Kerberos is a relatively complex protocol, and sometimes you find yourself trying to track down the source of authentication problems. One good way to do that is using a network capture, but once you find the Kerberos errors this way, how do you decipher what they mean? This post from TechNet’s Directory Services Team blog will tell you how to do the capture, how to filter it to isolate the Kerberos-related information, and finally, what some commonly encountered errors are all about.
http://blogs.technet.com/b/askds/archive/2012/07/27/kerberos-errors-in-network-captures.aspx