Capture Network Traffic Using Wireshark

Problem

You need to capture low-level network traffic to troubleshoot an issue (e.g. Kerberos SSO).

Download and install Wireshark on a workstation where the problem is occuring.

Download either the 32 or 64-bit "Windows Installer" for Wireshark from https://www.wireshark.org/download.html
Install Wireshark on the workstation as an administrator. Choose to install the WinPcap module during the Wireshark install.
Download the zip file containing PistolStar's Kerberos utilities from box.com: https://app.box.com/s/yxeeg4tunkt2z94cv8r4jtwddlqm1agp
- NOTE: If you are unable to download from box.com, the KerbUtil.zip file is also attached to this KB (link).
Unzip the "klist.exe" program from the KerbUtil.zip file and copy it to the root of the C:\ drive. When run, this utility will clear out any cached Kerberos service tickets.
Launch a Command Prompt as an administrator and type "cd \" then 'Enter' to change to the root directory of the C: drive.
Run the following commands in the Command Prompt:
- ipconfig /FlushDNS
- NBTStat -R
- klist.exe purge
Launch Wireshark, then choose the Capture -> Start menu item. If prompted, choose the appropriate interface ("Ethernet" is typically the LAN/wired connection).
Open a web browser and reproduce the failure
When complete, stop the trace using the red square icon in the Wireshark toolbar:
Press Ctrl-S to save the trace as a .pcapng file.
Email this .pcapng file to us or attach it to the ticket in the support portal.