Celebrate National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

AD auth & Wireshark

Posted on 2010-11-18
8
Medium Priority
?
1,009 Views
Last Modified: 2012-05-10
Hi

My domain is kamuk.com and is AD 2008. I have a Windows 2008 server that runs ApplicationA... to log onto it, it's supposed to carry out a query against AD so that I can use my AD username and password.

This doesn't seem to be working. I would like to check whether ApplicationA is even querying AD.

I guess the best way to do this would be to run Wireshark whilst attempting to log on? We have several DC's in our site, so I can't filter by all their IP addresses, so I think destination port would be easiest. Should I check for either 386 or 3268?

If so, which one is used for authentication?

Any help appreciated
0
Comment
Question by:kam_uk
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
8 Comments
 
LVL 57

Accepted Solution

by:
Mike Kline earned 2000 total points
ID: 34169917
You can install it on the application server and filter for ports 389 (LDAP) and 3268 (GC) to look for lookups against a DC.  You can also filter on the DC IP address

ip.dst==192.168.0.0/16 (just an example) or ip.dst==ipaddresshere

Thanks

Mike
0
 
LVL 3

Author Comment

by:kam_uk
ID: 34171952
Thanks Mike.

So if there is no traffic to port 389/3268, then there is no AD lookup taking place?

And which particular port does it use (or does it use both) for authentication for an application?
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 34173270
Authentication uses kerberos, (port 88).  Yeah so no ports 389 and 3268s at all from the server?
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
LVL 3

Author Comment

by:kam_uk
ID: 34173332
Hi

Nope, nothing on 389 or 3268..I guess a prob with the app then?

Out of interest -

1. Should I also be checking for port 88 (which isn't there anyway)?

2. Should it be port 389 OR 3268, or port 386 AND 3268? I mean, does the app use both or one of them?

3. If one of the two ports, then what defines which?

Thanks again!
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 34173414
389 is just the LDAP lookup where 3268 will search the GC.  It depends on the application, odd you ar not seeing any traffic on any ports.
0
 
LVL 3

Author Comment

by:kam_uk
ID: 34173680
Thanks again, I'm still a little confused on whether the app would use 389 or 3268 to be honest. All the app needs to do is verify someone's AD credentials to allow them access to the app.....in a multidomain forest...so would it use both, or just one?

I think there's a problem with the app where it's not querying AD for whatever reason?
0
 
LVL 3

Author Comment

by:kam_uk
ID: 34347017
Any idea, Mike?
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 34351617
Not sure, I would have expected the app to use one of the ports (LDAP or the GC).  What does the capture show.

Thanks

Mike

0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
Compliance and data security require steps be taken to prevent unauthorized users from copying data.  Here's one method to prevent data theft via USB drives (and writable optical media).
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question