Capture Auth Packes with WireShark¶
Sometimes it is required by firstname.lastname@example.org to capture the packets on the wire to better understand what is going on and why authentication is failing. Please use the following steps to make a capture.
Ensure time is synced between your domain joined machine, domain controller and proxy that fails authentication.
Ensure your browser points to your proxy by FQDN and not by IP address.
Close all browsers on your workstation
In command prompt on your workstation type
klist purge. It will delete all your Kerberos tickets. If you type
klistagain it should say
Cached Tickets: (0).
Choose Start, type Credentials Manager and clear every stored records for your proxy in Windows Credentials.
Start Wireshark on your workstation, open browser and type www.google.com
After connection is finished (successfully or not), close the browser, stop wireshark capture, save it and zip it.
Send the archive to email@example.com.