scp local/remote external calls

[petesea at bigfoot.com]

I'm a bit confused how scp works... could someone please explain the 
local/remote external calls that happen when scp is started... in 
particular how it relates to ssh on the remote site?

To be more specific...

I use Kerberos for authentication and I've been working on an ssh wrapper 
script that checks my Kerberos credentials before running the ssh command. 
If the credentials are missing or expired it gives a more appropriate 
message... something a bit more obvious then the standard "Permission 
denied" message from ssh.

So... lets say this ssh wrapper is called "ssh" and it's in my $HOME/bin 
dir (which is first on my PATH).

I have (for the sake of this discussion) 2 boxes... box1 and box2.  The 
ssh wrapper script exists ONLY on box2.

If I do an scp FROM box1 (which does NOT have this wrapper script) to box2 
AND my credentials have expired on box2, scp will fail with a message that 
my credentials have expired (which comes from my wrapper script)... which 
obviously means somehow my ssh wrapper on box2 was run.  This leads me to 
the conclusion that running scp on box1 to box2 somehow starts the ssh 
client on box2.

Is that correct?  Is so, could someone please outline exactly what happens 
both local and remote when scp is run.

Thanks.