Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Sep 26, 2006 12:37:42.376965000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 166 bytes Capture Length: 166 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Destination: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.102 (165.227.249.102) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x005d (93) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfb56 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.102 (165.227.249.102) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x2807 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x52E77C722719EE24 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 e0 4c 69 0a 78 00 0c 29 ab 06 ab 08 00 45 00 ..Li.x..).....E. 0010 00 98 00 5d 00 00 80 11 fb 56 a5 e3 f9 73 a5 e3 ...].....V...s.. 0020 f9 66 01 f4 01 f4 00 84 28 07 52 e7 7c 72 27 19 .f......(.R.|r'. 0030 ee 24 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .$.............. 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (146 bytes on wire, 146 bytes captured) Arrival Time: Sep 26, 2006 12:37:42.502975000 Time delta from previous packet: 0.126010000 seconds Time since reference or first frame: 0.126010000 seconds Frame Number: 2 Packet Length: 146 bytes Capture Length: 146 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.102 (165.227.249.102), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x0018 (24) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbaf [correct] Good: True Bad : False Source: 165.227.249.102 (165.227.249.102) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0x3861 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x52E77C722719EE24 Responder cookie: 0xBABB7BE323C9AFFF Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 ab 06 ab 00 e0 4c 69 0a 78 08 00 45 00 ..).....Li.x..E. 0010 00 84 00 18 40 00 40 11 fb af a5 e3 f9 66 a5 e3 ....@.@......f.. 0020 f9 73 01 f4 01 f4 00 70 38 61 52 e7 7c 72 27 19 .s.....p8aR.|r'. 0030 ee 24 ba bb 7b e3 23 c9 af ff 01 10 02 00 00 00 .$..{.#......... 0040 00 00 00 00 00 68 0d 00 00 38 00 00 00 01 00 00 .....h...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 00 00 ................ 0080 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 0090 8b 35 .5 Frame 3 (298 bytes on wire, 298 bytes captured) Arrival Time: Sep 26, 2006 12:37:44.486470000 Time delta from previous packet: 1.983495000 seconds Time since reference or first frame: 2.109505000 seconds Frame Number: 3 Packet Length: 298 bytes Capture Length: 298 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Destination: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.102 (165.227.249.102) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x005e (94) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfad1 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.102 (165.227.249.102) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xaffe [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x52E77C722719EE24 Responder cookie: 0xBABB7BE323C9AFFF Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 e0 4c 69 0a 78 00 0c 29 ab 06 ab 08 00 45 00 ..Li.x..).....E. 0010 01 1c 00 5e 00 00 80 11 fa d1 a5 e3 f9 73 a5 e3 ...^.........s.. 0020 f9 66 01 f4 01 f4 01 08 af fe 52 e7 7c 72 27 19 .f........R.|r'. 0030 ee 24 ba bb 7b e3 23 c9 af ff 04 10 02 00 00 00 .$..{.#......... 0040 00 00 00 00 01 00 0a 00 00 84 8f 4b b4 01 47 86 ...........K..G. 0050 5d f4 ca 71 61 40 c8 d9 c7 ee 36 01 32 1c b4 7a ]..qa@....6.2..z 0060 85 5b e8 e7 ba 32 26 ef 52 23 20 ea 08 18 11 8c .[...2&.R# ..... 0070 09 d9 55 60 f6 25 1f e9 9f c3 48 ee 4c a7 aa f4 ..U`.%....H.L... 0080 f2 4d 4d ef c4 7c 5d 30 44 05 26 44 a3 6c c1 6c .MM..|]0D.&D.l.l 0090 e9 ee 4b 59 4b c2 79 bc 44 ac de 0d 0d 0d 02 2a ..KYK.y.D......* 00a0 38 d4 ed 0d 8f 63 ac 80 de 73 d9 ed 55 8a 5c 31 8....c...s..U.\1 00b0 4c 56 a4 9f 66 ef 58 32 c5 a5 a8 98 f7 cc 44 4b LV..f.X2......DK 00c0 7c 1f a2 67 9b bf 09 c3 2d 6f 0d 00 00 18 7d 0a |..g....-o....}. 00d0 72 1e 7a d0 77 3e 26 fe ac 20 fb 2a 61 62 12 99 r.z.w>&.. .*ab.. 00e0 9a a2 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 4 (242 bytes on wire, 242 bytes captured) Arrival Time: Sep 26, 2006 12:37:44.605263000 Time delta from previous packet: 0.118793000 seconds Time since reference or first frame: 2.228298000 seconds Frame Number: 4 Packet Length: 242 bytes Capture Length: 242 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.102 (165.227.249.102), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0019 (25) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb4e [correct] Good: True Bad : False Source: 165.227.249.102 (165.227.249.102) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0x0104 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x52E77C722719EE24 Responder cookie: 0xBABB7BE323C9AFFF Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 20 Nonce Data Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 ab 06 ab 00 e0 4c 69 0a 78 08 00 45 00 ..).....Li.x..E. 0010 00 e4 00 19 40 00 40 11 fb 4e a5 e3 f9 66 a5 e3 ....@.@..N...f.. 0020 f9 73 01 f4 01 f4 00 d0 01 04 52 e7 7c 72 27 19 .s........R.|r'. 0030 ee 24 ba bb 7b e3 23 c9 af ff 04 10 02 00 00 00 .$..{.#......... 0040 00 00 00 00 00 c8 0a 00 00 84 f2 d3 a2 a3 15 01 ................ 0050 a9 0c 7e 6b 36 6d c6 51 12 ad c3 27 1c f7 ff 5f ..~k6m.Q...'..._ 0060 48 e3 fa d6 10 61 dc 6e 12 1f 6e b0 82 63 0c 80 H....a.n..n..c.. 0070 9c c8 5c aa e3 97 cd df 2b 6d e9 da 2a a4 38 4f ..\.....+m..*.8O 0080 03 f6 47 c3 a5 4b 38 94 ee 02 55 43 75 6a 24 81 ..G..K8...UCuj$. 0090 0c 48 18 3d cc 3d f5 e7 7f 70 b9 7a c4 eb e3 92 .H.=.=...p.z.... 00a0 74 df 60 e1 10 6c 11 4a 57 29 09 3e 5b 4a 74 86 t.`..l.JW).>[Jt. 00b0 87 82 c8 05 d6 92 21 7b c8 d0 7c be 29 76 d2 b1 ......!{..|.)v.. 00c0 be b7 19 21 c8 2e 1a c1 bd 51 0d 00 00 14 e3 68 ...!.....Q.....h 00d0 ed 9c ec b2 a1 2a 0e 53 b6 6d 7c e8 fd 3e 00 00 .....*.S.m|..>.. 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 5 (134 bytes on wire, 134 bytes captured) Arrival Time: Sep 26, 2006 12:37:45.594913000 Time delta from previous packet: 0.989650000 seconds Time since reference or first frame: 3.217948000 seconds Frame Number: 5 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Destination: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.102 (165.227.249.102) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x005f (95) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfb74 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.102 (165.227.249.102) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xad31 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x52E77C722719EE24 Responder cookie: 0xBABB7BE323C9AFFF Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 e0 4c 69 0a 78 00 0c 29 ab 06 ab 08 00 45 00 ..Li.x..).....E. 0010 00 78 00 5f 00 00 80 11 fb 74 a5 e3 f9 73 a5 e3 .x._.....t...s.. 0020 f9 66 01 f4 01 f4 00 64 ad 31 52 e7 7c 72 27 19 .f.....d.1R.|r'. 0030 ee 24 ba bb 7b e3 23 c9 af ff 05 10 02 01 00 00 .$..{.#......... 0040 00 00 00 00 00 5c d3 1f 54 46 e9 94 1d 75 45 f7 .....\..TF...uE. 0050 71 ce 8b 95 a2 0e d8 df a9 b2 07 c9 7e 99 f0 f8 q...........~... 0060 ec a8 6f aa f2 93 80 f5 92 90 fa 38 a5 dd 6c ea ..o........8..l. 0070 cb d4 eb 99 ef ee 31 a4 fd c6 9e 21 29 ac 62 aa ......1....!).b. 0080 2c 81 fa 33 73 d1 ,..3s. Frame 6 (118 bytes on wire, 118 bytes captured) Arrival Time: Sep 26, 2006 12:37:45.645955000 Time delta from previous packet: 0.051042000 seconds Time since reference or first frame: 3.268990000 seconds Frame Number: 6 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.102 (165.227.249.102), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x001a (26) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc9 [correct] Good: True Bad : False Source: 165.227.249.102 (165.227.249.102) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x664d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x52E77C722719EE24 Responder cookie: 0xBABB7BE323C9AFFF Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 ab 06 ab 00 e0 4c 69 0a 78 08 00 45 00 ..).....Li.x..E. 0010 00 68 00 1a 40 00 40 11 fb c9 a5 e3 f9 66 a5 e3 .h..@.@......f.. 0020 f9 73 01 f4 01 f4 00 54 66 4d 52 e7 7c 72 27 19 .s.....TfMR.|r'. 0030 ee 24 ba bb 7b e3 23 c9 af ff 05 10 02 01 00 00 .$..{.#......... 0040 00 00 00 00 00 4c 4c 38 ce 78 ca 98 e9 41 e0 8a .....LL8.x...A.. 0050 32 8f 22 e4 c0 13 42 65 69 50 25 3c ed 37 5a 94 2."...BeiP%<.7Z. 0060 4a 27 60 a4 8b 0b 9b 1e 20 59 3d 48 79 b9 69 9b J'`..... Y=Hy.i. 0070 08 65 95 9b d2 c9 .e.... Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Sep 26, 2006 12:37:45.675175000 Time delta from previous packet: 0.029220000 seconds Time since reference or first frame: 3.298210000 seconds Frame Number: 7 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.102 (165.227.249.102), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x001b (27) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb8 [correct] Good: True Bad : False Source: 165.227.249.102 (165.227.249.102) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x93ae [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x52E77C722719EE24 Responder cookie: 0xBABB7BE323C9AFFF Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x90FD9A81 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 ab 06 ab 00 e0 4c 69 0a 78 08 00 45 00 ..).....Li.x..E. 0010 00 78 00 1b 40 00 40 11 fb b8 a5 e3 f9 66 a5 e3 .x..@.@......f.. 0020 f9 73 01 f4 01 f4 00 64 93 ae 52 e7 7c 72 27 19 .s.....d..R.|r'. 0030 ee 24 ba bb 7b e3 23 c9 af ff 08 10 05 01 90 fd .$..{.#......... 0040 9a 81 00 00 00 5c f5 5c 3c 40 48 44 20 73 1e 6c .....\.\<@HD s.l 0050 a4 36 a2 76 62 b7 1e 17 cb f6 b4 65 92 1f d9 af .6.vb......e.... 0060 63 e6 65 86 6d fa 37 da b6 f7 ee 11 9c 15 19 dd c.e.m.7......... 0070 42 65 77 23 94 83 a8 92 d3 6c e1 74 56 13 f0 6c Bew#.....l.tV..l 0080 67 4c f1 a5 7f 68 gL...h Frame 8 (342 bytes on wire, 342 bytes captured) Arrival Time: Sep 26, 2006 12:37:47.605052000 Time delta from previous packet: 1.929877000 seconds Time since reference or first frame: 5.228087000 seconds Frame Number: 8 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Destination: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.102 (165.227.249.102) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0062 (98) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfaa1 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.102 (165.227.249.102) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xf19a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x52E77C722719EE24 Responder cookie: 0xBABB7BE323C9AFFF Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xEBD11F1D Length: 300 Encrypted payload (272 bytes) 0000 00 e0 4c 69 0a 78 00 0c 29 ab 06 ab 08 00 45 00 ..Li.x..).....E. 0010 01 48 00 62 00 00 80 11 fa a1 a5 e3 f9 73 a5 e3 .H.b.........s.. 0020 f9 66 01 f4 01 f4 01 34 f1 9a 52 e7 7c 72 27 19 .f.....4..R.|r'. 0030 ee 24 ba bb 7b e3 23 c9 af ff 08 10 20 01 eb d1 .$..{.#..... ... 0040 1f 1d 00 00 01 2c b2 17 80 31 cd 3f 42 08 3c 85 .....,...1.?B.<. 0050 98 e1 64 10 bc 26 db 94 f3 e3 cf 7e 54 56 04 d4 ..d..&.....~TV.. 0060 50 7e 46 c0 76 16 d2 15 e9 99 07 8a 85 d5 4c 13 P~F.v.........L. 0070 0b 77 50 82 83 af 7f d8 3d 2c e8 ef 31 4e be 29 .wP.....=,..1N.) 0080 83 6c f0 27 2a 5b 36 70 ba 17 f2 40 f8 b2 c5 aa .l.'*[6p...@.... 0090 2e a4 8c 4d 59 d2 5a 86 54 9f c3 10 28 3a 5e 92 ...MY.Z.T...(:^. 00a0 a1 60 c3 d7 26 12 3e 24 49 ad 99 f2 fd b6 e9 ab .`..&.>$I....... 00b0 9d b4 ad ef 86 67 30 9c 8c 05 75 b4 2d 78 45 73 .....g0...u.-xEs 00c0 28 66 f4 55 9d 2f b2 ba b1 61 28 be 90 78 77 ed (f.U./...a(..xw. 00d0 48 70 47 a1 4a 9e cf f0 19 57 65 b3 28 54 ff 0b HpG.J....We.(T.. 00e0 c6 a4 ae 29 f9 db 75 a8 06 1b 52 02 7b 3b ef 98 ...)..u...R.{;.. 00f0 b3 68 ec 36 96 1d c2 5b 8f 48 5f 93 bb 90 24 fe .h.6...[.H_...$. 0100 2b aa df 5d 13 d2 bc 79 2f 80 96 23 c8 5b 08 63 +..]...y/..#.[.c 0110 43 3c 7a 67 a2 df de 73 08 ad d9 2c 1c 6d 28 1c C...... 0060 22 92 61 b3 d8 ab 22 7d 40 2d 52 3f 72 93 4b 76 ".a..."}@-R?r.Kv 0070 34 55 a2 3e 14 fc 58 5d 8c d3 68 50 65 f8 7f fa 4U.>..X]..hPe... 0080 69 b5 69 90 be 7b 65 8f e8 b4 ee d4 d1 ff d6 5c i.i..{e........\ 0090 25 98 75 71 98 92 66 4a e8 6b 6f 1f 90 10 3f 20 %.uq..fJ.ko...? 00a0 5a 42 ba e2 60 07 39 2e dc cc 18 c3 51 9e 6b a3 ZB..`.9.....Q.k. 00b0 f7 09 83 4c 23 3f 8e 55 f2 a6 4d 6c ed 95 3e 95 ...L#?.U..Ml..>. 00c0 18 d1 73 45 99 68 54 a9 f9 7a 99 5a 6c 9b fd 2c ..sE.hT..z.Zl.., 00d0 1e 05 7f 3e d5 02 6a 00 74 7f b1 e6 09 f1 e8 f4 ...>..j.t....... 00e0 73 5b 17 17 9a 18 52 f7 84 55 57 d1 fc ff 4c 4d s[....R..UW...LM 00f0 9c ea 99 90 ee b4 7b 78 af 8e b8 64 4c 9f e7 12 ......{x...dL... 0100 e3 81 56 03 85 25 16 22 3e 4c fb d1 de e1 4d 1a ..V..%.">L....M. 0110 35 ee af 48 fb 46 9a bf 46 8f d6 33 bd f2 d9 ec 5..H.F..F..3.... 0120 a1 15 00 85 bf ea 31 47 22 cb 2c eb f8 04 8b 0b ......1G".,..... 0130 1d e4 28 77 85 d3 76 94 8a c7 7e 92 77 b0 9b 8e ..(w..v...~.w... 0140 5a 25 17 a0 61 6b 60 25 74 83 3e 3e db 72 7e cb Z%..ak`%t.>>.r~. 0150 5a cf 1c 42 51 2b Z..BQ+ Frame 10 (102 bytes on wire, 102 bytes captured) Arrival Time: Sep 26, 2006 12:37:47.885660000 Time delta from previous packet: 0.006393000 seconds Time since reference or first frame: 5.508695000 seconds Frame Number: 10 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Destination: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.102 (165.227.249.102) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0064 (100) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfb8f [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.102 (165.227.249.102) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x071d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x52E77C722719EE24 Responder cookie: 0xBABB7BE323C9AFFF Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xEBD11F1D Length: 60 Encrypted payload (32 bytes) 0000 00 e0 4c 69 0a 78 00 0c 29 ab 06 ab 08 00 45 00 ..Li.x..).....E. 0010 00 58 00 64 00 00 80 11 fb 8f a5 e3 f9 73 a5 e3 .X.d.........s.. 0020 f9 66 01 f4 01 f4 00 44 07 1d 52 e7 7c 72 27 19 .f.....D..R.|r'. 0030 ee 24 ba bb 7b e3 23 c9 af ff 08 10 20 01 eb d1 .$..{.#..... ... 0040 1f 1d 00 00 00 3c 2a 9a 61 1b 70 e7 d2 3b a1 13 .....<*.a.p..;.. 0050 f4 a9 6c 19 fc f7 a6 b2 4c b2 80 a9 e7 97 ef 1a ..l.....L....... 0060 28 2b 98 b7 ba 37 (+...7 Frame 11 (134 bytes on wire, 134 bytes captured) Arrival Time: Sep 26, 2006 12:37:52.408167000 Time delta from previous packet: 4.522507000 seconds Time since reference or first frame: 10.031202000 seconds Frame Number: 11 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Destination: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.102 (165.227.249.102) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfbb1 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.102 (165.227.249.102) Encapsulating Security Payload SPI: 0x01e1ce0f Sequence: 1 Data (92 bytes) 0000 00 e0 4c 69 0a 78 00 0c 29 ab 06 ab 08 00 45 00 ..Li.x..).....E. 0010 00 78 00 01 00 00 80 32 fb b1 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 66 01 e1 ce 0f 00 00 00 01 4f 80 e5 37 b7 a3 .f........O..7.. 0030 04 7d 84 09 f4 16 8a 89 aa b2 26 54 14 9d 0a fa .}........&T.... 0040 85 f3 c0 d4 fd 05 7d 46 fc 3a f1 d7 80 88 9c 26 ......}F.:.....& 0050 14 3a f2 29 fd 74 f2 a7 37 7a cc 14 d2 94 7f a0 .:.).t..7z...... 0060 ae 20 4e 99 ce f5 32 4f 15 a8 1e c5 b9 e1 eb 37 . N...2O.......7 0070 57 56 4d 34 5b 47 5c 70 50 2a 24 8b 05 dc 07 c5 WVM4[G\pP*$..... 0080 52 88 63 14 1a 5e R.c..^ Frame 12 (134 bytes on wire, 134 bytes captured) Arrival Time: Sep 26, 2006 12:37:52.442218000 Time delta from previous packet: 0.034051000 seconds Time since reference or first frame: 10.065253000 seconds Frame Number: 12 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.102 (165.227.249.102), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x3bb2 [correct] Good: True Bad : False Source: 165.227.249.102 (165.227.249.102) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0xd20efb29 Sequence: 1 Data (92 bytes) 0000 00 0c 29 ab 06 ab 00 e0 4c 69 0a 78 08 00 45 00 ..).....Li.x..E. 0010 00 78 00 01 00 00 40 32 3b b2 a5 e3 f9 66 a5 e3 .x....@2;....f.. 0020 f9 73 d2 0e fb 29 00 00 00 01 e1 91 4f 34 eb 67 .s...)......O4.g 0030 c6 f9 20 2c 0a d0 33 38 d9 e8 55 e3 a4 be fd 27 .. ,..38..U....' 0040 46 19 e5 77 fd bb 2d 60 99 6f ba 4e 5a c2 ce 95 F..w..-`.o.NZ... 0050 a6 89 18 bb e2 f1 82 c7 ef e9 9c 85 72 22 20 27 ............r" ' 0060 32 b9 ad 50 77 93 92 8f 02 a3 9e d3 35 e5 6f cf 2..Pw.......5.o. 0070 89 20 5e 6f 1a ec 09 1a fd 59 7a 9d 81 16 36 11 . ^o.....Yz...6. 0080 f1 02 ae 4d d6 12 ...M.. Frame 13 (134 bytes on wire, 134 bytes captured) Arrival Time: Sep 26, 2006 12:37:53.416734000 Time delta from previous packet: 0.974516000 seconds Time since reference or first frame: 11.039769000 seconds Frame Number: 13 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Destination: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.102 (165.227.249.102) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfbb0 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.102 (165.227.249.102) Encapsulating Security Payload SPI: 0x01e1ce0f Sequence: 2 Data (92 bytes) 0000 00 e0 4c 69 0a 78 00 0c 29 ab 06 ab 08 00 45 00 ..Li.x..).....E. 0010 00 78 00 02 00 00 80 32 fb b0 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 66 01 e1 ce 0f 00 00 00 02 1e c5 b9 e1 eb 37 .f.............7 0030 57 56 4d 34 5b 47 5c 70 50 2a 07 3b af 9a 29 1e WVM4[G\pP*.;..). 0040 58 e2 f3 5a bc 49 93 d4 96 74 5d f5 c3 f7 cb ad X..Z.I...t]..... 0050 cf 9e af 2f a4 b1 23 7c 27 50 aa 87 9a ae 20 2c .../..#|'P.... , 0060 30 6b cd 4b 5b 66 b2 1f 6b 6a 27 96 d9 57 c4 01 0k.K[f..kj'..W.. 0070 bf 3a 17 65 e5 a1 a5 16 09 83 12 3b 60 46 26 6a .:.e.......;`F&j 0080 7a ec 3f ed 87 ea z.?... Frame 14 (134 bytes on wire, 134 bytes captured) Arrival Time: Sep 26, 2006 12:37:53.487253000 Time delta from previous packet: 0.070519000 seconds Time since reference or first frame: 11.110288000 seconds Frame Number: 14 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.102 (165.227.249.102), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x3bb1 [correct] Good: True Bad : False Source: 165.227.249.102 (165.227.249.102) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0xd20efb29 Sequence: 2 Data (92 bytes) 0000 00 0c 29 ab 06 ab 00 e0 4c 69 0a 78 08 00 45 00 ..).....Li.x..E. 0010 00 78 00 02 00 00 40 32 3b b1 a5 e3 f9 66 a5 e3 .x....@2;....f.. 0020 f9 73 d2 0e fb 29 00 00 00 02 ee f6 c3 38 41 d4 .s...).......8A. 0030 dd 30 fb 92 7f ff f3 b6 b7 66 c0 51 6f e1 c3 86 .0.......f.Qo... 0040 a3 a1 5c 69 5c 2c eb 31 52 3c 59 a8 d0 b6 f9 de ..\i\,.1R 0060 2c cf d6 cd 3e 0b 4c 49 88 5b b0 db f1 07 5f 49 ,...>.LI.[...._I 0070 d9 e5 3b 81 5b a7 62 ba be 60 f2 81 cf 17 27 cd ..;.[.b..`....'. 0080 2d 0b 57 05 bb e2 -.W...