Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Aug 26, 2009 18:33:11.495416000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0140 (320) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa6e [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x6794 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 5397DFECCD1DA463 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 00 98 01 40 00 00 80 11 fa 6e a5 e3 f9 73 a5 e3 ...@.....n...s.. 0020 f9 6b 01 f4 01 f4 00 84 67 94 53 97 df ec cd 1d .k......g.S..... 0030 a4 63 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .c.............. 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (166 bytes on wire, 166 bytes captured) Arrival Time: Aug 26, 2009 18:33:11.495422000 [Time delta from previous captured frame: 0.000006000 seconds] [Time delta from previous displayed frame: 0.000006000 seconds] [Time since reference or first frame: 0.000006000 seconds] Frame Number: 2 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0140 (320) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa6e [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x6794 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 5397DFECCD1DA463 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 00 98 01 40 00 00 80 11 fa 6e a5 e3 f9 73 a5 e3 ...@.....n...s.. 0020 f9 6b 01 f4 01 f4 00 84 67 94 53 97 df ec cd 1d .k......g.S..... 0030 a4 63 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .c.............. 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 3 (166 bytes on wire, 166 bytes captured) Arrival Time: Aug 26, 2009 18:33:11.526259000 [Time delta from previous captured frame: 0.030837000 seconds] [Time delta from previous displayed frame: 0.030837000 seconds] [Time since reference or first frame: 0.030843000 seconds] Frame Number: 3 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbae [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x6daa [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 5397DFECCD1DA463 Responder cookie: 75A539270F1AB385 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 6d a9 a5 00 1e 2a d4 70 69 08 00 45 00 ..)m....*.pi..E. 0010 00 98 00 00 40 00 40 11 fb ae a5 e3 f9 6b a5 e3 ....@.@......k.. 0020 f9 73 01 f4 01 f4 00 84 6d aa 53 97 df ec cd 1d .s......m.S..... 0030 a4 63 75 a5 39 27 0f 1a b3 85 01 10 02 00 00 00 .cu.9'.......... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 3b 90 31 dc e4 fc f8 8b 48 9a 92 39 63 dd ..;.1.....H..9c. 0090 0c 49 00 00 00 14 70 03 cb c1 09 7d be 9c 26 00 .I....p....}..&. 00a0 ba 69 83 bc 8b 35 .i...5 Frame 4 (298 bytes on wire, 298 bytes captured) Arrival Time: Aug 26, 2009 18:33:13.529153000 [Time delta from previous captured frame: 2.002894000 seconds] [Time delta from previous displayed frame: 2.002894000 seconds] [Time since reference or first frame: 2.033737000 seconds] Frame Number: 4 Frame Length: 298 bytes Capture Length: 298 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x0143 (323) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9e7 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0x0003 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 5397DFECCD1DA463 Responder cookie: 75A539270F1AB385 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 01 1c 01 43 00 00 80 11 f9 e7 a5 e3 f9 73 a5 e3 ...C.........s.. 0020 f9 6b 01 f4 01 f4 01 08 00 03 53 97 df ec cd 1d .k........S..... 0030 a4 63 75 a5 39 27 0f 1a b3 85 04 10 02 00 00 00 .cu.9'.......... 0040 00 00 00 00 01 00 0a 00 00 84 eb ee 6a c1 86 92 ............j... 0050 8d a1 92 9e e1 6e 65 ab fd c3 cb 95 59 6e 18 4a .....ne.....Yn.J 0060 ea 9c 23 b5 73 0c 87 d3 6e 15 ff b2 95 57 47 35 ..#.s...n....WG5 0070 c7 77 00 4d 8a c4 d1 0e 60 5d 17 8a b3 75 ee 9f .w.M....`]...u.. 0080 6a 97 7b a5 c2 29 5d 83 07 e2 7d 5d be e0 08 83 j.{..)]...}].... 0090 45 bb d0 59 6a 1a 21 f7 7b fb c8 ac c0 69 c3 30 E..Yj.!.{....i.0 00a0 ec 6d 52 8f 26 88 26 e8 64 ae 7e 65 1b 2f 72 2d .mR.&.&.d.~e./r- 00b0 a7 27 82 2a d1 63 85 6b b6 5d bf da 51 17 ff db .'.*.c.k.]..Q... 00c0 a7 95 d5 4e a3 ca 4a d1 54 f2 0d 00 00 18 84 fc ...N..J.T....... 00d0 5b e2 18 99 3c 60 65 80 7e e1 11 28 87 87 16 62 [...<`e.~..(...b 00e0 14 10 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 5 (298 bytes on wire, 298 bytes captured) Arrival Time: Aug 26, 2009 18:33:13.529169000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 2.033753000 seconds] Frame Number: 5 Frame Length: 298 bytes Capture Length: 298 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x0143 (323) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9e7 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0x0003 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 5397DFECCD1DA463 Responder cookie: 75A539270F1AB385 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 01 1c 01 43 00 00 80 11 f9 e7 a5 e3 f9 73 a5 e3 ...C.........s.. 0020 f9 6b 01 f4 01 f4 01 08 00 03 53 97 df ec cd 1d .k........S..... 0030 a4 63 75 a5 39 27 0f 1a b3 85 04 10 02 00 00 00 .cu.9'.......... 0040 00 00 00 00 01 00 0a 00 00 84 eb ee 6a c1 86 92 ............j... 0050 8d a1 92 9e e1 6e 65 ab fd c3 cb 95 59 6e 18 4a .....ne.....Yn.J 0060 ea 9c 23 b5 73 0c 87 d3 6e 15 ff b2 95 57 47 35 ..#.s...n....WG5 0070 c7 77 00 4d 8a c4 d1 0e 60 5d 17 8a b3 75 ee 9f .w.M....`]...u.. 0080 6a 97 7b a5 c2 29 5d 83 07 e2 7d 5d be e0 08 83 j.{..)]...}].... 0090 45 bb d0 59 6a 1a 21 f7 7b fb c8 ac c0 69 c3 30 E..Yj.!.{....i.0 00a0 ec 6d 52 8f 26 88 26 e8 64 ae 7e 65 1b 2f 72 2d .mR.&.&.d.~e./r- 00b0 a7 27 82 2a d1 63 85 6b b6 5d bf da 51 17 ff db .'.*.c.k.]..Q... 00c0 a7 95 d5 4e a3 ca 4a d1 54 f2 0d 00 00 18 84 fc ...N..J.T....... 00d0 5b e2 18 99 3c 60 65 80 7e e1 11 28 87 87 16 62 [...<`e.~..(...b 00e0 14 10 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 6 (242 bytes on wire, 242 bytes captured) Arrival Time: Aug 26, 2009 18:33:13.625539000 [Time delta from previous captured frame: 0.096370000 seconds] [Time delta from previous displayed frame: 0.096370000 seconds] [Time since reference or first frame: 2.130123000 seconds] Frame Number: 6 Frame Length: 242 bytes Capture Length: 242 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb62 [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0x5b93 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 5397DFECCD1DA463 Responder cookie: 75A539270F1AB385 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 20 Nonce Data Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 6d a9 a5 00 1e 2a d4 70 69 08 00 45 00 ..)m....*.pi..E. 0010 00 e4 00 00 40 00 40 11 fb 62 a5 e3 f9 6b a5 e3 ....@.@..b...k.. 0020 f9 73 01 f4 01 f4 00 d0 5b 93 53 97 df ec cd 1d .s......[.S..... 0030 a4 63 75 a5 39 27 0f 1a b3 85 04 10 02 00 00 00 .cu.9'.......... 0040 00 00 00 00 00 c8 0a 00 00 84 50 5b de 7c e0 80 ..........P[.|.. 0050 74 39 67 5f d2 ff 27 ed 1c 8f c9 fa 31 52 2c 86 t9g_..'.....1R,. 0060 69 28 29 0a 81 fe 12 e2 8e e5 61 a5 a1 79 15 12 i().......a..y.. 0070 18 96 63 fb 91 b5 4c 1e 46 a7 71 8f 7d 0a 3b 89 ..c...L.F.q.}.;. 0080 6e 86 9e b8 4e c2 4e e9 6e 42 c9 83 7f 29 5a a3 n...N.N.nB...)Z. 0090 cf f3 d8 f3 6e 20 65 18 f3 e3 a6 c3 de c0 17 3c ....n e........< 00a0 f1 09 83 3d 16 9d f1 0c 52 0b e9 a9 16 34 fe 83 ...=....R....4.. 00b0 ec 7d 7f 9b b7 03 8e c2 2e 6d 3a cf 96 a0 2c 44 .}.......m:...,D 00c0 65 2c 1a f0 c1 8c 41 d2 f2 3d 0d 00 00 14 82 fd e,....A..=...... 00d0 a3 89 8a a5 93 1b f9 79 27 86 17 71 0e 4b 00 00 .......y'..q.K.. 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 26, 2009 18:33:14.702579000 [Time delta from previous captured frame: 1.077040000 seconds] [Time delta from previous displayed frame: 1.077040000 seconds] [Time since reference or first frame: 3.207163000 seconds] Frame Number: 7 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0146 (326) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa88 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x4d0c [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 5397DFECCD1DA463 Responder cookie: 75A539270F1AB385 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 00 78 01 46 00 00 80 11 fa 88 a5 e3 f9 73 a5 e3 .x.F.........s.. 0020 f9 6b 01 f4 01 f4 00 64 4d 0c 53 97 df ec cd 1d .k.....dM.S..... 0030 a4 63 75 a5 39 27 0f 1a b3 85 05 10 02 01 00 00 .cu.9'.......... 0040 00 00 00 00 00 5c 5c 5a e2 1f 1a 62 8c 65 60 5e .....\\Z...b.e`^ 0050 43 92 ee 94 b2 a7 5f fc 20 ea 61 4c 1e 02 42 88 C....._. .aL..B. 0060 13 a7 b2 b4 24 49 bd 85 09 a5 64 b5 6a c0 da 4f ....$I....d.j..O 0070 7a a2 de 05 6b f0 0f 7b 64 ba 62 17 d7 88 2e 78 z...k..{d.b....x 0080 60 31 81 e0 05 f2 `1.... Frame 8 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 26, 2009 18:33:14.702594000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 3.207178000 seconds] Frame Number: 8 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0146 (326) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa88 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x4d0c [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 5397DFECCD1DA463 Responder cookie: 75A539270F1AB385 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 00 78 01 46 00 00 80 11 fa 88 a5 e3 f9 73 a5 e3 .x.F.........s.. 0020 f9 6b 01 f4 01 f4 00 64 4d 0c 53 97 df ec cd 1d .k.....dM.S..... 0030 a4 63 75 a5 39 27 0f 1a b3 85 05 10 02 01 00 00 .cu.9'.......... 0040 00 00 00 00 00 5c 5c 5a e2 1f 1a 62 8c 65 60 5e .....\\Z...b.e`^ 0050 43 92 ee 94 b2 a7 5f fc 20 ea 61 4c 1e 02 42 88 C....._. .aL..B. 0060 13 a7 b2 b4 24 49 bd 85 09 a5 64 b5 6a c0 da 4f ....$I....d.j..O 0070 7a a2 de 05 6b f0 0f 7b 64 ba 62 17 d7 88 2e 78 z...k..{d.b....x 0080 60 31 81 e0 05 f2 `1.... Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: Aug 26, 2009 18:33:14.724127000 [Time delta from previous captured frame: 0.021533000 seconds] [Time delta from previous displayed frame: 0.021533000 seconds] [Time since reference or first frame: 3.228711000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbde [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xcbc8 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 5397DFECCD1DA463 Responder cookie: 75A539270F1AB385 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 6d a9 a5 00 1e 2a d4 70 69 08 00 45 00 ..)m....*.pi..E. 0010 00 68 00 00 40 00 40 11 fb de a5 e3 f9 6b a5 e3 .h..@.@......k.. 0020 f9 73 01 f4 01 f4 00 54 cb c8 53 97 df ec cd 1d .s.....T..S..... 0030 a4 63 75 a5 39 27 0f 1a b3 85 05 10 02 01 00 00 .cu.9'.......... 0040 00 00 00 00 00 4c 9c 67 6c f4 4e 1a 06 1b ab ae .....L.gl.N..... 0050 14 42 19 4d 35 52 fb 93 eb 2d b9 94 02 6d ae 24 .B.M5R...-...m.$ 0060 8a 05 e3 d9 58 c3 59 c5 54 19 39 63 50 1d 42 3b ....X.Y.T.9cP.B; 0070 0d 0e fa 76 ce 53 ...v.S Frame 10 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 26, 2009 18:33:14.735903000 [Time delta from previous captured frame: 0.011776000 seconds] [Time delta from previous displayed frame: 0.011776000 seconds] [Time since reference or first frame: 3.240487000 seconds] Frame Number: 10 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbce [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x97e2 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 5397DFECCD1DA463 Responder cookie: 75A539270F1AB385 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xf057bc4e Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 6d a9 a5 00 1e 2a d4 70 69 08 00 45 00 ..)m....*.pi..E. 0010 00 78 00 00 40 00 40 11 fb ce a5 e3 f9 6b a5 e3 .x..@.@......k.. 0020 f9 73 01 f4 01 f4 00 64 97 e2 53 97 df ec cd 1d .s.....d..S..... 0030 a4 63 75 a5 39 27 0f 1a b3 85 08 10 05 01 f0 57 .cu.9'.........W 0040 bc 4e 00 00 00 5c 52 09 1f f2 08 99 0f 49 58 e8 .N...\R......IX. 0050 d0 83 de c5 2a f4 26 26 09 b8 d6 de 66 db a2 eb ....*.&&....f... 0060 7c ab 9f 72 5b 81 92 7c d9 88 8c fc 57 f0 b0 40 |..r[..|....W..@ 0070 e8 3d 5e 65 4f 0b 7e 8d b7 be 9f ec b2 06 d3 b3 .=^eO.~......... 0080 40 2e a9 68 32 9c @..h2. Frame 11 (342 bytes on wire, 342 bytes captured) Arrival Time: Aug 26, 2009 18:33:16.811474000 [Time delta from previous captured frame: 2.075571000 seconds] [Time delta from previous displayed frame: 2.075571000 seconds] [Time since reference or first frame: 5.316058000 seconds] Frame Number: 11 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x014f (335) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9af [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x804a [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 5397DFECCD1DA463 Responder cookie: 75A539270F1AB385 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x7a55fc5b Length: 300 Encrypted payload (272 bytes) 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 01 48 01 4f 00 00 80 11 f9 af a5 e3 f9 73 a5 e3 .H.O.........s.. 0020 f9 6b 01 f4 01 f4 01 34 80 4a 53 97 df ec cd 1d .k.....4.JS..... 0030 a4 63 75 a5 39 27 0f 1a b3 85 08 10 20 01 7a 55 .cu.9'...... .zU 0040 fc 5b 00 00 01 2c fd 4f 5c 8d a4 40 17 41 9d ef .[...,.O\..@.A.. 0050 16 6f 01 4d a7 2c a1 37 05 24 01 2c 49 c0 2f e3 .o.M.,.7.$.,I./. 0060 df 27 a1 e8 d5 60 31 a3 7e 3a c6 1f 13 1c d5 f3 .'...`1.~:...... 0070 d9 1e 6d 66 0e b3 b2 9e ee 70 23 05 38 21 21 15 ..mf.....p#.8!!. 0080 39 7f 44 b2 bc f9 46 91 27 0d 99 1f aa 6f dc 48 9.D...F.'....o.H 0090 cc 5d 1c 53 df e7 22 13 bf f4 b6 93 b7 ac 73 62 .].S..".......sb 00a0 a8 1f 15 8d 54 6c d1 2e 39 8c d5 06 b7 e7 5f 97 ....Tl..9....._. 00b0 fb 57 df 0c e0 03 bd 56 b9 53 95 10 88 c6 12 71 .W.....V.S.....q 00c0 ad a3 64 17 6b 54 2c f4 e0 39 e7 57 2d 28 7d 7d ..d.kT,..9.W-(}} 00d0 2c bb 7c 57 cd 22 7f 37 a7 91 a2 c4 c3 e7 84 98 ,.|W.".7........ 00e0 98 04 54 6b 67 1a 71 67 55 42 64 81 0c 47 7a e4 ..Tkg.qgUBd..Gz. 00f0 06 9c 7d 63 9d 0d 6b ac ad 81 8d 72 cc dd f4 75 ..}c..k....r...u 0100 17 8b 3a 5e 5c cd 28 5d 23 73 44 d4 82 92 6c 3a ..:^\.(]#sD...l: 0110 1e 37 c2 89 af d3 da ee fe 0b 51 46 bf ac de 08 .7........QF.... 0120 1b 93 00 96 f9 63 cc b4 c6 6b 0e ec 43 8e f9 58 .....c...k..C..X 0130 77 04 ec a4 31 93 ee ac 67 3f 9f f2 8e 5c e4 1e w...1...g?...\.. 0140 e3 ff c4 68 7d 88 c7 4f d4 ee a0 1b ee 52 62 9e ...h}..O.....Rb. 0150 0a 74 3c 73 62 fc .t...\"M...s.... 0050 b4 2f e2 9a 77 6c 5e f7 3d bb d1 1c c2 36 94 de ./..wl^.=....6.. 0060 2f 08 3a af b0 f7 64 64 a2 62 99 54 44 f9 b4 a0 /.:...dd.b.TD... 0070 85 9a a5 d4 17 98 67 36 07 c2 03 f9 1d d5 df bf ......g6........ 0080 38 b8 25 57 33 b8 8.%W3. Frame 20 (166 bytes on wire, 166 bytes captured) Arrival Time: Aug 26, 2009 18:34:19.380508000 [Time delta from previous captured frame: 15.174785000 seconds] [Time delta from previous displayed frame: 15.174785000 seconds] [Time since reference or first frame: 67.885092000 seconds] Frame Number: 20 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0178 (376) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa36 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x06cd [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 397577166007F539 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 00 98 01 78 00 00 80 11 fa 36 a5 e3 f9 73 a5 e3 ...x.....6...s.. 0020 f9 6b 01 f4 01 f4 00 84 06 cd 39 75 77 16 60 07 .k........9uw.`. 0030 f5 39 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .9.............. 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 21 (166 bytes on wire, 166 bytes captured) Arrival Time: Aug 26, 2009 18:34:19.380524000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 67.885108000 seconds] Frame Number: 21 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0178 (376) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa36 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x06cd [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 397577166007F539 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 00 98 01 78 00 00 80 11 fa 36 a5 e3 f9 73 a5 e3 ...x.....6...s.. 0020 f9 6b 01 f4 01 f4 00 84 06 cd 39 75 77 16 60 07 .k........9uw.`. 0030 f5 39 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .9.............. 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 22 (166 bytes on wire, 166 bytes captured) Arrival Time: Aug 26, 2009 18:34:19.411345000 [Time delta from previous captured frame: 0.030821000 seconds] [Time delta from previous displayed frame: 0.030821000 seconds] [Time since reference or first frame: 67.915929000 seconds] Frame Number: 22 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbae [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x166e [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 397577166007F539 Responder cookie: 6632CA9AD2E26431 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 6d a9 a5 00 1e 2a d4 70 69 08 00 45 00 ..)m....*.pi..E. 0010 00 98 00 00 40 00 40 11 fb ae a5 e3 f9 6b a5 e3 ....@.@......k.. 0020 f9 73 01 f4 01 f4 00 84 16 6e 39 75 77 16 60 07 .s.......n9uw.`. 0030 f5 39 66 32 ca 9a d2 e2 64 31 01 10 02 00 00 00 .9f2....d1...... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 3b 90 31 dc e4 fc f8 8b 48 9a 92 39 63 dd ..;.1.....H..9c. 0090 0c 49 00 00 00 14 70 03 cb c1 09 7d be 9c 26 00 .I....p....}..&. 00a0 ba 69 83 bc 8b 35 .i...5 Frame 23 (298 bytes on wire, 298 bytes captured) Arrival Time: Aug 26, 2009 18:34:21.459470000 [Time delta from previous captured frame: 2.048125000 seconds] [Time delta from previous displayed frame: 2.048125000 seconds] [Time since reference or first frame: 69.964054000 seconds] Frame Number: 23 Frame Length: 298 bytes Capture Length: 298 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x017b (379) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9af [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xb893 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 397577166007F539 Responder cookie: 6632CA9AD2E26431 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 01 1c 01 7b 00 00 80 11 f9 af a5 e3 f9 73 a5 e3 ...{.........s.. 0020 f9 6b 01 f4 01 f4 01 08 b8 93 39 75 77 16 60 07 .k........9uw.`. 0030 f5 39 66 32 ca 9a d2 e2 64 31 04 10 02 00 00 00 .9f2....d1...... 0040 00 00 00 00 01 00 0a 00 00 84 10 6c 0c 65 86 bd ...........l.e.. 0050 c2 fd 93 57 a1 cc 22 4d af 18 c8 f9 fa a2 ce e3 ...W.."M........ 0060 d8 36 7d d4 7f 2f 89 7c 82 43 9e ae 13 3a 23 03 .6}../.|.C...:#. 0070 5f fe b0 2a b8 45 86 eb 34 0c 4d 8f 28 6a 11 74 _..*.E..4.M.(j.t 0080 a8 60 44 a8 50 d9 32 05 5d ea 05 0f 57 32 14 bd .`D.P.2.]...W2.. 0090 15 c0 9e d4 a5 ec e8 be 2e 83 e6 8a fa ae 09 b8 ................ 00a0 29 28 d6 2f 40 49 0e 32 93 fb 31 d1 5b 13 aa 4e )(./@I.2..1.[..N 00b0 04 9c 1f 45 11 e0 49 c3 2c f1 7e ae a3 e2 27 ef ...E..I.,.~...'. 00c0 d2 ab 40 2f 6c 27 d5 36 55 a1 0d 00 00 18 02 58 ..@/l'.6U......X 00d0 24 ac 9a 21 0e 57 e3 a5 3d 0e 2b 47 72 38 8c 0d $..!.W..=.+Gr8.. 00e0 70 87 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 p....0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 24 (298 bytes on wire, 298 bytes captured) Arrival Time: Aug 26, 2009 18:34:21.459486000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 69.964070000 seconds] Frame Number: 24 Frame Length: 298 bytes Capture Length: 298 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x017b (379) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9af [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xb893 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 397577166007F539 Responder cookie: 6632CA9AD2E26431 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 01 1c 01 7b 00 00 80 11 f9 af a5 e3 f9 73 a5 e3 ...{.........s.. 0020 f9 6b 01 f4 01 f4 01 08 b8 93 39 75 77 16 60 07 .k........9uw.`. 0030 f5 39 66 32 ca 9a d2 e2 64 31 04 10 02 00 00 00 .9f2....d1...... 0040 00 00 00 00 01 00 0a 00 00 84 10 6c 0c 65 86 bd ...........l.e.. 0050 c2 fd 93 57 a1 cc 22 4d af 18 c8 f9 fa a2 ce e3 ...W.."M........ 0060 d8 36 7d d4 7f 2f 89 7c 82 43 9e ae 13 3a 23 03 .6}../.|.C...:#. 0070 5f fe b0 2a b8 45 86 eb 34 0c 4d 8f 28 6a 11 74 _..*.E..4.M.(j.t 0080 a8 60 44 a8 50 d9 32 05 5d ea 05 0f 57 32 14 bd .`D.P.2.]...W2.. 0090 15 c0 9e d4 a5 ec e8 be 2e 83 e6 8a fa ae 09 b8 ................ 00a0 29 28 d6 2f 40 49 0e 32 93 fb 31 d1 5b 13 aa 4e )(./@I.2..1.[..N 00b0 04 9c 1f 45 11 e0 49 c3 2c f1 7e ae a3 e2 27 ef ...E..I.,.~...'. 00c0 d2 ab 40 2f 6c 27 d5 36 55 a1 0d 00 00 18 02 58 ..@/l'.6U......X 00d0 24 ac 9a 21 0e 57 e3 a5 3d 0e 2b 47 72 38 8c 0d $..!.W..=.+Gr8.. 00e0 70 87 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 p....0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 25 (242 bytes on wire, 242 bytes captured) Arrival Time: Aug 26, 2009 18:34:21.556352000 [Time delta from previous captured frame: 0.096866000 seconds] [Time delta from previous displayed frame: 0.096866000 seconds] [Time since reference or first frame: 70.060936000 seconds] Frame Number: 25 Frame Length: 242 bytes Capture Length: 242 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb62 [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0xdaf9 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 397577166007F539 Responder cookie: 6632CA9AD2E26431 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 20 Nonce Data Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 6d a9 a5 00 1e 2a d4 70 69 08 00 45 00 ..)m....*.pi..E. 0010 00 e4 00 00 40 00 40 11 fb 62 a5 e3 f9 6b a5 e3 ....@.@..b...k.. 0020 f9 73 01 f4 01 f4 00 d0 da f9 39 75 77 16 60 07 .s........9uw.`. 0030 f5 39 66 32 ca 9a d2 e2 64 31 04 10 02 00 00 00 .9f2....d1...... 0040 00 00 00 00 00 c8 0a 00 00 84 54 8b be 89 84 d2 ..........T..... 0050 e6 e6 af 42 c0 db 85 f6 8b ab 43 96 2b a9 da 24 ...B......C.+..$ 0060 f1 19 79 52 c7 70 7f 59 0f 00 59 4e 23 a2 b6 6c ..yR.p.Y..YN#..l 0070 ff 22 1f 11 dc cd e9 23 10 80 9a a4 bf 1f f4 b5 .".....#........ 0080 40 c0 5f f5 d4 ca 5d fe b2 6e 46 9a f4 17 5b 23 @._...]..nF...[# 0090 81 20 85 8f a0 72 57 f1 f3 48 16 23 be 46 bf f3 . ...rW..H.#.F.. 00a0 44 89 a5 b5 07 6b f7 f1 26 dc 73 19 7b 30 da d1 D....k..&.s.{0.. 00b0 38 31 ab 90 18 43 53 20 43 b5 3f b8 80 c2 6a 39 81...CS C.?...j9 00c0 09 03 56 14 22 90 c0 e8 b5 a3 0d 00 00 14 d5 f2 ..V."........... 00d0 37 eb 5e 9e 32 42 0e 8f 9c 86 f4 a1 70 66 00 00 7.^.2B......pf.. 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 26 (118 bytes on wire, 118 bytes captured) Arrival Time: Aug 26, 2009 18:34:22.550922000 [Time delta from previous captured frame: 0.994570000 seconds] [Time delta from previous displayed frame: 0.994570000 seconds] [Time since reference or first frame: 71.055506000 seconds] Frame Number: 26 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x017e (382) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa60 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xdb35 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 397577166007F539 Responder cookie: 6632CA9AD2E26431 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 00 68 01 7e 00 00 80 11 fa 60 a5 e3 f9 73 a5 e3 .h.~.....`...s.. 0020 f9 6b 01 f4 01 f4 00 54 db 35 39 75 77 16 60 07 .k.....T.59uw.`. 0030 f5 39 66 32 ca 9a d2 e2 64 31 05 10 02 01 00 00 .9f2....d1...... 0040 00 00 00 00 00 4c 12 be 02 00 8e bc a6 7d 4d e8 .....L.......}M. 0050 1c d0 ba 75 71 a4 0a 3b c9 17 60 16 cb d5 3c fb ...uq..;..`...<. 0060 e8 5e bc 26 45 67 ff d5 2e 93 1b 51 d5 00 03 b1 .^.&Eg.....Q.... 0070 08 0a e9 0e 51 ff ....Q. Frame 27 (118 bytes on wire, 118 bytes captured) Arrival Time: Aug 26, 2009 18:34:22.550938000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 71.055522000 seconds] Frame Number: 27 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x017e (382) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa60 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xdb35 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 397577166007F539 Responder cookie: 6632CA9AD2E26431 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 00 68 01 7e 00 00 80 11 fa 60 a5 e3 f9 73 a5 e3 .h.~.....`...s.. 0020 f9 6b 01 f4 01 f4 00 54 db 35 39 75 77 16 60 07 .k.....T.59uw.`. 0030 f5 39 66 32 ca 9a d2 e2 64 31 05 10 02 01 00 00 .9f2....d1...... 0040 00 00 00 00 00 4c 12 be 02 00 8e bc a6 7d 4d e8 .....L.......}M. 0050 1c d0 ba 75 71 a4 0a 3b c9 17 60 16 cb d5 3c fb ...uq..;..`...<. 0060 e8 5e bc 26 45 67 ff d5 2e 93 1b 51 d5 00 03 b1 .^.&Eg.....Q.... 0070 08 0a e9 0e 51 ff ....Q. Frame 28 (118 bytes on wire, 118 bytes captured) Arrival Time: Aug 26, 2009 18:34:22.570456000 [Time delta from previous captured frame: 0.019518000 seconds] [Time delta from previous displayed frame: 0.019518000 seconds] [Time since reference or first frame: 71.075040000 seconds] Frame Number: 28 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbde [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xf76f [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 397577166007F539 Responder cookie: 6632CA9AD2E26431 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 6d a9 a5 00 1e 2a d4 70 69 08 00 45 00 ..)m....*.pi..E. 0010 00 68 00 00 40 00 40 11 fb de a5 e3 f9 6b a5 e3 .h..@.@......k.. 0020 f9 73 01 f4 01 f4 00 54 f7 6f 39 75 77 16 60 07 .s.....T.o9uw.`. 0030 f5 39 66 32 ca 9a d2 e2 64 31 05 10 02 01 00 00 .9f2....d1...... 0040 00 00 00 00 00 4c 0d 43 35 17 80 19 22 19 91 c7 .....L.C5..."... 0050 ff 80 b8 79 e7 38 cf 9d 8c d2 67 98 d3 bd dd 63 ...y.8....g....c 0060 1e dd 39 44 2b 0c 74 8f 6c a4 46 c0 c6 aa 59 83 ..9D+.t.l.F...Y. 0070 98 ef b8 48 a9 01 ...H.. Frame 29 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 26, 2009 18:34:22.581588000 [Time delta from previous captured frame: 0.011132000 seconds] [Time delta from previous displayed frame: 0.011132000 seconds] [Time since reference or first frame: 71.086172000 seconds] Frame Number: 29 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbce [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xc1cd [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 397577166007F539 Responder cookie: 6632CA9AD2E26431 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xd44a2a19 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 6d a9 a5 00 1e 2a d4 70 69 08 00 45 00 ..)m....*.pi..E. 0010 00 78 00 00 40 00 40 11 fb ce a5 e3 f9 6b a5 e3 .x..@.@......k.. 0020 f9 73 01 f4 01 f4 00 64 c1 cd 39 75 77 16 60 07 .s.....d..9uw.`. 0030 f5 39 66 32 ca 9a d2 e2 64 31 08 10 05 01 d4 4a .9f2....d1.....J 0040 2a 19 00 00 00 5c be 5c 1e 5f 34 61 9d 6b a5 a1 *....\.\._4a.k.. 0050 d9 3b ef fb 24 7e 6f 1a 03 b0 73 0e 84 a6 b3 15 .;..$~o...s..... 0060 98 c2 75 75 9a 35 6f a8 c1 f4 83 6a 1f a9 2f 9b ..uu.5o....j../. 0070 1b 94 14 5b 86 d9 44 48 71 1e 82 86 1b f0 a7 53 ...[..DHq......S 0080 cb cd 57 5b 9f f8 ..W[.. Frame 30 (342 bytes on wire, 342 bytes captured) Arrival Time: Aug 26, 2009 18:34:24.762975000 [Time delta from previous captured frame: 2.181387000 seconds] [Time delta from previous displayed frame: 2.181387000 seconds] [Time since reference or first frame: 73.267559000 seconds] Frame Number: 30 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0188 (392) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf976 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x6df9 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 397577166007F539 Responder cookie: 6632CA9AD2E26431 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x461af9a9 Length: 300 Encrypted payload (272 bytes) 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 01 48 01 88 00 00 80 11 f9 76 a5 e3 f9 73 a5 e3 .H.......v...s.. 0020 f9 6b 01 f4 01 f4 01 34 6d f9 39 75 77 16 60 07 .k.....4m.9uw.`. 0030 f5 39 66 32 ca 9a d2 e2 64 31 08 10 20 01 46 1a .9f2....d1.. .F. 0040 f9 a9 00 00 01 2c ee d7 2d a6 6a 8e 20 1c 5a 96 .....,..-.j. .Z. 0050 cc a1 d2 f5 c7 cd b2 03 b8 50 69 da e8 dd 9e cc .........Pi..... 0060 b6 2e 65 5d 21 a8 18 cf fa da 0a 15 67 a6 bf 6d ..e]!.......g..m 0070 18 41 5c 32 27 a4 1d eb 4f aa 5e 3d ee 27 53 0e .A\2'...O.^=.'S. 0080 23 32 a2 b2 f5 f8 4c 9b 0e 43 52 8f f1 e5 87 3b #2....L..CR....; 0090 38 f1 5a 8b 2d 30 86 60 55 d6 38 8b 27 5b da 10 8.Z.-0.`U.8.'[.. 00a0 8b 82 15 8d b1 44 95 ef ed ec 6e cd 8a 21 18 ef .....D....n..!.. 00b0 3b ab 62 f6 af 9f df 6b 22 6c 8f 83 70 29 af 7d ;.b....k"l..p).} 00c0 d8 f6 1b a9 1c fa 77 eb 2a 2d 00 0a 01 89 c9 55 ......w.*-.....U 00d0 71 57 d3 0e 8c 5f 26 c8 e4 62 44 a8 06 b4 f6 75 qW..._&..bD....u 00e0 50 4f d8 ee 33 85 42 bd 00 24 8e f5 28 31 47 ed PO..3.B..$..(1G. 00f0 45 4d ff f8 a6 fe 5b 96 c2 7a 56 cf 2a 77 1e 24 EM....[..zV.*w.$ 0100 b9 d1 c7 a1 53 b8 24 fa a5 74 b3 fc c5 b9 c2 b9 ....S.$..t...... 0110 66 cf 41 f9 30 a4 60 75 5e 47 f0 be 67 a9 ae 81 f.A.0.`u^G..g... 0120 33 dc e2 42 9d 4f 94 b8 46 31 d9 27 63 43 d9 59 3..B.O..F1.'cC.Y 0130 8a 06 56 7d 8f 42 af 38 c7 29 62 9d cf 27 d7 4f ..V}.B.8.)b..'.O 0140 5c 65 ae 38 e9 e0 e3 8f d5 b8 fc b8 4b 3d ff 83 \e.8........K=.. 0150 a0 1d 02 64 5a 78 ...dZx Frame 31 (342 bytes on wire, 342 bytes captured) Arrival Time: Aug 26, 2009 18:34:24.762991000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 73.267575000 seconds] Frame Number: 31 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0188 (392) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf976 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x6df9 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 397577166007F539 Responder cookie: 6632CA9AD2E26431 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x461af9a9 Length: 300 Encrypted payload (272 bytes) 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 01 48 01 88 00 00 80 11 f9 76 a5 e3 f9 73 a5 e3 .H.......v...s.. 0020 f9 6b 01 f4 01 f4 01 34 6d f9 39 75 77 16 60 07 .k.....4m.9uw.`. 0030 f5 39 66 32 ca 9a d2 e2 64 31 08 10 20 01 46 1a .9f2....d1.. .F. 0040 f9 a9 00 00 01 2c ee d7 2d a6 6a 8e 20 1c 5a 96 .....,..-.j. .Z. 0050 cc a1 d2 f5 c7 cd b2 03 b8 50 69 da e8 dd 9e cc .........Pi..... 0060 b6 2e 65 5d 21 a8 18 cf fa da 0a 15 67 a6 bf 6d ..e]!.......g..m 0070 18 41 5c 32 27 a4 1d eb 4f aa 5e 3d ee 27 53 0e .A\2'...O.^=.'S. 0080 23 32 a2 b2 f5 f8 4c 9b 0e 43 52 8f f1 e5 87 3b #2....L..CR....; 0090 38 f1 5a 8b 2d 30 86 60 55 d6 38 8b 27 5b da 10 8.Z.-0.`U.8.'[.. 00a0 8b 82 15 8d b1 44 95 ef ed ec 6e cd 8a 21 18 ef .....D....n..!.. 00b0 3b ab 62 f6 af 9f df 6b 22 6c 8f 83 70 29 af 7d ;.b....k"l..p).} 00c0 d8 f6 1b a9 1c fa 77 eb 2a 2d 00 0a 01 89 c9 55 ......w.*-.....U 00d0 71 57 d3 0e 8c 5f 26 c8 e4 62 44 a8 06 b4 f6 75 qW..._&..bD....u 00e0 50 4f d8 ee 33 85 42 bd 00 24 8e f5 28 31 47 ed PO..3.B..$..(1G. 00f0 45 4d ff f8 a6 fe 5b 96 c2 7a 56 cf 2a 77 1e 24 EM....[..zV.*w.$ 0100 b9 d1 c7 a1 53 b8 24 fa a5 74 b3 fc c5 b9 c2 b9 ....S.$..t...... 0110 66 cf 41 f9 30 a4 60 75 5e 47 f0 be 67 a9 ae 81 f.A.0.`u^G..g... 0120 33 dc e2 42 9d 4f 94 b8 46 31 d9 27 63 43 d9 59 3..B.O..F1.'cC.Y 0130 8a 06 56 7d 8f 42 af 38 c7 29 62 9d cf 27 d7 4f ..V}.B.8.)b..'.O 0140 5c 65 ae 38 e9 e0 e3 8f d5 b8 fc b8 4b 3d ff 83 \e.8........K=.. 0150 a0 1d 02 64 5a 78 ...dZx Frame 32 (342 bytes on wire, 342 bytes captured) Arrival Time: Aug 26, 2009 18:34:24.919253000 [Time delta from previous captured frame: 0.156262000 seconds] [Time delta from previous displayed frame: 0.156262000 seconds] [Time since reference or first frame: 73.423837000 seconds] Frame Number: 32 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfafe [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x99d7 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 397577166007F539 Responder cookie: 6632CA9AD2E26431 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x461af9a9 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 6d a9 a5 00 1e 2a d4 70 69 08 00 45 00 ..)m....*.pi..E. 0010 01 48 00 00 40 00 40 11 fa fe a5 e3 f9 6b a5 e3 .H..@.@......k.. 0020 f9 73 01 f4 01 f4 01 34 99 d7 39 75 77 16 60 07 .s.....4..9uw.`. 0030 f5 39 66 32 ca 9a d2 e2 64 31 08 10 20 01 46 1a .9f2....d1.. .F. 0040 f9 a9 00 00 01 2c ff ec 84 f4 23 3b 60 b9 60 55 .....,....#;`.`U 0050 c8 e3 17 7c ce 37 c1 84 ce 7c f6 fc 1e 2f df c8 ...|.7...|.../.. 0060 65 86 b9 f0 9d a9 29 98 df 98 7b 3f 63 8a ae 52 e.....)...{?c..R 0070 56 f0 c2 ef a9 ef d1 2a 69 bf c6 49 67 58 38 46 V......*i..IgX8F 0080 9f 1a 3c da 71 8a f5 cf 57 91 ac 9c 60 b7 6d c2 ..<.q...W...`.m. 0090 09 7c 95 7a 1f a9 1f e3 5a 12 d3 5b a1 72 89 c1 .|.z....Z..[.r.. 00a0 98 59 3b 9c c8 b8 e3 55 7a bb 6e 36 27 17 6c 76 .Y;....Uz.n6'.lv 00b0 38 d4 15 47 7d 7f 4b 40 85 ed a1 8d 56 e9 ba 55 8..G}.K@....V..U 00c0 1b 0a b1 03 e6 b3 15 4f c8 c3 7f d6 92 7a 03 3e .......O.....z.> 00d0 34 ac 31 97 9c 7e b5 0c be 24 a7 30 38 db 79 86 4.1..~...$.08.y. 00e0 8f 9d 2e b3 31 39 1a 77 52 a0 ee d7 f6 40 8a bd ....19.wR....@.. 00f0 00 63 57 de b0 db 0c 77 7e 53 e8 de e9 52 ff 12 .cW....w~S...R.. 0100 a9 56 6a 4e c2 97 23 5b b2 8f 49 f3 d3 2c 59 ef .VjN..#[..I..,Y. 0110 cb a0 df 6d 1a 2f 8d 4d b8 cb ec 45 0a 2a 3c 17 ...m./.M...E.*<. 0120 92 a9 b3 e6 29 0b ef 45 54 84 ac 81 d1 0b 63 17 ....)..ET.....c. 0130 0c a2 59 06 a2 b6 68 e7 d1 f4 10 5e e9 ad d1 69 ..Y...h....^...i 0140 cf 11 20 f6 0c d8 a3 bb 0e 87 fc 49 99 d5 64 fb .. ........I..d. 0150 09 48 cf 7c 2e 0f .H.|.. Frame 33 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 26, 2009 18:34:24.921979000 [Time delta from previous captured frame: 0.002726000 seconds] [Time delta from previous displayed frame: 0.002726000 seconds] [Time since reference or first frame: 73.426563000 seconds] Frame Number: 33 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x018d (397) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa61 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x1d4d [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 397577166007F539 Responder cookie: 6632CA9AD2E26431 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x461af9a9 Length: 60 Encrypted payload (32 bytes) 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 00 58 01 8d 00 00 80 11 fa 61 a5 e3 f9 73 a5 e3 .X.......a...s.. 0020 f9 6b 01 f4 01 f4 00 44 1d 4d 39 75 77 16 60 07 .k.....D.M9uw.`. 0030 f5 39 66 32 ca 9a d2 e2 64 31 08 10 20 01 46 1a .9f2....d1.. .F. 0040 f9 a9 00 00 00 3c b4 4d 56 60 6a 73 cb 0b 98 21 .....<.MV`js...! 0050 7e b5 9f 1d 3d 19 3b a9 b5 d9 4e f2 51 18 36 ed ~...=.;...N.Q.6. 0060 80 55 86 58 c7 66 .U.X.f Frame 34 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 26, 2009 18:34:24.921991000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 73.426575000 seconds] Frame Number: 34 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x018d (397) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa61 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x1d4d [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 397577166007F539 Responder cookie: 6632CA9AD2E26431 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x461af9a9 Length: 60 Encrypted payload (32 bytes) 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 00 58 01 8d 00 00 80 11 fa 61 a5 e3 f9 73 a5 e3 .X.......a...s.. 0020 f9 6b 01 f4 01 f4 00 44 1d 4d 39 75 77 16 60 07 .k.....D.M9uw.`. 0030 f5 39 66 32 ca 9a d2 e2 64 31 08 10 20 01 46 1a .9f2....d1.. .F. 0040 f9 a9 00 00 00 3c b4 4d 56 60 6a 73 cb 0b 98 21 .....<.MV`js...! 0050 7e b5 9f 1d 3d 19 3b a9 b5 d9 4e f2 51 18 36 ed ~...=.;...N.Q.6. 0060 80 55 86 58 c7 66 .U.X.f Frame 35 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 26, 2009 18:34:36.753919000 [Time delta from previous captured frame: 11.831928000 seconds] [Time delta from previous displayed frame: 11.831928000 seconds] [Time since reference or first frame: 85.258503000 seconds] Frame Number: 35 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfbac [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) Encapsulating Security Payload ESP SPI: 0x062bb03e ESP Sequence: 1 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 00 78 00 01 00 00 80 32 fb ac a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 6b 06 2b b0 3e 00 00 00 01 c2 b2 25 1d 5b 1d .k.+.>......%.[. 0030 0e 3d ff 6f d3 da cb 7c a1 56 f6 06 a9 29 c4 70 .=.o...|.V...).p 0040 71 f7 40 95 2c 53 94 18 96 1f ec ee 50 43 4a 98 q.@.,S......PCJ. 0050 0a 64 b6 cc c1 be 2b b9 27 c9 f9 d9 97 0b f0 83 .d....+.'....... 0060 5b 23 9d 65 85 dd fc d8 c7 db 31 70 7e 58 d8 25 [#.e......1p~X.% 0070 b1 c7 29 86 4c c8 b8 cf be d5 1d 9f d0 4f 4e 2f ..).L........ON/ 0080 eb d3 79 08 8b 57 ..y..W Frame 36 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 26, 2009 18:34:36.753935000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 85.258519000 seconds] Frame Number: 36 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfbac [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) Encapsulating Security Payload ESP SPI: 0x062bb03e ESP Sequence: 1 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 00 78 00 01 00 00 80 32 fb ac a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 6b 06 2b b0 3e 00 00 00 01 c2 b2 25 1d 5b 1d .k.+.>......%.[. 0030 0e 3d ff 6f d3 da cb 7c a1 56 f6 06 a9 29 c4 70 .=.o...|.V...).p 0040 71 f7 40 95 2c 53 94 18 96 1f ec ee 50 43 4a 98 q.@.,S......PCJ. 0050 0a 64 b6 cc c1 be 2b b9 27 c9 f9 d9 97 0b f0 83 .d....+.'....... 0060 5b 23 9d 65 85 dd fc d8 c7 db 31 70 7e 58 d8 25 [#.e......1p~X.% 0070 b1 c7 29 86 4c c8 b8 cf be d5 1d 9f d0 4f 4e 2f ..).L........ON/ 0080 eb d3 79 08 8b 57 ..y..W Frame 37 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 26, 2009 18:34:36.756451000 [Time delta from previous captured frame: 0.002516000 seconds] [Time delta from previous displayed frame: 0.002516000 seconds] [Time since reference or first frame: 85.261035000 seconds] Frame Number: 37 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0xbbfa (48122) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x7fb3 [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0xcee673dc ESP Sequence: 1 0000 00 0c 29 6d a9 a5 00 1e 2a d4 70 69 08 00 45 00 ..)m....*.pi..E. 0010 00 78 bb fa 00 00 40 32 7f b3 a5 e3 f9 6b a5 e3 .x....@2.....k.. 0020 f9 73 ce e6 73 dc 00 00 00 01 93 e2 ac f6 7b 94 .s..s.........{. 0030 57 45 46 47 1a 85 b1 c1 5b f5 bc 91 db ab 4f 5b WEFG....[.....O[ 0040 e9 12 c5 16 90 e8 e8 07 86 a7 af 88 c1 72 42 cb .............rB. 0050 ba f5 bf b1 1e af 06 d5 b0 8d 09 27 23 4b 05 13 ...........'#K.. 0060 6b 0f 7c 42 6a 16 7a 81 83 bf c7 4a a5 70 db 66 k.|Bj.z....J.p.f 0070 9e 10 65 f8 d9 bf e5 af 44 97 db 97 3c 78 7b 1e ..e.....D.......1p~X.% 0030 b1 c7 29 86 4c c8 b8 cf be d5 4f 8d 10 8c 05 e5 ..).L.....O..... 0040 f0 24 31 b3 f0 4c d6 8e 9b e5 44 42 ad 95 01 9a .$1..L....DB.... 0050 e2 3c 96 66 32 00 2e 6a ba 5f 22 3a d3 e3 47 37 .<.f2..j._":..G7 0060 10 27 f7 70 e6 da e7 20 b1 54 56 b1 a7 8a 8a 04 .'.p... .TV..... 0070 bc 75 44 8c aa 7d 30 47 36 ff 2f fd 71 7e 89 c0 .uD..}0G6./.q~.. 0080 e9 96 6b 9a 2d c6 ..k.-. Frame 39 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 26, 2009 18:34:37.769903000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 86.274487000 seconds] Frame Number: 39 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfbab [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.107 (165.227.249.107) Encapsulating Security Payload ESP SPI: 0x062bb03e ESP Sequence: 2 0000 00 1e 2a d4 70 69 00 0c 29 6d a9 a5 08 00 45 00 ..*.pi..)m....E. 0010 00 78 00 02 00 00 80 32 fb ab a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 6b 06 2b b0 3e 00 00 00 02 31 70 7e 58 d8 25 .k.+.>....1p~X.% 0030 b1 c7 29 86 4c c8 b8 cf be d5 4f 8d 10 8c 05 e5 ..).L.....O..... 0040 f0 24 31 b3 f0 4c d6 8e 9b e5 44 42 ad 95 01 9a .$1..L....DB.... 0050 e2 3c 96 66 32 00 2e 6a ba 5f 22 3a d3 e3 47 37 .<.f2..j._":..G7 0060 10 27 f7 70 e6 da e7 20 b1 54 56 b1 a7 8a 8a 04 .'.p... .TV..... 0070 bc 75 44 8c aa 7d 30 47 36 ff 2f fd 71 7e 89 c0 .uD..}0G6./.q~.. 0080 e9 96 6b 9a 2d c6 ..k.-. Frame 40 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 26, 2009 18:34:37.771139000 [Time delta from previous captured frame: 0.001236000 seconds] [Time delta from previous displayed frame: 0.001236000 seconds] [Time since reference or first frame: 86.275723000 seconds] Frame Number: 40 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x546c (21612) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xe741 [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0xcee673dc ESP Sequence: 2 0000 00 0c 29 6d a9 a5 00 1e 2a d4 70 69 08 00 45 00 ..)m....*.pi..E. 0010 00 78 54 6c 00 00 40 32 e7 41 a5 e3 f9 6b a5 e3 .xTl..@2.A...k.. 0020 f9 73 ce e6 73 dc 00 00 00 02 c7 4a a5 70 db 66 .s..s......J.p.f 0030 9e 10 65 f8 d9 bf e5 af 44 97 c6 4b 5c d2 c0 58 ..e.....D..K\..X 0040 ba e8 5e 75 83 0c 97 83 6c 85 ac 91 07 d2 56 b1 ..^u....l.....V. 0050 c4 af 9d ea dd 38 87 fa 3f 43 5e 50 01 e2 94 ef .....8..?C^P.... 0060 ac 7b 58 12 34 9e 0a 50 8d 95 87 3c 75 6e ba 86 .{X.4..P...