A Better Way of Looking at Things

We can continue digging down through packets, but Ethereal offers a powerful and unique feature that makes the analysis a lot easier!  It's called the Follow TCP Stream feature, and it's one of the many features that makes Ethereal an awesome tool for troubleshooting authentication problems.

To use the Follow TCP Stream feature, right-click on the 401 error and select Follow TCP Stream from the menu.  What you end up with is the following:

 

A closer look here will reveal the power of this dialog.  You can't see it here because of space limitations, but the information that FrontPage sent is in red and the information in the response from the server (seen here) is in blue.  What's more, you have clearly readable information here that shows you exactly why I wasn't allowed to open the site!  In this case, the message is "The user ' ' is not authorized to execute the 'Author Pages' method."  What does that mean?  It tells me that the Web server doesn't know who I am!  Wininet has not yet sent any authentication information.  Remember, this is normal for the first request.

Below is what you see when the authentication succeeds:

Notice here that the next to the last line contains authorization information from FrontPage.  (It's the long string of letters.)  Notice also that the Web server returned an HTTP response of "HTTP/1.1 200 OK."  This tells us that we have been granted permission and we're ready to go.

<Go on to page 5>