![\"LDAP](\"http:\/\/www.clientcyde.com\/wp-content\/uploads\/2014\/10\/LDAP-Error-300x46.png\")
<\/a><\/p>\nI’m on Windows, so I had to install 32bit Wireshark (64 bit doesn’t have Kerberos decryption). \u00a0You then need to generate a keytab file. \u00a0ktpass is installed on windows server 2012 (or it was on mine at least, earlier versions may require the support tools). \u00a0The following command will create the keytab file (the user I used was the user that was communicating with the LDAP server for the communication I was trying to debug).<\/p>\n
ktpass \/princ username@FQDNDOMAIN \/pass user-password \/crypto RC4-HMAC-NT \/ptype KRB5_NT_PRINCIPAL \/out file.name<\/pre>\nYou can then open the capture in Wireshark and go to Edit->preferences->Expand protocols on the left->select KRB5. \u00a0Then select your keytab file, and tick the ‘Try to decrypt Kerberos blobs’ check box. \u00a0Then all your encrypted frames should be decrypted. \u00a0If it doesn’t work, there are no error messages, it just doesn’t do anything.<\/p>\n
I initially tried creating the keytab using ktutil on centos (from the krb5-workstation package). \u00a0This didn’t work.<\/p>\n","protected":false},"excerpt":{"rendered":"
It turns out that LDAP is encrypted using Kerberos. \u00a0Wireshark can decrypt these frames. I’m on Windows, so I had to install 32bit Wireshark (64 bit doesn’t have Kerberos decryption). \u00a0You then need to generate a keytab file. \u00a0ktpass is installed on windows server 2012 (or it was on mine at least, earlier versions may … Continue reading Debugging LDAP with Wireshark<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59","post","type-post","status-publish","format-standard","hentry","category-wireshark"],"_links":{"self":[{"href":"https:\/\/www.clientcyde.com\/index.php?rest_route=\/wp\/v2\/posts\/59","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.clientcyde.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.clientcyde.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.clientcyde.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.clientcyde.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=59"}],"version-history":[{"count":1,"href":"https:\/\/www.clientcyde.com\/index.php?rest_route=\/wp\/v2\/posts\/59\/revisions"}],"predecessor-version":[{"id":61,"href":"https:\/\/www.clientcyde.com\/index.php?rest_route=\/wp\/v2\/posts\/59\/revisions\/61"}],"wp:attachment":[{"href":"https:\/\/www.clientcyde.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=59"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.clientcyde.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=59"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.clientcyde.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=59"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"LDAP](\"http:\/\/www.clientcyde.com\/wp-content\/uploads\/2014\/10\/LDAP-Error.png\")
<\/a><\/p>\n