Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Oct 29, 2006 11:35:19.406420000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 166 bytes Capture Length: 166 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Destination: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.101 (165.227.249.101) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x012c (300) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa88 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.101 (165.227.249.101) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x5363 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x25E35C9F100726B3 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 0f b5 4b 45 e0 00 0c 29 ab 06 ab 08 00 45 00 ...KE...).....E. 0010 00 98 01 2c 00 00 80 11 fa 88 a5 e3 f9 73 a5 e3 ...,.........s.. 0020 f9 65 01 f4 01 f4 00 84 53 63 25 e3 5c 9f 10 07 .e......Sc%.\... 0030 26 b3 00 00 00 00 00 00 00 00 01 10 02 00 00 00 &............... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (146 bytes on wire, 146 bytes captured) Arrival Time: Oct 29, 2006 11:35:19.548050000 Time delta from previous packet: 0.141630000 seconds Time since reference or first frame: 0.141630000 seconds Frame Number: 2 Packet Length: 146 bytes Capture Length: 146 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.101 (165.227.249.101), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x003b (59) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb8d [correct] Good: True Bad : False Source: 165.227.249.101 (165.227.249.101) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0x9d01 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x25E35C9F100726B3 Responder cookie: 0x43B46104DE234E47 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 ab 06 ab 00 0f b5 4b 45 e0 08 00 45 00 ..)......KE...E. 0010 00 84 00 3b 40 00 40 11 fb 8d a5 e3 f9 65 a5 e3 ...;@.@......e.. 0020 f9 73 01 f4 01 f4 00 70 9d 01 25 e3 5c 9f 10 07 .s.....p..%.\... 0030 26 b3 43 b4 61 04 de 23 4e 47 01 10 02 00 00 00 &.C.a..#NG...... 0040 00 00 00 00 00 68 0d 00 00 38 00 00 00 01 00 00 .....h...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 00 00 ................ 0080 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 0090 8b 35 .5 Frame 3 (298 bytes on wire, 298 bytes captured) Arrival Time: Oct 29, 2006 11:35:21.718077000 Time delta from previous packet: 2.170027000 seconds Time since reference or first frame: 2.311657000 seconds Frame Number: 3 Packet Length: 298 bytes Capture Length: 298 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Destination: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.101 (165.227.249.101) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x012d (301) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa03 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.101 (165.227.249.101) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xbf4b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x25E35C9F100726B3 Responder cookie: 0x43B46104DE234E47 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0f b5 4b 45 e0 00 0c 29 ab 06 ab 08 00 45 00 ...KE...).....E. 0010 01 1c 01 2d 00 00 80 11 fa 03 a5 e3 f9 73 a5 e3 ...-.........s.. 0020 f9 65 01 f4 01 f4 01 08 bf 4b 25 e3 5c 9f 10 07 .e.......K%.\... 0030 26 b3 43 b4 61 04 de 23 4e 47 04 10 02 00 00 00 &.C.a..#NG...... 0040 00 00 00 00 01 00 0a 00 00 84 e8 1d 53 8f 6c ec ............S.l. 0050 92 24 c5 01 d5 ab ab cc f6 81 67 13 ca 4c 45 10 .$........g..LE. 0060 47 ca 2c de 6f c5 49 2d 7c 8c e7 ef 19 6a 2a c4 G.,.o.I-|....j*. 0070 0d 8d 1d cf d1 b3 b6 2a c6 fa 26 58 e8 d8 a5 6c .......*..&X...l 0080 10 4a 71 11 52 59 28 19 3e 19 68 19 1b 07 f2 3f .Jq.RY(.>.h....? 0090 1f 6c 41 83 dd 1a 3d c0 fc 7f a4 03 0d a8 26 f0 .lA...=.......&. 00a0 1e f2 86 45 32 2c 00 c9 3d 41 31 05 58 be 1b 8d ...E2,..=A1.X... 00b0 8c 2e 70 55 d9 ab c3 9a 87 86 bc 25 70 b9 e7 3f ..pU.......%p..? 00c0 c7 e3 01 db e5 4f 8e 7d 19 6d 0d 00 00 18 d1 74 .....O.}.m.....t 00d0 ae 79 d3 b7 2f 05 b7 d4 0c c8 19 56 09 28 e9 dd .y../......V.(.. 00e0 ee 4c 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .L...0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 4 (242 bytes on wire, 242 bytes captured) Arrival Time: Oct 29, 2006 11:35:21.972843000 Time delta from previous packet: 0.254766000 seconds Time since reference or first frame: 2.566423000 seconds Frame Number: 4 Packet Length: 242 bytes Capture Length: 242 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.101 (165.227.249.101), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x003c (60) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb2c [correct] Good: True Bad : False Source: 165.227.249.101 (165.227.249.101) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0xee1c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x25E35C9F100726B3 Responder cookie: 0x43B46104DE234E47 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 20 Nonce Data Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 ab 06 ab 00 0f b5 4b 45 e0 08 00 45 00 ..)......KE...E. 0010 00 e4 00 3c 40 00 40 11 fb 2c a5 e3 f9 65 a5 e3 ...<@.@..,...e.. 0020 f9 73 01 f4 01 f4 00 d0 ee 1c 25 e3 5c 9f 10 07 .s........%.\... 0030 26 b3 43 b4 61 04 de 23 4e 47 04 10 02 00 00 00 &.C.a..#NG...... 0040 00 00 00 00 00 c8 0a 00 00 84 a6 c4 4c f2 ed 13 ............L... 0050 74 0f ad 99 e1 02 ff 1b e1 f4 ed f1 e2 dc 5b 4d t.............[M 0060 3f 47 59 b3 5b 4e fd 69 14 91 06 69 06 c6 14 7a ?GY.[N.i...i...z 0070 3b 6e 43 d0 0b a8 dd 2b 47 3d 21 e7 a6 d7 1a fe ;nC....+G=!..... 0080 a6 e0 ad 1b 1e 0e 60 bb d6 db d6 43 2d 75 8d e5 ......`....C-u.. 0090 6a 9e ee 9c cc aa c8 f8 72 87 2e f6 af 19 24 14 j.......r.....$. 00a0 4a 96 7a bf 81 16 c0 2e d7 85 28 cb 9c c2 4b 28 J.z.......(...K( 00b0 08 73 5d 0b 46 93 45 cb ad 5c cc 61 8c 2b de 5a .s].F.E..\.a.+.Z 00c0 d0 ed cb aa 22 c4 95 e1 a0 e2 0d 00 00 14 f1 45 ...."..........E 00d0 f8 9b 5e 18 80 7c 8b 85 53 13 e0 c1 a4 35 00 00 ..^..|..S....5.. 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 5 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 29, 2006 11:35:22.919714000 Time delta from previous packet: 0.946871000 seconds Time since reference or first frame: 3.513294000 seconds Frame Number: 5 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Destination: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.101 (165.227.249.101) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x012f (303) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfaa5 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.101 (165.227.249.101) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x742d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x25E35C9F100726B3 Responder cookie: 0x43B46104DE234E47 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0f b5 4b 45 e0 00 0c 29 ab 06 ab 08 00 45 00 ...KE...).....E. 0010 00 78 01 2f 00 00 80 11 fa a5 a5 e3 f9 73 a5 e3 .x./.........s.. 0020 f9 65 01 f4 01 f4 00 64 74 2d 25 e3 5c 9f 10 07 .e.....dt-%.\... 0030 26 b3 43 b4 61 04 de 23 4e 47 05 10 02 01 00 00 &.C.a..#NG...... 0040 00 00 00 00 00 5c 7f 1a 62 ef e7 78 18 fd 0c 98 .....\..b..x.... 0050 8c 99 ba ec 2b c7 9c 1d 00 d5 0e d7 77 1d b2 09 ....+.......w... 0060 f8 59 e0 bc 61 10 5d 38 d0 41 79 82 fd 68 c7 fc .Y..a.]8.Ay..h.. 0070 c4 c6 c0 54 c6 d1 4f 67 a8 91 53 42 c7 b7 fd 46 ...T..Og..SB...F 0080 e0 17 5c ca 3f b9 ..\.?. Frame 6 (118 bytes on wire, 118 bytes captured) Arrival Time: Oct 29, 2006 11:35:23.024628000 Time delta from previous packet: 0.104914000 seconds Time since reference or first frame: 3.618208000 seconds Frame Number: 6 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.101 (165.227.249.101), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x003d (61) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba7 [correct] Good: True Bad : False Source: 165.227.249.101 (165.227.249.101) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x78ba [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x25E35C9F100726B3 Responder cookie: 0x43B46104DE234E47 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 ab 06 ab 00 0f b5 4b 45 e0 08 00 45 00 ..)......KE...E. 0010 00 68 00 3d 40 00 40 11 fb a7 a5 e3 f9 65 a5 e3 .h.=@.@......e.. 0020 f9 73 01 f4 01 f4 00 54 78 ba 25 e3 5c 9f 10 07 .s.....Tx.%.\... 0030 26 b3 43 b4 61 04 de 23 4e 47 05 10 02 01 00 00 &.C.a..#NG...... 0040 00 00 00 00 00 4c 2d 66 dd 83 1d 5a 67 d5 93 c4 .....L-f...Zg... 0050 82 7c e0 27 8e 22 0f 12 cd 1e 29 52 8e f1 e8 c0 .|.'."....)R.... 0060 2e 56 84 52 db 2c 1c 51 95 06 e0 c1 04 d4 72 10 .V.R.,.Q......r. 0070 af 21 ff ad da c7 .!.... Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 29, 2006 11:35:23.094144000 Time delta from previous packet: 0.069516000 seconds Time since reference or first frame: 3.687724000 seconds Frame Number: 7 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.101 (165.227.249.101), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x003e (62) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb96 [correct] Good: True Bad : False Source: 165.227.249.101 (165.227.249.101) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xdbea [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x25E35C9F100726B3 Responder cookie: 0x43B46104DE234E47 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xBFE6068D Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 ab 06 ab 00 0f b5 4b 45 e0 08 00 45 00 ..)......KE...E. 0010 00 78 00 3e 40 00 40 11 fb 96 a5 e3 f9 65 a5 e3 .x.>@.@......e.. 0020 f9 73 01 f4 01 f4 00 64 db ea 25 e3 5c 9f 10 07 .s.....d..%.\... 0030 26 b3 43 b4 61 04 de 23 4e 47 08 10 05 01 bf e6 &.C.a..#NG...... 0040 06 8d 00 00 00 5c 79 13 1c c1 c5 30 b5 d6 ca 7b .....\y....0...{ 0050 d8 23 5a 7a 08 a4 6f 00 11 2d 2d a6 3d ee f7 f0 .#Zz..o..--.=... 0060 86 43 53 51 51 f0 5e 61 3d 1c 61 c6 b3 0e 6c 07 .CSQQ.^a=.a...l. 0070 cf 3d e0 96 32 e7 cb 4b 48 f3 ae 97 eb e0 37 7b .=..2..KH.....7{ 0080 00 99 c1 1d b5 9f ...... Frame 8 (342 bytes on wire, 342 bytes captured) Arrival Time: Oct 29, 2006 11:35:25.287826000 Time delta from previous packet: 2.193682000 seconds Time since reference or first frame: 5.881406000 seconds Frame Number: 8 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Destination: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.101 (165.227.249.101) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0131 (305) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9d3 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.101 (165.227.249.101) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xf2ea [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x25E35C9F100726B3 Responder cookie: 0x43B46104DE234E47 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xA0782B67 Length: 300 Encrypted payload (272 bytes) 0000 00 0f b5 4b 45 e0 00 0c 29 ab 06 ab 08 00 45 00 ...KE...).....E. 0010 01 48 01 31 00 00 80 11 f9 d3 a5 e3 f9 73 a5 e3 .H.1.........s.. 0020 f9 65 01 f4 01 f4 01 34 f2 ea 25 e3 5c 9f 10 07 .e.....4..%.\... 0030 26 b3 43 b4 61 04 de 23 4e 47 08 10 20 01 a0 78 &.C.a..#NG.. ..x 0040 2b 67 00 00 01 2c e3 cc d2 75 3f e1 8b 05 55 11 +g...,...u?...U. 0050 01 ab a8 60 86 e7 ea 8e eb 8c dd 4c 02 69 e5 fb ...`.......L.i.. 0060 c6 33 b0 2d b9 c6 94 bf f1 6c c0 45 fa 47 1c 95 .3.-.....l.E.G.. 0070 0f f7 a7 df be 4c 27 40 83 94 c6 b6 a7 8f cd e0 .....L'@........ 0080 63 1c e3 ed 6d 1c ac e5 44 25 9c 28 17 c7 3c 2a c...m...D%.(..<* 0090 c2 fa b1 9c 88 d3 7c 6c e2 c9 7c 08 94 dd e5 5b ......|l..|....[ 00a0 97 c4 c8 d0 10 c1 19 2a 4b aa 19 34 8f 55 c5 db .......*K..4.U.. 00b0 63 c5 3a a9 90 28 d3 24 95 51 2d 31 21 1d 08 21 c.:..(.$.Q-1!..! 00c0 f2 d1 e2 96 fc c4 27 cb 66 b1 11 54 f7 cd bc 9e ......'.f..T.... 00d0 c1 58 e0 9e ed 18 4d 3c 00 f5 9e 3f 2d b9 a0 e4 .X....M<...?-... 00e0 45 bd e6 59 a9 43 41 60 04 6b 25 d7 6c 96 db 32 E..Y.CA`.k%.l..2 00f0 7a dc 48 83 5f 48 8f f8 11 d2 4a 84 92 27 64 a3 z.H._H....J..'d. 0100 fd 1a 78 43 8e 71 fe f1 b6 59 14 63 8e a8 b6 ba ..xC.q...Y.c.... 0110 50 d5 27 fa 16 21 25 a4 73 df 6d 31 19 d2 ba bc P.'..!%.s.m1.... 0120 e3 61 5c a8 c1 5a c6 c5 ad 7e 53 28 14 fd f0 46 .a\..Z...~S(...F 0130 50 b7 06 37 d7 0e 46 50 f9 94 3d e3 76 35 52 ea P..7..FP..=.v5R. 0140 29 84 42 dd e1 95 c4 3a d8 80 d8 84 0f 6b 44 77 ).B....:.....kDw 0150 fd c1 69 2c 63 99 ..i,c. Frame 9 (342 bytes on wire, 342 bytes captured) Arrival Time: Oct 29, 2006 11:35:25.750969000 Time delta from previous packet: 0.463143000 seconds Time since reference or first frame: 6.344549000 seconds Frame Number: 9 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.101 (165.227.249.101), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x003f (63) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfac5 [correct] Good: True Bad : False Source: 165.227.249.101 (165.227.249.101) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xdfe8 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x25E35C9F100726B3 Responder cookie: 0x43B46104DE234E47 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xA0782B67 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 ab 06 ab 00 0f b5 4b 45 e0 08 00 45 00 ..)......KE...E. 0010 01 48 00 3f 40 00 40 11 fa c5 a5 e3 f9 65 a5 e3 .H.?@.@......e.. 0020 f9 73 01 f4 01 f4 01 34 df e8 25 e3 5c 9f 10 07 .s.....4..%.\... 0030 26 b3 43 b4 61 04 de 23 4e 47 08 10 20 01 a0 78 &.C.a..#NG.. ..x 0040 2b 67 00 00 01 2c 3c 30 33 91 8f 52 3b 66 71 81 +g...,<03..R;fq. 0050 71 f6 75 32 d4 83 1a c4 a5 d3 3b 3b 88 4f f7 1f q.u2......;;.O.. 0060 2f 4a df 43 29 72 1b 17 52 ab a9 30 67 5d 64 57 /J.C)r..R..0g]dW 0070 77 9e 24 b3 cd 11 0d c5 5e 01 b9 4f 29 ea 4b 6b w.$.....^..O).Kk 0080 22 ad 57 cb 4e 89 ba c9 6d df 15 a6 30 84 75 90 ".W.N...m...0.u. 0090 67 7f 10 f9 04 82 8d 37 9b 7e f9 5d c0 83 32 21 g......7.~.]..2! 00a0 93 3b 89 14 15 a9 95 3d 69 db 6b 3e 31 7a 79 71 .;.....=i.k>1zyq 00b0 b2 1d 29 86 0e e4 94 80 7e 35 33 59 11 16 32 db ..).....~53Y..2. 00c0 55 a6 c5 ae c0 9b 3b b0 bb bb 75 d7 d4 80 ab 18 U.....;...u..... 00d0 2e 09 9b a0 5b 67 d9 46 dc 26 a3 2b 87 42 b4 49 ....[g.F.&.+.B.I 00e0 ac 6e 27 87 da a2 30 72 51 eb 0f 2a 25 1c 24 94 .n'...0rQ..*%.$. 00f0 04 78 b6 1e f5 f4 6d e7 28 57 1d 06 c1 06 35 0d .x....m.(W....5. 0100 f8 93 d8 e2 4d 59 31 d4 ef 2f 0a f2 9c 13 18 5f ....MY1../....._ 0110 95 99 96 87 b7 92 a5 c8 a1 c5 45 4d 75 59 60 f3 ..........EMuY`. 0120 6b 03 41 bf 95 9c c0 39 47 87 ea 94 15 46 48 45 k.A....9G....FHE 0130 2e 8e e2 ac de 96 b4 12 2c 6e 2d 3f 0d 14 2d af ........,n-?..-. 0140 a5 28 37 4a be d6 f3 af d5 27 02 c3 b5 65 79 a8 .(7J.....'...ey. 0150 39 3b 10 b4 09 11 9;.... Frame 10 (102 bytes on wire, 102 bytes captured) Arrival Time: Oct 29, 2006 11:35:25.753059000 Time delta from previous packet: 0.002090000 seconds Time since reference or first frame: 6.346639000 seconds Frame Number: 10 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Destination: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.101 (165.227.249.101) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0132 (306) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfac2 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.101 (165.227.249.101) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xa962 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x25E35C9F100726B3 Responder cookie: 0x43B46104DE234E47 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xA0782B67 Length: 60 Encrypted payload (32 bytes) 0000 00 0f b5 4b 45 e0 00 0c 29 ab 06 ab 08 00 45 00 ...KE...).....E. 0010 00 58 01 32 00 00 80 11 fa c2 a5 e3 f9 73 a5 e3 .X.2.........s.. 0020 f9 65 01 f4 01 f4 00 44 a9 62 25 e3 5c 9f 10 07 .e.....D.b%.\... 0030 26 b3 43 b4 61 04 de 23 4e 47 08 10 20 01 a0 78 &.C.a..#NG.. ..x 0040 2b 67 00 00 00 3c 69 14 47 1d 99 13 e5 d4 24 dc +g.....;... 0070 d8 c1 28 dc 99 a1 ed 43 b5 f4 fb 99 18 80 5c d5 ..(....C......\. 0080 4b 9f e6 07 dd 40 K....@ Frame 12 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 29, 2006 11:35:29.538416000 Time delta from previous packet: 0.004768000 seconds Time since reference or first frame: 10.131996000 seconds Frame Number: 12 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.101 (165.227.249.101), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x2b11 (11025) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x10a3 [correct] Good: True Bad : False Source: 165.227.249.101 (165.227.249.101) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x1a0ad664 Sequence: 1 Data (92 bytes) 0000 00 0c 29 ab 06 ab 00 0f b5 4b 45 e0 08 00 45 00 ..)......KE...E. 0010 00 78 2b 11 00 00 40 32 10 a3 a5 e3 f9 65 a5 e3 .x+...@2.....e.. 0020 f9 73 1a 0a d6 64 00 00 00 01 a3 1a 8f e1 d3 c4 .s...d.......... 0030 ed 8e 38 99 54 92 75 93 ad d8 37 42 fa 6a 6a 96 ..8.T.u...7B.jj. 0040 06 ff a5 ee ef 71 0a 71 33 17 b9 a9 74 5d b6 f2 .....q.q3...t].. 0050 6d d0 e1 5c ee 19 88 71 74 b8 2d a4 06 ef 8f 44 m..\...qt.-....D 0060 41 5a 43 67 67 93 70 57 24 73 5f e5 83 92 46 7d AZCgg.pW$s_...F} 0070 50 f8 ce b5 1c 5b 8c 0b 8f b5 cd de ba bf 61 7e P....[........a~ 0080 29 8f cc 3b 76 27 )..;v' Frame 13 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 29, 2006 11:35:30.567874000 Time delta from previous packet: 1.029458000 seconds Time since reference or first frame: 11.161454000 seconds Frame Number: 13 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Destination: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.101 (165.227.249.101) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfbb1 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.101 (165.227.249.101) Encapsulating Security Payload SPI: 0x02d945a7 Sequence: 2 Data (92 bytes) 0000 00 0f b5 4b 45 e0 00 0c 29 ab 06 ab 08 00 45 00 ...KE...).....E. 0010 00 78 00 02 00 00 80 32 fb b1 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 65 02 d9 45 a7 00 00 00 02 a2 f6 3b 08 ec bc .e..E.......;... 0030 d8 c1 28 dc 99 a1 ed 43 b5 f4 53 39 be 77 6b d2 ..(....C..S9.wk. 0040 ca 5e 6c ed d3 23 ed 99 92 e8 c9 11 3d 6c e3 af .^l..#......=l.. 0050 5d 54 66 c5 94 4c 80 e4 4e 5d 3c 5d 61 e0 2c af ]Tf..L..N]<]a.,. 0060 d8 2d 96 c4 ae f2 cd db aa d1 97 c8 14 9b e7 bb .-.............. 0070 9c 9c 5e 28 a9 46 38 eb 52 24 ca c9 b9 0e 23 50 ..^(.F8.R$....#P 0080 3c b7 e7 3d c4 fc <..=.. Frame 14 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 29, 2006 11:35:30.568906000 Time delta from previous packet: 0.001032000 seconds Time since reference or first frame: 11.162486000 seconds Frame Number: 14 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.101 (165.227.249.101), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x962d (38445) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xa586 [correct] Good: True Bad : False Source: 165.227.249.101 (165.227.249.101) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x1a0ad664 Sequence: 2 Data (92 bytes) 0000 00 0c 29 ab 06 ab 00 0f b5 4b 45 e0 08 00 45 00 ..)......KE...E. 0010 00 78 96 2d 00 00 40 32 a5 86 a5 e3 f9 65 a5 e3 .x.-..@2.....e.. 0020 f9 73 1a 0a d6 64 00 00 00 02 a3 1a 8f e1 d3 c4 .s...d.......... 0030 ed 8e 38 99 54 92 75 93 ad d8 a0 08 6c 82 c6 3e ..8.T.u.....l..> 0040 ca f2 e8 e8 d2 90 2b 42 00 f9 fe fe d0 1c a5 8c ......+B........ 0050 40 19 ab 3c 5a 11 3a 9a ab 77 fb 39 9b e9 be 1f @..