Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Oct 19, 2010 18:41:22.006618000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x01e6 (486) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9cb [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x08af [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 177993B7B350A56C Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 17 c5 6d 9d fd 00 0c 29 3f 71 77 08 00 45 00 ...m....)?qw..E. 0010 00 98 01 e6 00 00 80 11 f9 cb a5 e3 f9 73 a5 e3 .............s.. 0020 f9 68 01 f4 01 f4 00 84 08 af 17 79 93 b7 b3 50 .h.........y...P 0030 a5 6c 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .l.............. 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (166 bytes on wire, 166 bytes captured) Arrival Time: Oct 19, 2010 18:41:22.006642000 [Time delta from previous captured frame: 0.000024000 seconds] [Time delta from previous displayed frame: 0.000024000 seconds] [Time since reference or first frame: 0.000024000 seconds] Frame Number: 2 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x01e6 (486) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9cb [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x08af [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 177993B7B350A56C Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 17 c5 6d 9d fd 00 0c 29 3f 71 77 08 00 45 00 ...m....)?qw..E. 0010 00 98 01 e6 00 00 80 11 f9 cb a5 e3 f9 73 a5 e3 .............s.. 0020 f9 68 01 f4 01 f4 00 84 08 af 17 79 93 b7 b3 50 .h.........y...P 0030 a5 6c 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .l.............. 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 3 (158 bytes on wire, 158 bytes captured) Arrival Time: Oct 19, 2010 18:41:22.009637000 [Time delta from previous captured frame: 0.002995000 seconds] [Time delta from previous displayed frame: 0.002995000 seconds] [Time since reference or first frame: 0.003019000 seconds] Frame Number: 3 Frame Length: 158 bytes Capture Length: 158 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd), Dst: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Destination: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.104 (165.227.249.104), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 144 Identification: 0x0d76 (3446) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x6f43 [correct] [Good: True] [Bad : False] Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 124 Checksum: 0x76d1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 177993B7B350A56C Responder cookie: EA1785751E2BB1F4 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 116 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: 5B362BC820F60007 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: 5B362BC820F60007 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 0c 29 3f 71 77 00 17 c5 6d 9d fd 08 00 45 00 ..)?qw...m....E. 0010 00 90 0d 76 00 00 ff 11 6f 43 a5 e3 f9 68 a5 e3 ...v....oC...h.. 0020 f9 73 01 f4 01 f4 00 7c 76 d1 17 79 93 b7 b3 50 .s.....|v..y...P 0030 a5 6c ea 17 85 75 1e 2b b1 f4 01 10 02 00 00 00 .l...u.+........ 0040 00 00 00 00 00 74 0d 00 00 38 00 00 00 01 00 00 .....t...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 0c 5b 36 2b c8 20 f6 00 07 00 00 00 14 90 cb ..[6+. ......... 0090 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f ..>.in.c...B{. Frame 4 (346 bytes on wire, 346 bytes captured) Arrival Time: Oct 19, 2010 18:41:23.727962000 [Time delta from previous captured frame: 1.718325000 seconds] [Time delta from previous displayed frame: 1.718325000 seconds] [Time since reference or first frame: 1.721344000 seconds] Frame Number: 4 Frame Length: 346 bytes Capture Length: 346 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x01ea (490) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf913 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xb8b4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 177993B7B350A56C Responder cookie: EA1785751E2BB1F4 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: 8439F16D2B3DB0619EEEB5726E94513C240E8448 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: Vendor ID (13) Payload length: 24 Hash of address and port: 497697F55220C334220B037FF6F1299040D307F8 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 17 c5 6d 9d fd 00 0c 29 3f 71 77 08 00 45 00 ...m....)?qw..E. 0010 01 4c 01 ea 00 00 80 11 f9 13 a5 e3 f9 73 a5 e3 .L...........s.. 0020 f9 68 01 f4 01 f4 01 38 b8 b4 17 79 93 b7 b3 50 .h.....8...y...P 0030 a5 6c ea 17 85 75 1e 2b b1 f4 04 10 02 00 00 00 .l...u.+........ 0040 00 00 00 00 01 30 0a 00 00 84 c9 5b 54 26 04 83 .....0.....[T&.. 0050 fb 92 18 2d 6a d6 c3 19 8a 9f f5 03 ab f6 98 7d ...-j..........} 0060 17 bf 68 43 e5 6b 74 1c 82 ca c5 21 91 ce 85 51 ..hC.kt....!...Q 0070 0e f2 91 86 66 2d 97 0a 4e a7 58 ea 90 2b 7a e0 ....f-..N.X..+z. 0080 09 4f b5 9e 24 cd e2 59 ce fc ad 99 15 ef d1 a1 .O..$..Y........ 0090 b8 a4 b5 ae 03 f5 80 42 41 fa a6 75 5b 7d c9 87 .......BA..u[}.. 00a0 bc 27 dc bf f8 f1 12 28 28 2b 5d 43 58 bf 35 de .'.....((+]CX.5. 00b0 ee 8c a7 8f db 7e 02 b5 42 92 72 1f 90 17 93 bb .....~..B.r..... 00c0 11 51 73 0c 81 5b 02 73 69 94 82 00 00 18 cd 7f .Qs..[.si....... 00d0 7f fa 62 6e cb 11 ce 56 73 4d ab 4b 27 51 f5 67 ..bn...VsM.K'Q.g 00e0 5b 86 82 00 00 18 84 39 f1 6d 2b 3d b0 61 9e ee [......9.m+=.a.. 00f0 b5 72 6e 94 51 3c 24 0e 84 48 0d 00 00 18 49 76 .rn.Q<$..H....Iv 0100 97 f5 52 20 c3 34 22 0b 03 7f f6 f1 29 90 40 d3 ..R .4".....).@. 0110 07 f8 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 5 (346 bytes on wire, 346 bytes captured) Arrival Time: Oct 19, 2010 18:41:23.727986000 [Time delta from previous captured frame: 0.000024000 seconds] [Time delta from previous displayed frame: 0.000024000 seconds] [Time since reference or first frame: 1.721368000 seconds] Frame Number: 5 Frame Length: 346 bytes Capture Length: 346 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x01ea (490) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf913 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xb8b4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 177993B7B350A56C Responder cookie: EA1785751E2BB1F4 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: 8439F16D2B3DB0619EEEB5726E94513C240E8448 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: Vendor ID (13) Payload length: 24 Hash of address and port: 497697F55220C334220B037FF6F1299040D307F8 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 17 c5 6d 9d fd 00 0c 29 3f 71 77 08 00 45 00 ...m....)?qw..E. 0010 01 4c 01 ea 00 00 80 11 f9 13 a5 e3 f9 73 a5 e3 .L...........s.. 0020 f9 68 01 f4 01 f4 01 38 b8 b4 17 79 93 b7 b3 50 .h.....8...y...P 0030 a5 6c ea 17 85 75 1e 2b b1 f4 04 10 02 00 00 00 .l...u.+........ 0040 00 00 00 00 01 30 0a 00 00 84 c9 5b 54 26 04 83 .....0.....[T&.. 0050 fb 92 18 2d 6a d6 c3 19 8a 9f f5 03 ab f6 98 7d ...-j..........} 0060 17 bf 68 43 e5 6b 74 1c 82 ca c5 21 91 ce 85 51 ..hC.kt....!...Q 0070 0e f2 91 86 66 2d 97 0a 4e a7 58 ea 90 2b 7a e0 ....f-..N.X..+z. 0080 09 4f b5 9e 24 cd e2 59 ce fc ad 99 15 ef d1 a1 .O..$..Y........ 0090 b8 a4 b5 ae 03 f5 80 42 41 fa a6 75 5b 7d c9 87 .......BA..u[}.. 00a0 bc 27 dc bf f8 f1 12 28 28 2b 5d 43 58 bf 35 de .'.....((+]CX.5. 00b0 ee 8c a7 8f db 7e 02 b5 42 92 72 1f 90 17 93 bb .....~..B.r..... 00c0 11 51 73 0c 81 5b 02 73 69 94 82 00 00 18 cd 7f .Qs..[.si....... 00d0 7f fa 62 6e cb 11 ce 56 73 4d ab 4b 27 51 f5 67 ..bn...VsM.K'Q.g 00e0 5b 86 82 00 00 18 84 39 f1 6d 2b 3d b0 61 9e ee [......9.m+=.a.. 00f0 b5 72 6e 94 51 3c 24 0e 84 48 0d 00 00 18 49 76 .rn.Q<$..H....Iv 0100 97 f5 52 20 c3 34 22 0b 03 7f f6 f1 29 90 40 d3 ..R .4".....).@. 0110 07 f8 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 6 (310 bytes on wire, 310 bytes captured) Arrival Time: Oct 19, 2010 18:41:23.775799000 [Time delta from previous captured frame: 0.047813000 seconds] [Time delta from previous displayed frame: 0.047813000 seconds] [Time since reference or first frame: 1.769181000 seconds] Frame Number: 6 Frame Length: 310 bytes Capture Length: 310 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd), Dst: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Destination: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.104 (165.227.249.104), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 296 Identification: 0x0d76 (3446) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x6eab [correct] [Good: True] [Bad : False] Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 276 Checksum: 0x240e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 177993B7B350A56C Responder cookie: EA1785751E2BB1F4 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 268 Key Exchange payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: 497697F55220C334220B037FF6F1299040D307F8 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: Nonce (10) Payload length: 24 Hash of address and port: 8439F16D2B3DB0619EEEB5726E94513C240E8448 Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 404BF439522CA3F6 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: 404BF439522CA3F6 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: Vendor ID (13) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt Vendor ID: DA8E937880010000 Next payload: NONE (0) Payload length: 12 Vendor ID: DA8E937880010000 0000 00 0c 29 3f 71 77 00 17 c5 6d 9d fd 08 00 45 00 ..)?qw...m....E. 0010 01 28 0d 76 00 00 ff 11 6e ab a5 e3 f9 68 a5 e3 .(.v....n....h.. 0020 f9 73 01 f4 01 f4 01 14 24 0e 17 79 93 b7 b3 50 .s......$..y...P 0030 a5 6c ea 17 85 75 1e 2b b1 f4 04 10 02 00 00 00 .l...u.+........ 0040 00 00 00 00 01 0c 82 00 00 84 d2 10 fd e3 b4 c1 ................ 0050 db 3c 34 23 4c 4d 44 4d e2 2f 80 5e 35 08 2e 69 .<4#LMDM./.^5..i 0060 e6 63 9d 6c 8b b3 05 1f fa 1f a3 13 f9 b0 b4 e9 .c.l............ 0070 62 01 ee c9 58 96 c7 82 53 db 4d a1 b8 98 bc 64 b...X...S.M....d 0080 45 c6 a3 48 d5 ff 00 b9 27 f4 29 73 e0 32 89 0a E..H....'.)s.2.. 0090 ce 6d 14 42 40 ce 1a cc 54 76 18 0a 12 9b d7 25 .m.B@...Tv.....% 00a0 b2 49 86 61 50 9c 9b 8b e1 7b ae c8 9c 15 1b 14 .I.aP....{...... 00b0 b9 22 ef fe d1 d1 89 c0 10 1c 7c 83 a0 1a 9a 5e ."........|....^ 00c0 b8 6f 0c 58 f7 57 03 fe 94 cc 82 00 00 18 49 76 .o.X.W........Iv 00d0 97 f5 52 20 c3 34 22 0b 03 7f f6 f1 29 90 40 d3 ..R .4".....).@. 00e0 07 f8 0a 00 00 18 84 39 f1 6d 2b 3d b0 61 9e ee .......9.m+=.a.. 00f0 b5 72 6e 94 51 3c 24 0e 84 48 0d 00 00 18 ca de .rn.Q<$..H...... 0100 e9 ca 63 bf 2a d0 fc 11 0d ee 81 2a 89 55 ce 48 ..c.*......*.U.H 0110 0f 85 0d 00 00 0c 40 4b f4 39 52 2c a3 f6 0d 00 ......@K.9R,.... 0120 00 0c 09 00 26 89 df d6 b7 12 00 00 00 0c da 8e ....&........... 0130 93 78 80 01 00 00 .x.... Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 19, 2010 18:41:24.757047000 [Time delta from previous captured frame: 0.981248000 seconds] [Time delta from previous displayed frame: 0.981248000 seconds] [Time since reference or first frame: 2.750429000 seconds] Frame Number: 7 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x01ee (494) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9e3 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xd29e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 177993B7B350A56C Responder cookie: EA1785751E2BB1F4 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 17 c5 6d 9d fd 00 0c 29 3f 71 77 08 00 45 00 ...m....)?qw..E. 0010 00 78 01 ee 00 00 80 11 f9 e3 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 68 01 f4 01 f4 00 64 d2 9e 17 79 93 b7 b3 50 .h.....d...y...P 0030 a5 6c ea 17 85 75 1e 2b b1 f4 05 10 02 01 00 00 .l...u.+........ 0040 00 00 00 00 00 5c 5d 7f 14 4b 94 60 c9 a7 b9 36 .....\]..K.`...6 0050 2b 5e 6d 58 43 80 fb 1f 28 95 db 2c 0a 42 74 02 +^mXC...(..,.Bt. 0060 e0 b7 35 b7 bd d2 25 de 9c 81 2a af b4 94 88 a8 ..5...%...*..... 0070 58 97 be 31 bd 11 bf 44 09 c5 ec 0f 6a 95 9f 6d X..1...D....j..m 0080 0e 0a 25 f1 f7 0b ..%... Frame 8 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 19, 2010 18:41:24.757076000 [Time delta from previous captured frame: 0.000029000 seconds] [Time delta from previous displayed frame: 0.000029000 seconds] [Time since reference or first frame: 2.750458000 seconds] Frame Number: 8 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x01ee (494) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9e3 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xd29e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 177993B7B350A56C Responder cookie: EA1785751E2BB1F4 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 17 c5 6d 9d fd 00 0c 29 3f 71 77 08 00 45 00 ...m....)?qw..E. 0010 00 78 01 ee 00 00 80 11 f9 e3 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 68 01 f4 01 f4 00 64 d2 9e 17 79 93 b7 b3 50 .h.....d...y...P 0030 a5 6c ea 17 85 75 1e 2b b1 f4 05 10 02 01 00 00 .l...u.+........ 0040 00 00 00 00 00 5c 5d 7f 14 4b 94 60 c9 a7 b9 36 .....\]..K.`...6 0050 2b 5e 6d 58 43 80 fb 1f 28 95 db 2c 0a 42 74 02 +^mXC...(..,.Bt. 0060 e0 b7 35 b7 bd d2 25 de 9c 81 2a af b4 94 88 a8 ..5...%...*..... 0070 58 97 be 31 bd 11 bf 44 09 c5 ec 0f 6a 95 9f 6d X..1...D....j..m 0080 0e 0a 25 f1 f7 0b ..%... Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: Oct 19, 2010 18:41:24.758791000 [Time delta from previous captured frame: 0.001715000 seconds] [Time delta from previous displayed frame: 0.001715000 seconds] [Time since reference or first frame: 2.752173000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd), Dst: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Destination: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.104 (165.227.249.104), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0d76 (3446) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x6f6b [correct] [Good: True] [Bad : False] Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x4e1b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 177993B7B350A56C Responder cookie: EA1785751E2BB1F4 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 3f 71 77 00 17 c5 6d 9d fd 08 00 45 00 ..)?qw...m....E. 0010 00 68 0d 76 00 00 ff 11 6f 6b a5 e3 f9 68 a5 e3 .h.v....ok...h.. 0020 f9 73 01 f4 01 f4 00 54 4e 1b 17 79 93 b7 b3 50 .s.....TN..y...P 0030 a5 6c ea 17 85 75 1e 2b b1 f4 05 10 02 01 00 00 .l...u.+........ 0040 00 00 00 00 00 4c 56 ce 74 17 05 81 cb df be d7 .....LV.t....... 0050 eb 70 96 55 f6 1c e2 81 cb 21 01 1b 88 7a cb 3f .p.U.....!...z.? 0060 ba c1 dc 66 23 7d 85 15 ff ea 92 ee 5e 23 40 4a ...f#}......^#@J 0070 2a fd 45 ea 6c 42 *.E.lB Frame 10 (342 bytes on wire, 342 bytes captured) Arrival Time: Oct 19, 2010 18:41:26.967418000 [Time delta from previous captured frame: 2.208627000 seconds] [Time delta from previous displayed frame: 2.208627000 seconds] [Time since reference or first frame: 4.960800000 seconds] Frame Number: 10 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x01f7 (503) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf90a [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x9ca2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 177993B7B350A56C Responder cookie: EA1785751E2BB1F4 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x746fedd4 Length: 300 Encrypted payload (272 bytes) 0000 00 17 c5 6d 9d fd 00 0c 29 3f 71 77 08 00 45 00 ...m....)?qw..E. 0010 01 48 01 f7 00 00 80 11 f9 0a a5 e3 f9 73 a5 e3 .H...........s.. 0020 f9 68 01 f4 01 f4 01 34 9c a2 17 79 93 b7 b3 50 .h.....4...y...P 0030 a5 6c ea 17 85 75 1e 2b b1 f4 08 10 20 01 74 6f .l...u.+.... .to 0040 ed d4 00 00 01 2c 95 2f e8 86 53 e0 cd b1 93 75 .....,./..S....u 0050 eb 02 9b c4 4a e4 c4 b6 e7 84 5f 55 8e ab 61 0c ....J....._U..a. 0060 a6 3c 6c a6 ab 9b e8 5e 81 4f f9 7a ca b3 db d9 .....LH 0080 6e 92 9c 03 82 24 63 67 cb b8 3c 0b 33 cb 91 b6 n....$cg..<.3... 0090 ee e4 3d 95 51 cc a4 2e 12 11 5f 3b 60 19 69 13 ..=.Q....._;`.i. 00a0 22 a9 f3 63 bb 11 e8 a2 47 9d 63 eb 19 79 f9 11 "..c....G.c..y.. 00b0 2e 5b 40 29 b5 17 79 13 d1 e3 80 25 e1 68 e3 6e .[@)..y....%.h.n 00c0 c0 d6 e2 c0 ea a1 cc dd a8 6a 45 04 88 7d 30 ed .........jE..}0. 00d0 bb 96 0e 27 d6 a8 0e af 14 49 41 3e 7b e4 ce b0 ...'.....IA>{... 00e0 23 8e 95 a4 4d 6d 03 47 af 73 bd 09 39 69 00 0a #...Mm.G.s..9i.. 00f0 41 89 29 19 69 96 b9 c8 de d1 d8 9a a6 54 9b 25 A.).i........T.% 0100 60 38 f2 4c ff 85 77 2c b1 0b d9 64 33 47 80 50 `8.L..w,...d3G.P 0110 72 c6 58 ad 6d af a6 82 8d 68 b6 ea e9 ad 3d ab r.X.m....h....=. 0120 b1 e6 b6 c9 33 e5 3f d3 a4 14 bc 10 d9 d9 7b 57 ....3.?.......{W 0130 94 a4 50 a0 44 cc 60 2e 82 5d ef 9b c3 cb b5 6e ..P.D.`..].....n 0140 8c 1e 3b 32 cb b7 be b8 cd 28 33 56 19 2e 38 ae ..;2.....(3V..8. 0150 10 19 ea e9 30 f0 ....0. Frame 11 (342 bytes on wire, 342 bytes captured) Arrival Time: Oct 19, 2010 18:41:26.967446000 [Time delta from previous captured frame: 0.000028000 seconds] [Time delta from previous displayed frame: 0.000028000 seconds] [Time since reference or first frame: 4.960828000 seconds] Frame Number: 11 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x01f7 (503) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf90a [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x9ca2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 177993B7B350A56C Responder cookie: EA1785751E2BB1F4 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x746fedd4 Length: 300 Encrypted payload (272 bytes) 0000 00 17 c5 6d 9d fd 00 0c 29 3f 71 77 08 00 45 00 ...m....)?qw..E. 0010 01 48 01 f7 00 00 80 11 f9 0a a5 e3 f9 73 a5 e3 .H...........s.. 0020 f9 68 01 f4 01 f4 01 34 9c a2 17 79 93 b7 b3 50 .h.....4...y...P 0030 a5 6c ea 17 85 75 1e 2b b1 f4 08 10 20 01 74 6f .l...u.+.... .to 0040 ed d4 00 00 01 2c 95 2f e8 86 53 e0 cd b1 93 75 .....,./..S....u 0050 eb 02 9b c4 4a e4 c4 b6 e7 84 5f 55 8e ab 61 0c ....J....._U..a. 0060 a6 3c 6c a6 ab 9b e8 5e 81 4f f9 7a ca b3 db d9 .....LH 0080 6e 92 9c 03 82 24 63 67 cb b8 3c 0b 33 cb 91 b6 n....$cg..<.3... 0090 ee e4 3d 95 51 cc a4 2e 12 11 5f 3b 60 19 69 13 ..=.Q....._;`.i. 00a0 22 a9 f3 63 bb 11 e8 a2 47 9d 63 eb 19 79 f9 11 "..c....G.c..y.. 00b0 2e 5b 40 29 b5 17 79 13 d1 e3 80 25 e1 68 e3 6e .[@)..y....%.h.n 00c0 c0 d6 e2 c0 ea a1 cc dd a8 6a 45 04 88 7d 30 ed .........jE..}0. 00d0 bb 96 0e 27 d6 a8 0e af 14 49 41 3e 7b e4 ce b0 ...'.....IA>{... 00e0 23 8e 95 a4 4d 6d 03 47 af 73 bd 09 39 69 00 0a #...Mm.G.s..9i.. 00f0 41 89 29 19 69 96 b9 c8 de d1 d8 9a a6 54 9b 25 A.).i........T.% 0100 60 38 f2 4c ff 85 77 2c b1 0b d9 64 33 47 80 50 `8.L..w,...d3G.P 0110 72 c6 58 ad 6d af a6 82 8d 68 b6 ea e9 ad 3d ab r.X.m....h....=. 0120 b1 e6 b6 c9 33 e5 3f d3 a4 14 bc 10 d9 d9 7b 57 ....3.?.......{W 0130 94 a4 50 a0 44 cc 60 2e 82 5d ef 9b c3 cb b5 6e ..P.D.`..].....n 0140 8c 1e 3b 32 cb b7 be b8 cd 28 33 56 19 2e 38 ae ..;2.....(3V..8. 0150 10 19 ea e9 30 f0 ....0. Frame 12 (342 bytes on wire, 342 bytes captured) Arrival Time: Oct 19, 2010 18:41:27.014930000 [Time delta from previous captured frame: 0.047484000 seconds] [Time delta from previous displayed frame: 0.047484000 seconds] [Time since reference or first frame: 5.008312000 seconds] Frame Number: 12 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd), Dst: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Destination: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.104 (165.227.249.104), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0d76 (3446) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x6e8b [correct] [Good: True] [Bad : False] Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x8d23 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 177993B7B350A56C Responder cookie: EA1785751E2BB1F4 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x746fedd4 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 3f 71 77 00 17 c5 6d 9d fd 08 00 45 00 ..)?qw...m....E. 0010 01 48 0d 76 00 00 ff 11 6e 8b a5 e3 f9 68 a5 e3 .H.v....n....h.. 0020 f9 73 01 f4 01 f4 01 34 8d 23 17 79 93 b7 b3 50 .s.....4.#.y...P 0030 a5 6c ea 17 85 75 1e 2b b1 f4 08 10 20 01 74 6f .l...u.+.... .to 0040 ed d4 00 00 01 2c a1 ec ea 28 72 7a 26 9c b5 bd .....,...(rz&... 0050 89 4b b3 e1 22 85 ef 22 f8 b6 1e ea ca c9 b6 30 .K.."..".......0 0060 1d 91 2d da 21 c7 12 cc b9 58 24 b3 ea 06 26 79 ..-.!....X$...&y 0070 35 ce 57 ee 50 62 40 a8 36 5b 6c cc ef 20 68 62 5.W.Pb@.6[l.. hb 0080 f9 18 02 4f 74 a4 6d 9e cd a1 fe 98 b0 28 fc 8c ...Ot.m......(.. 0090 cf f7 88 f3 51 a9 4b 42 9c b1 3f 39 38 6c 45 3d ....Q.KB..?98lE= 00a0 e3 aa e9 c6 e5 d9 0b 4f 43 ff a6 aa 0b 5b 54 ec .......OC....[T. 00b0 f7 03 c6 4c c8 34 0c 1a 19 e8 f7 a7 de fd 20 7e ...L.4........ ~ 00c0 af 5c 32 d0 c6 26 dc 0b de 51 09 01 bd 97 93 eb .\2..&...Q...... 00d0 b9 eb 3b f0 a8 50 be 46 1c 80 4f 26 65 a0 07 34 ..;..P.F..O&e..4 00e0 d3 56 08 91 98 ee 85 ac fa c0 49 b7 49 96 18 e1 .V........I.I... 00f0 8c 47 be 76 6e fa de ea c7 dd cb 3d 27 85 7d 94 .G.vn......='.}. 0100 fe 7e 56 59 22 4a 5c d2 43 b6 e4 3c cc 61 c2 61 .~VY"J\.C..<.a.a 0110 21 e6 64 6a 75 81 84 2a 66 77 20 b3 90 8f fd ae !.dju..*fw ..... 0120 a2 6f fe 2a bb e2 29 f8 cd e2 41 1b 5f ff 2c d0 .o.*..)...A._.,. 0130 49 d2 10 02 6e d4 00 f7 f7 ff 70 8a 1a 33 eb 3a I...n.....p..3.: 0140 e0 75 9b 7c a3 61 1c 2a 1b 4a 44 c3 a4 00 43 72 .u.|.a.*.JD...Cr 0150 9d 67 aa 09 19 59 .g...Y Frame 13 (102 bytes on wire, 102 bytes captured) Arrival Time: Oct 19, 2010 18:41:27.020680000 [Time delta from previous captured frame: 0.005750000 seconds] [Time delta from previous displayed frame: 0.005750000 seconds] [Time since reference or first frame: 5.014062000 seconds] Frame Number: 13 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x01fb (507) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9f6 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x1364 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 177993B7B350A56C Responder cookie: EA1785751E2BB1F4 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x746fedd4 Length: 60 Encrypted payload (32 bytes) 0000 00 17 c5 6d 9d fd 00 0c 29 3f 71 77 08 00 45 00 ...m....)?qw..E. 0010 00 58 01 fb 00 00 80 11 f9 f6 a5 e3 f9 73 a5 e3 .X...........s.. 0020 f9 68 01 f4 01 f4 00 44 13 64 17 79 93 b7 b3 50 .h.....D.d.y...P 0030 a5 6c ea 17 85 75 1e 2b b1 f4 08 10 20 01 74 6f .l...u.+.... .to 0040 ed d4 00 00 00 3c 67 35 e3 fc 57 11 db b9 88 a0 ...... 0050 9b 8c ab ce 4d 2a be 44 04 f2 93 2e df 6b 8c b0 ....M*.D.....k.. 0060 43 53 8f 85 07 4d 09 28 1f 09 b3 63 2e fd d6 95 CS...M.(...c.... 0070 8d 6b 69 96 39 23 3d d7 3f 8a 88 4c 0f fe a2 da .ki.9#=.?..L.... 0080 c4 1b 4d 54 3f ae ..MT?. Frame 18 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 19, 2010 18:41:40.684344000 [Time delta from previous captured frame: 0.996661000 seconds] [Time delta from previous displayed frame: 0.996661000 seconds] [Time since reference or first frame: 18.677726000 seconds] Frame Number: 18 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfbae [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.104 (165.227.249.104) Encapsulating Security Payload ESP SPI: 0x33e03b58 ESP Sequence: 2 0000 00 17 c5 6d 9d fd 00 0c 29 3f 71 77 08 00 45 00 ...m....)?qw..E. 0010 00 78 00 02 00 00 80 32 fb ae a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 68 33 e0 3b 58 00 00 00 02 b4 29 b0 67 71 de .h3.;X.....).gq. 0030 37 09 2a eb 42 d8 23 b1 b3 9b e2 c8 fc 3d 31 7f 7.*.B.#......=1. 0040 90 de 4a 5b a2 b7 14 d5 42 ec 4f 93 19 5b 7a cc ..J[....B.O..[z. 0050 5a 88 40 ed 7e c1 8b 31 3c ce 05 9e ec 58 76 6e Z.@.~..1<....Xvn 0060 92 aa d7 93 3c b8 dd 76 fd 98 0f f0 0d fc c7 f3 ....<..v........ 0070 38 57 7e 90 bc f4 11 cf 1d e8 6c 64 6e 84 e4 47 8W~.......ldn..G 0080 0f 3e f8 94 d5 a3 .>.... Frame 19 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 19, 2010 18:41:40.684366000 [Time delta from previous captured frame: 0.000022000 seconds] [Time delta from previous displayed frame: 0.000022000 seconds] [Time since reference or first frame: 18.677748000 seconds] Frame Number: 19 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfbae [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.104 (165.227.249.104) Encapsulating Security Payload ESP SPI: 0x33e03b58 ESP Sequence: 2 0000 00 17 c5 6d 9d fd 00 0c 29 3f 71 77 08 00 45 00 ...m....)?qw..E. 0010 00 78 00 02 00 00 80 32 fb ae a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 68 33 e0 3b 58 00 00 00 02 b4 29 b0 67 71 de .h3.;X.....).gq. 0030 37 09 2a eb 42 d8 23 b1 b3 9b e2 c8 fc 3d 31 7f 7.*.B.#......=1. 0040 90 de 4a 5b a2 b7 14 d5 42 ec 4f 93 19 5b 7a cc ..J[....B.O..[z. 0050 5a 88 40 ed 7e c1 8b 31 3c ce 05 9e ec 58 76 6e Z.@.~..1<....Xvn 0060 92 aa d7 93 3c b8 dd 76 fd 98 0f f0 0d fc c7 f3 ....<..v........ 0070 38 57 7e 90 bc f4 11 cf 1d e8 6c 64 6e 84 e4 47 8W~.......ldn..G 0080 0f 3e f8 94 d5 a3 .>.... Frame 20 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 19, 2010 18:41:40.686914000 [Time delta from previous captured frame: 0.002548000 seconds] [Time delta from previous displayed frame: 0.002548000 seconds] [Time since reference or first frame: 18.680296000 seconds] Frame Number: 20 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd), Dst: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Destination: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.104 (165.227.249.104), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0204 (516) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x39ad [correct] [Good: True] [Bad : False] Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0xc9b76e9f ESP Sequence: 2 0000 00 0c 29 3f 71 77 00 17 c5 6d 9d fd 08 00 45 00 ..)?qw...m....E. 0010 00 78 02 04 00 00 40 32 39 ad a5 e3 f9 68 a5 e3 .x....@29....h.. 0020 f9 73 c9 b7 6e 9f 00 00 00 02 bd 10 5f 58 f6 7b .s..n......._X.{ 0030 2a 75 75 76 77 61 62 63 64 65 ca c4 16 45 9a f6 *uuvwabcde...E.. 0040 45 0f 1a 94 76 2a a1 ee 53 ab 31 ed 0a 3d f5 ba E...v*..S.1..=.. 0050 3b 9f db a9 a9 fa 32 0e bc ef 82 85 95 8c aa 2f ;.....2......../ 0060 1a 58 bf f0 95 b5 c0 e3 55 3d 83 cc d2 c0 de 23 .X......U=.....# 0070 06 fe 18 72 d4 a5 d3 80 b0 ce 1a d2 df 3c 86 ab ...r.........<.. 0080 9e 80 6f 53 0f 0c ..oS..