typedef struct krbinfo {
    uint8_t krb_version;
    string krb_message_type;
    uint64_t krb_message_id;
    uint32_t krb_message_length;
    uintptr_t krb_message; 
} krbinfo_t;

typedef struct kaprepinfo {
    uint32_t kaprep_enc_part_kvno;
    string kaprep_enc_part_etype;
    uint32_t kaprep_enc_ctime;
    uint32_t kaprep_enc_cusec;
    string kaprep_enc_subkey_type;
    uint32_t kaprep_enc_subkey_length;
    uintptr_t kaprep_enc_subkey_value;
    uint32_t kaprep_enc_seq_number;
} kaprepinfo_t;

typedef struct kapreqinfo {
    string kapreq_ap_options;
    uint32_t kapreq_authenticator_kvno;
    string kapreq_authenticator_etype;
} kapreqinfo_t;

typedef struct kticketinfo_t {
    string kticket_server;
    uint32_t kticket_enc_part_kvno;
    string kticket_enc_part_etype;
    string kticket_enc_flags;
    string kticket_enc_key_type;
    uint32_t kticket_enc_key_length;
    uintptr_t kticket_enc_key_value;
    string kticket_enc_client;
    string kticket_enc_transited;
    string kticket_enc_transited_type;
    uint32_t kticket_enc_authtime;
    uint32_t kticket_enc_starttime;
    uint32_t kticket_enc_endtime;
    uint32_t kticket_enc_renew_till;
    string kticket_enc_addresses;
    string kticket_enc_authorization_data;
} kticketinfo_t;

typedef struct kauthenticatorinfo {
    string kauth_client;
    string kauth_cksum_type;
    uint32_t kauth_cksum_length;
    uintptr_t kauth_cksum_value;
    uint32_t kauth_cusec;
    uint32_t kauth_ctime;
    string kauth_subkey_type;
    uint32_t kauth_subkey_length;
    uintptr_t kauth_subkey_value;
    uint32_t kauth_seq_number;
    string kauth_authorization_data;
} kauthenticatorinfo_t;

typedef struct kcredinfo {
    uint32_t kcred_enc_part_kvno;
    string kcred_enc_part_etype;
    uint32_t kcred_tickets;
    uint32_t kcred_enc_nonce;
    uint32_t kcred_enc_timestamp;
    uint32_t kcred_enc_usec;
    string kcred_enc_s_address;
    string kcred_enc_r_address;
} kcredinfo_t;

typedef struct kerrorinfo {
    uint32_t kerror_ctime;
    uint32_t kerror_cusec;
    uint32_t kerror_stime;
    uint32_t kerror_susec;
    string kerror_error_code;
    string kerror_client;
    string kerror_server;
    string kerror_e_text;
    string kerror_e_data;
} kerrorinfo_t;

typedef struct kdcrepinfo {
    string kdcrep_padata_types;
    string kdcrep_client;
    uint32_t kdcrep_enc_part_kvno;
    string kdcrep_enc_part_etype;
    string kdcrep_enc_key_type;
    uint32_t kdcrep_enc_key_length;
    uintptr_t kdcrep_enc_key_value;
    string kdcrep_enc_last_req;
    uint32_t kdcrep_enc_nonce;
    uint32_t kdcrep_enc_key_expiration;
    string kdcrep_enc_flags;
    uint32_t kdcrep_enc_authtime;
    uint32_t kdcrep_enc_starttime;
    uint32_t kdcrep_enc_endtime;
    uint32_t kdcrep_enc_renew_till;
    string kdcrep_enc_server;
    string kdcrep_enc_caddr;
} kdcrepinfo_t;

typedef struct kdcreqinfo {
    string kdcreq_padata_types;
    string kdcreq_kdc_options;
    string kdcreq_client;
    string kdcreq_server;
    string kdcreq_from;
    uint32_t kdcreq_till;
    uint32_t kdcreq_rtime;
    uint32_t kdcreq_nonce;
    string kdcreq_etype;
    string kdcreq_addresses;
    string kdcreq_authorization_data;
    uint32_t kdcreq_num_additional_tickets;
} kdcreqinfo_t;

typedef struct kprivinfo {
    uint32_t kpriv_enc_part_kvno;
    string kpriv_enc_part_etype;
    uintptr_t kpriv_enc_user_data;
    uint32_t kpriv_enc_timestamp;
    uint32_t kpriv_enc_usec;
    uint32_t kpriv_enc_seq_number;
    string kpriv_enc_s_address;
    string kpriv_enc_r_address;
} kprivinfo_t;

typedef struct ksafeinfo {
    uintptr_t ksafe_user_data;
    uint32_t ksafe_timestamp;
    uint32_t ksafe_usec;
    uint32_t ksafe_seq_number;
    string ksafe_s_address;
    string ksafe_r_address;
    string ksafe_cksum_type;
    uint32_t ksafe_cksum_length;
    uintptr_t ksafe_cksum_value;
} ksafeinfo_t;

typedef struct kconninfo {
    string kconn_remote;
    string kconn_local;
    string kconn_protocol;
    string kconn_type;
    uint16_t kconn_localport;
    uint16_t kconn_remoteport;
} kconninfo_t;

# Dump a Kerberos error message
# dtrace -n 'krb_error-make {
    printf("\n{");
    printf("\n\tctime = %Y", (uint64_t)(args[1]->kerror_ctime * 1000000000));
    printf("\n\tcusec = %d", args[1]->kerror_cusec);
    printf("\n\tstime = %Y", (uint64_t)(args[1]->kerror_stime * 1000000000));
    printf("\n\tsusec = %d", args[1]->kerror_susec);
    printf("\n\terror_code = %s", args[1]->kerror_error_code);
    printf("\n\tclient = %s", args[1]->kerror_client);
    printf("\n\tserver = %s", args[1]->kerror_server);
    printf("\n\te_text = %s", args[1]->kerror_e_text);
    printf("\n\te_data = %s", "");
    printf("\n}");
}'
dtrace: description 'krb_error-make ' matched 1 probe
CPU     ID                    FUNCTION:NAME
  0  78307     krb5_mk_error:krb_error-make 
{
	ctime = 2010 May 10 12:11:20
	cusec = 0
	stime = 2010 May 10 12:11:20
	susec = 319090
	error_code = KDC_ERR_C_PRINCIPAL_UNKNOWN(6)
	client = testuser@D.COM
	server = krbtgt/D.COM@D.COM
	e_text = CLIENT_NOT_FOUND
	e_data = 
}

# dtrace -n 'kerberos$target:::krb_kdc_req-read { @[args[1]->kdcreq_server] = count(); }' -p $(pgrep krb5kdc)
^C

  nfs/four.acme.com@D.COM                                           2
  krbtgt/D.COM@D.COM                                                3
  host/four.acme.com@D.COM                                          4

# LD_PRELOAD_32=/usr/lib/gss/mech_krb5.so.1 dtrace -q -n '
kerberos$target:::krb_kdc_req-make {
    printf("kdcreq_server: %s",args[1]->kdcreq_server);
}' -c "ssh local@four.acme.com" -o dtrace.out
Last login: Thu Apr 29 15:27:44 2010
Sun Microsystems Inc.   SunOS 5.11      snv_137 March 2010
$ ^D
# cat dtrace.out 
kdcreq_server: host/four.acme.com@D.COM

# LD_BIND_NOW=1 dtrace -q -n '
kerberos$target:::krb_message-send {
    printf("%s:%d\n",args[1]->kconn_remote, args[1]->kconn_remoteport)
}
' -c "kinit local4"

10.10.10.14:88
10.10.10.14:750
10.10.10.14:88
10.10.10.14:750
10.10.10.14:88
10.10.10.14:750
kinit(v5): Cannot contact any KDC for realm 'D.COM' while getting initial credentials