There are times when you want to take netmon trace when a certain event is generated on the server/machine. There is a nice blogpost that explains the usage of Eventmon and Nmcap http://blogs.technet.com/b/netmon/archive/2007/02/22/eventmon-stopping...

While working on a case came across a link and thought of sharing with all http://support.microsoft.com/kb/321044 it gives details about how to find out duplicate SPNs or query SPNs