The node you are looking for is at shishi_kdcreq_to_file.