Skip to main content

Kerberos error 57: Can't send request (send to kdc)

Problem: Attempts to use any Kerberized service results in "Kerberos error 57: Can't send request (send to kdc)"

Solution: This error can be caused by a number of problems. Please go throught the following suggestions in order:

  1. Your Network ID was entered with the "@cornell.edu" included. Your NetID should be entered in all lowercase, without the "@cornell.edu". If you have a problem with the incorrect NetID appearing by default every time, see the Kerb Error 8 document on how to change the default NetID.
  2. The network connection is failing. If other network applications are also failing to properly connect, then most likely there are problems with the network connection (ethernet or modem). Troubleshoot the network connection using: Ethernet troubleshooting or EZ-Remote/modem troubleshooting.

Technical Description: Can't send request occurs when Kerberos was unable to connect properly to a Kerberos host. If there is a problem with the network connection (including protocol, SLIP setup, DNS configuration, etc.) then Kerberos will be unable to find or connect to a Kerberos host (or any server for that matter). When users enter a complete e-mail address (such as ecl3@cornell.edu), the Kerberos IRealm setting is changed to cornell.edu. (putting an "@" in your netid tells Kerberos to use the realm that came after the "@" in preference over the realm specified in krb.con). More commonly, problems arise from the services file.
Windows95/98: The first time Kerberos is run, it will search the current working directory and then each directory in the PATH statement until it finds a services file. Once it has read a services file, or searched all the directories without finding one, it will not attempt to read it again, and the machine must be reset to get Kerberos to look for a services file again.
WindowsNT: Every time Kerberos is run, NT will look in %winnt%\system32\drivers\etc directory for the services file. It will look nowhere else, regardless of the PATH environment variable. The relevant line in the services file is

kerberos 750/udp kerberos # kerberos UDP

This line sets the kerberos_udp port to 750 and must be present in the services file that Kerberos reads. In KView Debug mode, you can see the udp port set to 750 the first time Kerberos is run during each session. If it can't find the services file or the line is missing, you will see a "can't get kerberos udp service" message. One other potential hangup is an end-of-file character appearing before the kerberos_udp line in the services file. EOF characters are typically displayed as ^Z or a black square.

Last updated July 28, 2004