Hi,
I have a web service running in IIS on machine A, with Windows Authentication enabled and a specific user authorized - a domain account. I need to call that web service from an ASP.NET website running in IIS on machine B. When I set the application pool for my website to run under the identity of the user who is authorized on the web service on machine A, my website can call the web service. If I change the application pool identity for my web site to, say, the default application pool identity or to another domain account that is not authorized on the web service, the call from the web site to the web service fails. So, the authentication and authorization are both working.
Now I want to put a third IIS in the middle on machine C and to use the URL Rewrite IIS module and a Reverse Proxy rule to route from my website on machine A to the web service on machine B. (This is a cut-down prototype of a real world scenario where I need to use the URL Rewrite between my website and the web service.) Once I'm routing my call through the rewrite module, I get a 401 Unauthorized response from IIS on machine A.
I've used wireshark on machine C to capture the traffic between the three servers - see below. In this trace, the machine details are as follows:
172.22.20.53 is machine A - the machine running the web service
172.22.20.97 is machine B - the machine running the website that is calling the web service via the URL Rewrite on machine C
172.22.20.69 is machine C - the machine running the web site hosting the URL Rewrite
The trace is as follows:
No. Time Source Destination Protocol Length Info
1066 14.797111000 172.22.20.69 172.22.20.53 HTTP 79 HTTP/1.1 100 Continue
1067 14.797641000 172.22.20.53 172.22.20.69 HTTP/XML 320 POST /redirect1/SampleService.asmx HTTP/1.1
1068 14.797815000 172.22.20.69 172.22.20.97 HTTP/XML 320 POST /SampleService.asmx HTTP/1.1
1071 14.799521000 172.22.20.97 172.22.20.69 HTTP 103 HTTP/1.1 401 Unauthorized (text/html)
1073 14.802334000 172.22.20.69 172.22.20.53 HTTP 1609 HTTP/1.1 401 Unauthorized (text/html)
1085 14.807257000 172.22.20.69 172.22.20.53 HTTP 79 HTTP/1.1 100 Continue
1088 14.807925000 172.22.20.53 172.22.20.69 HTTP/XML 320 POST /redirect1/SampleService.asmx HTTP/1.1
1089 14.808064000 172.22.20.69 172.22.20.97 HTTP/XML 320 POST /SampleService.asmx HTTP/1.1
1092 14.810541000 172.22.20.97 172.22.20.69 HTTP 766 KRB Error: KRB5KRB_AP_ERR_MODIFIED (text/html)
1095 14.813283000 172.22.20.69 172.22.20.53 HTTP 808 KRB Error: KRB5KRB_AP_ERR_MODIFIED (text/html)
1104 14.823097000 172.22.20.69 172.22.20.53 HTTP 79 HTTP/1.1 100 Continue
1105 14.823801000 172.22.20.53 172.22.20.69 HTTP/XML 320 POST /redirect1/SampleService.asmx HTTP/1.1
1107 14.823973000 172.22.20.69 172.22.20.97 HTTP/XML 320 POST /SampleService.asmx HTTP/1.1
1110 14.824975000 172.22.20.97 172.22.20.69 HTTP 746 KRB Error: KRB5KRB_AP_ERR_MODIFIED (text/html)
1111 14.825340000 172.22.20.69 172.22.20.53 HTTP 788 KRB Error: KRB5KRB_AP_ERR_MODIFIED (text/html)
Full details of each request/response is below.
Any idea why the authentication is failing?
No. Time Source Destination Protocol Length Info
1066 14.797111000 172.22.20.69 172.22.20.53 HTTP 79 HTTP/1.1 100 Continue
Frame 1066: 79 bytes on wire (632 bits), 79 bytes captured (632 bits) on interface 0
Ethernet II, Src: Vmware_a1:3e:e6 (00:50:56:a1:3e:e6), Dst: Vmware_a1:7a:1f (00:50:56:a1:7a:1f)
Internet Protocol Version 4, Src: 172.22.20.69 (172.22.20.69), Dst: 172.22.20.53 (172.22.20.53)
Transmission Control Protocol, Src Port: 81 (81), Dst Port: 19412 (19412), Seq: 1, Ack: 236, Len: 25
Hypertext Transfer Protocol
HTTP/1.1 100 Continue\r\n
\r\n
[HTTP response 1/6]
[Next request in frame: 1067]
[Next response in frame: 1073]
No. Time Source Destination Protocol Length Info
1067 14.797641000 172.22.20.53 172.22.20.69 HTTP/XML 320 POST /redirect1/SampleService.asmx HTTP/1.1
Frame 1067: 320 bytes on wire (2560 bits), 320 bytes captured (2560 bits) on interface 0
Ethernet II, Src: Vmware_a1:7a:1f (00:50:56:a1:7a:1f), Dst: Vmware_a1:3e:e6 (00:50:56:a1:3e:e6)
Internet Protocol Version 4, Src: 172.22.20.53 (172.22.20.53), Dst: 172.22.20.69 (172.22.20.69)
Transmission Control Protocol, Src Port: 19412 (19412), Dst Port: 81 (81), Seq: 236, Ack: 26, Len: 266
[2 Reassembled TCP Segments (501 bytes): #1057(235), #1067(266)]
Hypertext Transfer Protocol
POST /redirect1/SampleService.asmx HTTP/1.1\r\n
Content-Type: application/soap+xml; charset=utf-8; action="http://tempuri.org/HelloWorld"\r\n
Host: dub-iis-t03:81\r\n
Content-Length: 266\r\n
Expect: 100-continue\r\n
Accept-Encoding: gzip, deflate\r\n
\r\n
[Full request URI: http://dub-iis-t03:81/redirect1/SampleService.asmx]
[HTTP request 2/6]
[Response in frame: 1073]
eXtensible Markup Language
No. Time Source Destination Protocol Length Info
1068 14.797815000 172.22.20.69 172.22.20.97 HTTP/XML 320 POST /SampleService.asmx HTTP/1.1
Frame 1068: 320 bytes on wire (2560 bits), 320 bytes captured (2560 bits) on interface 0
Ethernet II, Src: Vmware_a1:3e:e6 (00:50:56:a1:3e:e6), Dst: Vmware_a1:51:28 (00:50:56:a1:51:28)
Internet Protocol Version 4, Src: 172.22.20.69 (172.22.20.69), Dst: 172.22.20.97 (172.22.20.97)
Transmission Control Protocol, Src Port: 63410 (63410), Dst Port: 9995 (9995), Seq: 409, Ack: 1, Len: 266
[2 Reassembled TCP Segments (674 bytes): #1065(408), #1068(266)]
Hypertext Transfer Protocol
POST /SampleService.asmx HTTP/1.1\r\n
Connection: Keep-Alive\r\n
Content-Type: application/soap+xml; charset=utf-8; action="http://tempuri.org/HelloWorld"\r\n
Accept-Encoding: gzip, deflate\r\n
Expect: 100-continue\r\n
Host: dub-invest-d01:9995\r\n
Max-Forwards: 10\r\n
X-Original-URL: /redirect1/SampleService.asmx\r\n
X-Forwarded-For: 172.22.20.53:19412\r\n
X-ARR-LOG-ID: 107a32a7-67b0-415b-a052-815e689a15f1\r\n
Content-Length: 266\r\n
\r\n
[Full request URI: http://dub-invest-d01:9995/SampleService.asmx]
[HTTP request 1/1]
[Response in frame: 1071]
eXtensible Markup Language
No. Time Source Destination Protocol Length Info
1071 14.799521000 172.22.20.97 172.22.20.69 HTTP 103 HTTP/1.1 401 Unauthorized (text/html)
Frame 1071: 103 bytes on wire (824 bits), 103 bytes captured (824 bits) on interface 0
Ethernet II, Src: Vmware_a1:51:28 (00:50:56:a1:51:28), Dst: Vmware_a1:3e:e6 (00:50:56:a1:3e:e6)
Internet Protocol Version 4, Src: 172.22.20.97 (172.22.20.97), Dst: 172.22.20.69 (172.22.20.69)
Transmission Control Protocol, Src Port: 9995 (9995), Dst Port: 63410 (63410), Seq: 1461, Ack: 675, Len: 49
[2 Reassembled TCP Segments (1509 bytes): #1070(1460), #1071(49)]
Hypertext Transfer Protocol
HTTP/1.1 401 Unauthorized\r\n
Content-Type: text/html\r\n
Server: Microsoft-IIS/8.0\r\n
WWW-Authenticate: NTLM\r\n
WWW-Authenticate: Negotiate\r\n
X-Powered-By: ASP.NET\r\n
Date: Mon, 17 Nov 2014 15:41:11 GMT\r\n
Content-Length: 1293\r\n
\r\n
[HTTP response 1/1]
[Time since request: 0.001706000 seconds]
[Request in frame: 1068]
Line-based text data: text/html
No. Time Source Destination Protocol Length Info
1073 14.802334000 172.22.20.69 172.22.20.53 HTTP 1609 HTTP/1.1 401 Unauthorized (text/html)
Frame 1073: 1609 bytes on wire (12872 bits), 1609 bytes captured (12872 bits) on interface 0
Ethernet II, Src: Vmware_a1:3e:e6 (00:50:56:a1:3e:e6), Dst: Vmware_a1:7a:1f (00:50:56:a1:7a:1f)
Internet Protocol Version 4, Src: 172.22.20.69 (172.22.20.69), Dst: 172.22.20.53 (172.22.20.53)
Transmission Control Protocol, Src Port: 81 (81), Dst Port: 19412 (19412), Seq: 26, Ack: 502, Len: 1555
Hypertext Transfer Protocol
HTTP/1.1 401 Unauthorized\r\n
Content-Length: 1293\r\n
Content-Type: text/html\r\n
Server: Microsoft-IIS/7.5\r\n
WWW-Authenticate: NTLM\r\n
WWW-Authenticate: Negotiate\r\n
X-Powered-By: ASP.NET\r\n
X-Powered-By: ARR/2.5\r\n
X-Powered-By: ASP.NET\r\n
Date: Mon, 17 Nov 2014 15:41:11 GMT\r\n
\r\n
[HTTP response 2/6]
[Time since request: 0.004693000 seconds]
[Prev response in frame: 1066]
[Request in frame: 1067]
[Next response in frame: 1085]
Line-based text data: text/html
No. Time Source Destination Protocol Length Info
1085 14.807257000 172.22.20.69 172.22.20.53 HTTP 79 HTTP/1.1 100 Continue
Frame 1085: 79 bytes on wire (632 bits), 79 bytes captured (632 bits) on interface 0
Ethernet II, Src: Vmware_a1:3e:e6 (00:50:56:a1:3e:e6), Dst: Vmware_a1:7a:1f (00:50:56:a1:7a:1f)
Internet Protocol Version 4, Src: 172.22.20.69 (172.22.20.69), Dst: 172.22.20.53 (172.22.20.53)
Transmission Control Protocol, Src Port: 81 (81), Dst Port: 19412 (19412), Seq: 1581, Ack: 6364, Len: 25
Hypertext Transfer Protocol
HTTP/1.1 100 Continue\r\n
\r\n
[HTTP response 3/6]
[Prev request in frame: 1067]
[Prev response in frame: 1073]
[Next request in frame: 1088]
[Next response in frame: 1095]
No. Time Source Destination Protocol Length Info
1088 14.807925000 172.22.20.53 172.22.20.69 HTTP/XML 320 POST /redirect1/SampleService.asmx HTTP/1.1
Frame 1088: 320 bytes on wire (2560 bits), 320 bytes captured (2560 bits) on interface 0
Ethernet II, Src: Vmware_a1:7a:1f (00:50:56:a1:7a:1f), Dst: Vmware_a1:3e:e6 (00:50:56:a1:3e:e6)
Internet Protocol Version 4, Src: 172.22.20.53 (172.22.20.53), Dst: 172.22.20.69 (172.22.20.69)
Transmission Control Protocol, Src Port: 19412 (19412), Dst Port: 81 (81), Seq: 6364, Ack: 1606, Len: 266
[6 Reassembled TCP Segments (6128 bytes): #1075(1460), #1076(1460), #1077(1460), #1078(1460), #1079(22), #1088(266)]
Hypertext Transfer Protocol
POST /redirect1/SampleService.asmx HTTP/1.1\r\n
Content-Type: application/soap+xml; charset=utf-8; action="http://tempuri.org/HelloWorld"\r\n
Accept-Encoding: gzip, deflate\r\n
[truncated]Authorization: Negotiate YIIQYwYGKwYBBQUCoIIQVzCCEFOgMDAuBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwICHgYKKwYBBAGCNwICCqKCEB0EghAZYIIQFQYJKoZIhvcSAQICAQBughAEMIIQAKADAgEFoQMCAQ6iBwMFACAAAACjgg6MYYIOiDCCDoSgAwIBBaEOGwxTQ09URVFJTl
Host: dub-iis-t03:81\r\n
Content-Length: 266\r\n
Expect: 100-continue\r\n
\r\n
[Full request URI: http://dub-iis-t03:81/redirect1/SampleService.asmx]
[HTTP request 4/6]
[Response in frame: 1095]
eXtensible Markup Language
No. Time Source Destination Protocol Length Info
1089 14.808064000 172.22.20.69 172.22.20.97 HTTP/XML 320 POST /SampleService.asmx HTTP/1.1
Frame 1089: 320 bytes on wire (2560 bits), 320 bytes captured (2560 bits) on interface 0
Ethernet II, Src: Vmware_a1:3e:e6 (00:50:56:a1:3e:e6), Dst: Vmware_a1:51:28 (00:50:56:a1:51:28)
Internet Protocol Version 4, Src: 172.22.20.69 (172.22.20.69), Dst: 172.22.20.97 (172.22.20.97)
Transmission Control Protocol, Src Port: 63411 (63411), Dst Port: 9995 (9995), Seq: 6036, Ack: 1, Len: 266
[3 Reassembled TCP Segments (6301 bytes): #1084(2920), #1087(3115), #1089(266)]
Hypertext Transfer Protocol
POST /SampleService.asmx HTTP/1.1\r\n
Connection: Keep-Alive\r\n
Content-Type: application/soap+xml; charset=utf-8; action="http://tempuri.org/HelloWorld"\r\n
Accept-Encoding: gzip, deflate\r\n
[truncated]Authorization: Negotiate YIIQYwYGKwYBBQUCoIIQVzCCEFOgMDAuBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwICHgYKKwYBBAGCNwICCqKCEB0EghAZYIIQFQYJKoZIhvcSAQICAQBughAEMIIQAKADAgEFoQMCAQ6iBwMFACAAAACjgg6MYYIOiDCCDoSgAwIBBaEOGwxTQ09URVFJTl
Expect: 100-continue\r\n
Host: dub-invest-d01:9995\r\n
Max-Forwards: 10\r\n
X-Original-URL: /redirect1/SampleService.asmx\r\n
X-Forwarded-For: 172.22.20.53:19412\r\n
X-ARR-LOG-ID: 6f820cca-382d-42af-9863-9d3faf682d7c\r\n
Content-Length: 266\r\n
\r\n
[Full request URI: http://dub-invest-d01:9995/SampleService.asmx]
[HTTP request 1/2]
[Response in frame: 1092]
[Next request in frame: 1107]
eXtensible Markup Language
No. Time Source Destination Protocol Length Info
1092 14.810541000 172.22.20.97 172.22.20.69 HTTP 766 KRB Error: KRB5KRB_AP_ERR_MODIFIED (text/html)
Frame 1092: 766 bytes on wire (6128 bits), 766 bytes captured (6128 bits) on interface 0
Ethernet II, Src: Vmware_a1:51:28 (00:50:56:a1:51:28), Dst: Vmware_a1:3e:e6 (00:50:56:a1:3e:e6)
Internet Protocol Version 4, Src: 172.22.20.97 (172.22.20.97), Dst: 172.22.20.69 (172.22.20.69)
Transmission Control Protocol, Src Port: 9995 (9995), Dst Port: 63411 (63411), Seq: 1, Ack: 6302, Len: 712
Hypertext Transfer Protocol
HTTP/1.1 401 Unauthorized\r\n
Content-Type: text/html; charset=us-ascii\r\n
Server: Microsoft-HTTPAPI/2.0\r\n
WWW-Authenticate: Negotiate oYGDMIGAoAMKAQGhCwYJKoZIgvcSAQIComwEamBoBgkqhkiG9xIBAgIDAH5ZMFegAwIBBaEDAgEepBEYDzIwMTQxMTE3MTU0MTExWqUFAgMFsSCmAwIBKakOGwxTQ09URVFJTlQuSUWqHDAaoAMCAQGhEzARGw9kdWItaW52ZXN0LWQwMSQ=\r\n
Date: Mon, 17 Nov 2014 15:41:11 GMT\r\n
Content-Length: 341\r\n
\r\n
[HTTP response 1/2]
[Time since request: 0.002477000 seconds]
[Request in frame: 1089]
[Next request in frame: 1107]
[Next response in frame: 1110]
Line-based text data: text/html
No. Time Source Destination Protocol Length Info
1095 14.813283000 172.22.20.69 172.22.20.53 HTTP 808 KRB Error: KRB5KRB_AP_ERR_MODIFIED (text/html)
Frame 1095: 808 bytes on wire (6464 bits), 808 bytes captured (6464 bits) on interface 0
Ethernet II, Src: Vmware_a1:3e:e6 (00:50:56:a1:3e:e6), Dst: Vmware_a1:7a:1f (00:50:56:a1:7a:1f)
Internet Protocol Version 4, Src: 172.22.20.69 (172.22.20.69), Dst: 172.22.20.53 (172.22.20.53)
Transmission Control Protocol, Src Port: 81 (81), Dst Port: 19412 (19412), Seq: 1606, Ack: 6630, Len: 754
Hypertext Transfer Protocol
HTTP/1.1 401 Unauthorized\r\n
Content-Length: 341\r\n
Content-Type: text/html; charset=us-ascii\r\n
Server: Microsoft-IIS/7.5\r\n
WWW-Authenticate: Negotiate oYGDMIGAoAMKAQGhCwYJKoZIgvcSAQIComwEamBoBgkqhkiG9xIBAgIDAH5ZMFegAwIBBaEDAgEepBEYDzIwMTQxMTE3MTU0MTExWqUFAgMFsSCmAwIBKakOGwxTQ09URVFJTlQuSUWqHDAaoAMCAQGhEzARGw9kdWItaW52ZXN0LWQwMSQ=\r\n
X-Powered-By: ARR/2.5\r\n
X-Powered-By: ASP.NET\r\n
Date: Mon, 17 Nov 2014 15:41:11 GMT\r\n
\r\n
[HTTP response 4/6]
[Time since request: 0.005358000 seconds]
[Prev response in frame: 1085]
[Request in frame: 1088]
[Next response in frame: 1104]
Line-based text data: text/html
No. Time Source Destination Protocol Length Info
1104 14.823097000 172.22.20.69 172.22.20.53 HTTP 79 HTTP/1.1 100 Continue
Frame 1104: 79 bytes on wire (632 bits), 79 bytes captured (632 bits) on interface 0
Ethernet II, Src: Vmware_a1:3e:e6 (00:50:56:a1:3e:e6), Dst: Vmware_a1:7a:1f (00:50:56:a1:7a:1f)
Internet Protocol Version 4, Src: 172.22.20.69 (172.22.20.69), Dst: 172.22.20.53 (172.22.20.53)
Transmission Control Protocol, Src Port: 81 (81), Dst Port: 19412 (19412), Seq: 2360, Ack: 12416, Len: 25
Hypertext Transfer Protocol
HTTP/1.1 100 Continue\r\n
\r\n
[HTTP response 5/6]
[Prev request in frame: 1088]
[Prev response in frame: 1095]
[Next request in frame: 1105]
[Next response in frame: 1111]
No. Time Source Destination Protocol Length Info
1105 14.823801000 172.22.20.53 172.22.20.69 HTTP/XML 320 POST /redirect1/SampleService.asmx HTTP/1.1
Frame 1105: 320 bytes on wire (2560 bits), 320 bytes captured (2560 bits) on interface 0
Ethernet II, Src: Vmware_a1:7a:1f (00:50:56:a1:7a:1f), Dst: Vmware_a1:3e:e6 (00:50:56:a1:3e:e6)
Internet Protocol Version 4, Src: 172.22.20.53 (172.22.20.53), Dst: 172.22.20.69 (172.22.20.69)
Transmission Control Protocol, Src Port: 19412 (19412), Dst Port: 81 (81), Seq: 12416, Ack: 2385, Len: 266
[5 Reassembled TCP Segments (6052 bytes): #1097(1460), #1098(1460), #1100(1460), #1101(1406), #1105(266)]
Hypertext Transfer Protocol
POST /redirect1/SampleService.asmx HTTP/1.1\r\n
Content-Type: application/soap+xml; charset=utf-8; action="http://tempuri.org/HelloWorld"\r\n
Accept-Encoding: gzip, deflate\r\n
[truncated]Authorization: Negotiate oYIQKjCCECagAwoBAaKCEB0EghAZYIIQFQYJKoZIhvcSAQICAQBughAEMIIQAKADAgEFoQMCAQ6iBwMFACAAAACjgg6MYYIOiDCCDoSgAwIBBaEOGwxTQ09URVFJTlQuSUWiKzApoAMCAQKhIjAgGwRIVFRQGxhkdWItaWlzLXQwMy5zY290ZXFpbnQuaWWjgg4+MIIOOq
Host: dub-iis-t03:81\r\n
Content-Length: 266\r\n
Expect: 100-continue\r\n
\r\n
[Full request URI: http://dub-iis-t03:81/redirect1/SampleService.asmx]
[HTTP request 6/6]
[Response in frame: 1111]
eXtensible Markup Language
No. Time Source Destination Protocol Length Info
1107 14.823973000 172.22.20.69 172.22.20.97 HTTP/XML 320 POST /SampleService.asmx HTTP/1.1
Frame 1107: 320 bytes on wire (2560 bits), 320 bytes captured (2560 bits) on interface 0
Ethernet II, Src: Vmware_a1:3e:e6 (00:50:56:a1:3e:e6), Dst: Vmware_a1:51:28 (00:50:56:a1:51:28)
Internet Protocol Version 4, Src: 172.22.20.69 (172.22.20.69), Dst: 172.22.20.97 (172.22.20.97)
Transmission Control Protocol, Src Port: 63411 (63411), Dst Port: 9995 (9995), Seq: 12261, Ack: 713, Len: 266
[2 Reassembled TCP Segments (6225 bytes): #1103(5959), #1107(266)]
Hypertext Transfer Protocol
POST /SampleService.asmx HTTP/1.1\r\n
Connection: Keep-Alive\r\n
Content-Type: application/soap+xml; charset=utf-8; action="http://tempuri.org/HelloWorld"\r\n
Accept-Encoding: gzip, deflate\r\n
[truncated]Authorization: Negotiate oYIQKjCCECagAwoBAaKCEB0EghAZYIIQFQYJKoZIhvcSAQICAQBughAEMIIQAKADAgEFoQMCAQ6iBwMFACAAAACjgg6MYYIOiDCCDoSgAwIBBaEOGwxTQ09URVFJTlQuSUWiKzApoAMCAQKhIjAgGwRIVFRQGxhkdWItaWlzLXQwMy5zY290ZXFpbnQuaWWjgg4+MIIOOq
Expect: 100-continue\r\n
Host: dub-invest-d01:9995\r\n
Max-Forwards: 10\r\n
X-Original-URL: /redirect1/SampleService.asmx\r\n
X-Forwarded-For: 172.22.20.53:19412\r\n
X-ARR-LOG-ID: e8e7b4c9-f41a-46d3-ab0e-5d931def3e0c\r\n
Content-Length: 266\r\n
\r\n
[Full request URI: http://dub-invest-d01:9995/SampleService.asmx]
[HTTP request 2/2]
[Prev request in frame: 1089]
[Response in frame: 1110]
eXtensible Markup Language
No. Time Source Destination Protocol Length Info
1110 14.824975000 172.22.20.97 172.22.20.69 HTTP 746 KRB Error: KRB5KRB_AP_ERR_MODIFIED (text/html)
Frame 1110: 746 bytes on wire (5968 bits), 746 bytes captured (5968 bits) on interface 0
Ethernet II, Src: Vmware_a1:51:28 (00:50:56:a1:51:28), Dst: Vmware_a1:3e:e6 (00:50:56:a1:3e:e6)
Internet Protocol Version 4, Src: 172.22.20.97 (172.22.20.97), Dst: 172.22.20.69 (172.22.20.69)
Transmission Control Protocol, Src Port: 9995 (9995), Dst Port: 63411 (63411), Seq: 713, Ack: 12527, Len: 692
Hypertext Transfer Protocol
HTTP/1.1 401 Unauthorized\r\n
Content-Type: text/html; charset=us-ascii\r\n
Server: Microsoft-HTTPAPI/2.0\r\n
WWW-Authenticate: Negotiate oXUwc6ADCgEBomwEamBoBgkqhkiG9xIBAgIDAH5ZMFegAwIBBaEDAgEepBEYDzIwMTQxMTE3MTU0MTExWqUFAgMF7g+mAwIBKakOGwxTQ09URVFJTlQuSUWqHDAaoAMCAQGhEzARGw9kdWItaW52ZXN0LWQwMSQ=\r\n
Date: Mon, 17 Nov 2014 15:41:11 GMT\r\n
Content-Length: 341\r\n
\r\n
[HTTP response 2/2]
[Time since request: 0.001002000 seconds]
[Prev request in frame: 1089]
[Prev response in frame: 1092]
[Request in frame: 1107]
Line-based text data: text/html
No. Time Source Destination Protocol Length Info
1111 14.825340000 172.22.20.69 172.22.20.53 HTTP 788 KRB Error: KRB5KRB_AP_ERR_MODIFIED (text/html)
Frame 1111: 788 bytes on wire (6304 bits), 788 bytes captured (6304 bits) on interface 0
Ethernet II, Src: Vmware_a1:3e:e6 (00:50:56:a1:3e:e6), Dst: Vmware_a1:7a:1f (00:50:56:a1:7a:1f)
Internet Protocol Version 4, Src: 172.22.20.69 (172.22.20.69), Dst: 172.22.20.53 (172.22.20.53)
Transmission Control Protocol, Src Port: 81 (81), Dst Port: 19412 (19412), Seq: 2385, Ack: 12682, Len: 734
Hypertext Transfer Protocol
HTTP/1.1 401 Unauthorized\r\n
Content-Length: 341\r\n
Content-Type: text/html; charset=us-ascii\r\n
Server: Microsoft-IIS/7.5\r\n
WWW-Authenticate: Negotiate oXUwc6ADCgEBomwEamBoBgkqhkiG9xIBAgIDAH5ZMFegAwIBBaEDAgEepBEYDzIwMTQxMTE3MTU0MTExWqUFAgMF7g+mAwIBKakOGwxTQ09URVFJTlQuSUWqHDAaoAMCAQGhEzARGw9kdWItaW52ZXN0LWQwMSQ=\r\n
X-Powered-By: ARR/2.5\r\n
X-Powered-By: ASP.NET\r\n
Date: Mon, 17 Nov 2014 15:41:11 GMT\r\n
\r\n
[HTTP response 6/6]
[Time since request: 0.001539000 seconds]
[Prev response in frame: 1104]
[Request in frame: 1105]
Line-based text data: text/html