Wireshark-bugs: [Wireshark-bugs] [Bug 5712] New: Does not decode KRB5 for AS REP using Windows 7
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5712
Summary: Does not decode KRB5 for AS REP using Windows 7
Product: Wireshark
Version: 1.4.3
Platform: Other
OS/Version: Windows 7
Status: NEW
Severity: Major
Priority: Low
Component: TShark
AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
ReportedBy: mattsmess2002@xxxxxxxxx
Build Information:
Version 1.4.3 (SVN Rev 35482 from /trunk-1.4)
Copyright 1998-2011 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (32-bit) with GTK+ 2.16.6, with GLib 2.22.4, with WinPcap (version
unknown), with libz 1.2.3, without POSIX capabilities, without libpcre, with
SMI
0.4.8, with c-ares 1.7.1, with Lua 5.1, without Python, with GnuTLS 2.8.5, with
Gcrypt 1.4.5, with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built
Jan
11 2011), with AirPcap.
Running on 32-bit Windows 7, build 7600, with WinPcap version 4.1.2 (packet.dll
version 4.1.0.2001), based on libpcap version 1.0 branch 1_0_rel0b (20091008),
GnuTLS 2.8.5, Gcrypt 1.4.5, without AirPcap.
Built using Microsoft Visual C++ 9.0 build 30729
--
When running a capture for a Kerberos key request and response, Wireshark
decodes the request, but will not decode the response. I can manually decode
the packet once the trace is stopped, but that won't allow my automated parsing
tool to parse for the packet in the trace.
Also, the decode cannot be saved.
Basically the procedure to reproduce this would require a device that uses a
security association with a provisioning server, a provisioning server, and a
KDC. Reset the keys in the device and provision it. Capture the process and
the key request (AS REQ) decodes as KRB5 as expected. The response (AS REP)
appears as a UDP packet, not expected. Wireshark decodes these packets
correctly using Windows XP.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
