerberos.ticket.enc_part enc-part rc4-hmac
        
        kerberos.etype Encryption type: rc4-hmac (23)
        
        kerberos.kvno Kvno: 2
        
        kerberos.ticket.data enc-part: 76873a46dedc5b7de4cd702aef30ae79cbd8aa172b9d167e...
      - kerberos.authenticator Authenticator des-cbc-md5
        
        kerberos.etype Encryption type: des-cbc-md5 (3)
        
        kerberos.authenticator.data Authenticator data: 60b1edf4e7433bef9d79f38bd2c9d2bb69ac0301c0f343a2...
        
        kerberos [Decrypted using: key learnt from frame 4]
        
        kerberos.Authenticator Authenticator
        
        kerberos.authenticator_vno Authenticator vno: 5
        
        kerberos.crealm Client Realm: DENYDC.COM
        
        kerberos.cname Client Name (Principal): des
        
        kerberos.name_type Name-type: Principal (1)
        
        kerberos.name_string Name: des
        
        kerberos.Checksum Checksum
        
        kerberos.checksum.type Type: md5 (7)
        
        kerberos.checksum.checksum checksum: 187177292b1b104ac72c8dbac18e5a78
        
        kerberos.cusec cusec: 11
        
        kerberos.ctime ctime: 2005-08-16 09:40:29 (UTC)
        
        kerberos.seq_number Seq Number: 197296424
- kerberos.kdc_req_body KDC_REQ_BODY
  - ber.bitstring.padding Padding: 0
  - kerberos.kdcoptions KDCOptions: 40800000 (Forwardable, Renewable)
    - kerberos.kdcoptions.forwardable .1.. .... .... .... .... .... .... .... = Forwardable: FORWARDABLE tickets are allowed/requested
    - kerberos.kdcoptions.forwarded ..0. .... .... .... .... .... .... .... = Forwarded: This is NOT a forwarded ticket
    - kerberos.kdcoptions.proxiable ...0 .... .... .... .... .... .... .... = Proxiable: Do NOT use proxiable tickets
    - kerberos.kdcoptions.proxy .... 0... .... .... .... .... .... .... = Proxy: This ticket has NOT been proxied
    - kerberos.kdcoptions.allow_postdate .... .0.. .... .... .... .... .... .... = Allow Postdate: We do NOT allow the ticket to be postdated
    - kerberos.kdcoptions.postdated .... ..0. .... .... .... .... .... .... = Postdated: This ticket is NOT postdated
    - kerberos.kdcoptions.renewable .... .... 1... .... .... .... .... .... = Renewable: This ticket is RENEWABLE
    - kerberos.kdcoptions.opt_hardware_auth .... .... ...0 .... .... .... .... .... = Opt HW Auth: False
    - kerberos.kdcoptions.constrained_delegation .... .... .... ..0. .... .... .... .... = Constrained Delegation: This is a normal request (no constrained delegation)
    - kerberos.kdcoptions.canonicalize .... .... .... ...0 .... .... .... .... = Canonicalize: This is NOT a canonicalized ticket request
    - kerberos.kdcoptions.disable_transited_check .... .... .... .... .... .... ..0. .... = Disable Transited Check: Transited checking is NOT disabled
    - kerberos.kdcoptions.renewable_ok .... .... .... .... .... .... ...0 .... = Renewable OK: We do NOT accept renewed tickets
    - kerberos.kdcoptions.enc_tkt_in_skey .... .... .... .... .... .... .... 0... = Enc-Tkt-in-Skey: Do NOT encrypt the tkt using the skey
    - kerberos.kdcoptions.renew .... .... .... .... .... .... .... ..0. = Renew: This is NOT a request to renew a ticket
    - kerberos.kdcoptions.validate .... .... .... .... .... .... .... ...0 = Validate: This is NOT a request to validate a postdated ticket
  - kerberos.realm Realm: DENYDC.COM
  - kerberos.sname Server Name (Service and Host): host/xp1.denydc.com
    - kerberos.name_type Name-type: Service and Host (3)
    - kerberos.name_string Name: host
    - kerberos.name_string Name: xp1.denydc.com
  - kerberos.till till: 2037-09-13 02:48:05 (UTC)
  - kerberos.nonce Nonce: 197296424
  - kerberos.etypes Encryption Types: rc4-hmac rc4-hmac-old rc4-md4 des-cbc-md5 des-cbc-crc rc4-hmac-exp rc4-hmac-old-exp
    - kerberos.etype Encryption type: rc4-hmac (23)
    - kerberos.etype Encryption type: rc4-hmac-old (-133)
    - kerberos.etype Encryption type: rc4-md4 (-128)
    - kerberos.etype Encryption type: des-cbc-md5 (3)
    - kerberos.etype Encryption type: des-cbc-crc (1)
    - kerberos.etype Encryption type: rc4-hmac-exp (24)
    - kerberos.etype Encryption type: rc4-hmac-old-exp (-135)