Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Oct 18, 2007 14:53:15.689260000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 166 bytes Capture Length: 166 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Destination: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x03af (943) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf7fd [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.109 (165.227.249.109) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0xe57b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5F98211E47A85EBD Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 1b 2f 42 bd 75 00 0c 29 ab 06 ab 08 00 45 00 ../B.u..).....E. 0010 00 98 03 af 00 00 80 11 f7 fd a5 e3 f9 73 a5 e3 .............s.. 0020 f9 6d 01 f4 01 f4 00 84 e5 7b 5f 98 21 1e 47 a8 .m.......{_.!.G. 0030 5e bd 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ^............... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (146 bytes on wire, 146 bytes captured) Arrival Time: Oct 18, 2007 14:53:15.822912000 Time delta from previous packet: 0.133652000 seconds Time since reference or first frame: 0.133652000 seconds Frame Number: 2 Packet Length: 146 bytes Capture Length: 146 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.109 (165.227.249.109), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x0af5 (2805) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x30cc [correct] Good: True Bad : False Source: 165.227.249.109 (165.227.249.109) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0x36bf [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5F98211E47A85EBD Responder cookie: 0xAF33E90FB6427AF8 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 ab 06 ab 00 1b 2f 42 bd 75 08 00 45 00 ..)...../B.u..E. 0010 00 84 0a f5 00 00 40 11 30 cc a5 e3 f9 6d a5 e3 ......@.0....m.. 0020 f9 73 01 f4 01 f4 00 70 36 bf 5f 98 21 1e 47 a8 .s.....p6._.!.G. 0030 5e bd af 33 e9 0f b6 42 7a f8 01 10 02 00 00 00 ^..3...Bz....... 0040 00 00 00 00 00 68 0d 00 00 38 00 00 00 01 00 00 .....h...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 00 00 ................ 0080 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 0090 8b 35 .5 Frame 3 (298 bytes on wire, 298 bytes captured) Arrival Time: Oct 18, 2007 14:53:18.033666000 Time delta from previous packet: 2.210754000 seconds Time since reference or first frame: 2.344406000 seconds Frame Number: 3 Packet Length: 298 bytes Capture Length: 298 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Destination: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x03b0 (944) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf778 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.109 (165.227.249.109) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0x61f6 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5F98211E47A85EBD Responder cookie: 0xAF33E90FB6427AF8 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 1b 2f 42 bd 75 00 0c 29 ab 06 ab 08 00 45 00 ../B.u..).....E. 0010 01 1c 03 b0 00 00 80 11 f7 78 a5 e3 f9 73 a5 e3 .........x...s.. 0020 f9 6d 01 f4 01 f4 01 08 61 f6 5f 98 21 1e 47 a8 .m......a._.!.G. 0030 5e bd af 33 e9 0f b6 42 7a f8 04 10 02 00 00 00 ^..3...Bz....... 0040 00 00 00 00 01 00 0a 00 00 84 70 43 a0 ab d3 f2 ..........pC.... 0050 00 76 2a 6e d6 a9 01 fc fa 0a da 88 5a 95 6c 62 .v*n........Z.lb 0060 a6 4c 53 62 8f a6 d5 1a 23 a2 a8 e0 a4 c5 f1 a4 .LSb....#....... 0070 a8 79 c6 1e bc b4 46 14 aa c3 a8 eb 3f cf 1b ca .y....F.....?... 0080 83 ed cf 91 c8 23 97 a1 7e aa a7 4e c0 ee 7d 78 .....#..~..N..}x 0090 25 0f 5d cc e8 8a 81 24 91 ef 93 f0 2e 0b a1 ae %.]....$........ 00a0 ed 35 59 c5 4e be 24 e4 1f 6d 56 79 86 b3 a7 72 .5Y.N.$..mVy...r 00b0 87 85 0d e4 f2 a7 20 ce 2d 7e 66 f1 e8 64 d5 94 ...... .-~f..d.. 00c0 93 0a 1d d3 ac 5f e8 05 04 c9 0d 00 00 18 9d 1c ....._.......... 00d0 d8 00 5f f8 af 63 18 09 75 91 3e 7e 6b 02 25 d9 .._..c..u.>~k.%. 00e0 8e 67 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .g...0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 4 (242 bytes on wire, 242 bytes captured) Arrival Time: Oct 18, 2007 14:53:18.465972000 Time delta from previous packet: 0.432306000 seconds Time since reference or first frame: 2.776712000 seconds Frame Number: 4 Packet Length: 242 bytes Capture Length: 242 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.109 (165.227.249.109), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0af6 (2806) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x306b [correct] Good: True Bad : False Source: 165.227.249.109 (165.227.249.109) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0x45fb [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5F98211E47A85EBD Responder cookie: 0xAF33E90FB6427AF8 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 20 Nonce Data Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 ab 06 ab 00 1b 2f 42 bd 75 08 00 45 00 ..)...../B.u..E. 0010 00 e4 0a f6 00 00 40 11 30 6b a5 e3 f9 6d a5 e3 ......@.0k...m.. 0020 f9 73 01 f4 01 f4 00 d0 45 fb 5f 98 21 1e 47 a8 .s......E._.!.G. 0030 5e bd af 33 e9 0f b6 42 7a f8 04 10 02 00 00 00 ^..3...Bz....... 0040 00 00 00 00 00 c8 0a 00 00 84 da d3 7b a6 7f eb ............{... 0050 50 a0 3d 70 74 96 bb 36 4b ad cb 4d d1 ee f6 58 P.=pt..6K..M...X 0060 3d 13 0c 32 a4 fb 70 76 e4 5e 6e b2 9f fb d8 68 =..2..pv.^n....h 0070 fa 41 62 87 9a ba c2 0d c3 be 65 ac 08 76 c5 57 .Ab.......e..v.W 0080 7f 2d 0d 66 b6 b9 77 6f e7 73 65 65 48 7e 9e 9a .-.f..wo.seeH~.. 0090 c7 7b ae ee 11 1f eb ad 76 6b 42 ee 0b f3 4b 0e .{......vkB...K. 00a0 77 ca 68 30 6a ad 55 90 ba 5e d0 cd 07 c0 1b ee w.h0j.U..^...... 00b0 82 36 88 5e d4 32 95 89 b9 38 1e 41 fe ed 96 3c .6.^.2...8.A...< 00c0 0e 05 d0 73 95 84 ff ea 66 6b 0d 00 00 14 95 59 ...s....fk.....Y 00d0 f9 7d c3 b3 24 55 38 66 df 04 26 25 f3 da 00 00 .}..$U8f..&%.... 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 5 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 18, 2007 14:53:19.307875000 Time delta from previous packet: 0.841903000 seconds Time since reference or first frame: 3.618615000 seconds Frame Number: 5 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Destination: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x03b2 (946) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf81a [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.109 (165.227.249.109) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x4bb9 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5F98211E47A85EBD Responder cookie: 0xAF33E90FB6427AF8 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 1b 2f 42 bd 75 00 0c 29 ab 06 ab 08 00 45 00 ../B.u..).....E. 0010 00 78 03 b2 00 00 80 11 f8 1a a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 6d 01 f4 01 f4 00 64 4b b9 5f 98 21 1e 47 a8 .m.....dK._.!.G. 0030 5e bd af 33 e9 0f b6 42 7a f8 05 10 02 01 00 00 ^..3...Bz....... 0040 00 00 00 00 00 5c ac ce 59 0b b7 e2 96 b1 76 70 .....\..Y.....vp 0050 1b db 78 7e 28 52 97 a2 a6 f4 0c 9d c9 e6 3b d5 ..x~(R........;. 0060 75 2f 25 4a a3 7c 5e 98 94 d3 ca a2 c2 84 d4 f9 u/%J.|^......... 0070 d1 0b aa 55 95 c2 ed 4a 53 4e 7f 50 0d d1 62 26 ...U...JSN.P..b& 0080 4d df ca 16 b3 da M..... Frame 6 (118 bytes on wire, 118 bytes captured) Arrival Time: Oct 18, 2007 14:53:19.356291000 Time delta from previous packet: 0.048416000 seconds Time since reference or first frame: 3.667031000 seconds Frame Number: 6 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.109 (165.227.249.109), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0af7 (2807) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x30e6 [correct] Good: True Bad : False Source: 165.227.249.109 (165.227.249.109) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x9c69 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5F98211E47A85EBD Responder cookie: 0xAF33E90FB6427AF8 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 ab 06 ab 00 1b 2f 42 bd 75 08 00 45 00 ..)...../B.u..E. 0010 00 68 0a f7 00 00 40 11 30 e6 a5 e3 f9 6d a5 e3 .h....@.0....m.. 0020 f9 73 01 f4 01 f4 00 54 9c 69 5f 98 21 1e 47 a8 .s.....T.i_.!.G. 0030 5e bd af 33 e9 0f b6 42 7a f8 05 10 02 01 00 00 ^..3...Bz....... 0040 00 00 00 00 00 4c 3d 44 c7 50 8d bd c2 7a 77 4f .....L=D.P...zwO 0050 0d 1e 87 34 f4 b0 ae 10 eb a9 a9 02 70 48 78 d6 ...4........pHx. 0060 6e e7 db e9 a3 83 11 46 6e c4 83 d7 ec e8 48 53 n......Fn.....HS 0070 28 4c ec c2 6a d5 (L..j. Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 18, 2007 14:53:19.382726000 Time delta from previous packet: 0.026435000 seconds Time since reference or first frame: 3.693466000 seconds Frame Number: 7 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.109 (165.227.249.109), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0af8 (2808) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x30d5 [correct] Good: True Bad : False Source: 165.227.249.109 (165.227.249.109) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x9fbe [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5F98211E47A85EBD Responder cookie: 0xAF33E90FB6427AF8 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xA977DAC2 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 ab 06 ab 00 1b 2f 42 bd 75 08 00 45 00 ..)...../B.u..E. 0010 00 78 0a f8 00 00 40 11 30 d5 a5 e3 f9 6d a5 e3 .x....@.0....m.. 0020 f9 73 01 f4 01 f4 00 64 9f be 5f 98 21 1e 47 a8 .s.....d.._.!.G. 0030 5e bd af 33 e9 0f b6 42 7a f8 08 10 05 01 a9 77 ^..3...Bz......w 0040 da c2 00 00 00 5c 18 60 9c e9 dc 9b 8c 7a ef d7 .....\.`.....z.. 0050 02 d4 7e e2 c0 9e 80 24 c8 1c a4 0e 65 04 59 e1 ..~....$....e.Y. 0060 1f 21 70 5c 1d c2 fa 5c 04 6e c5 89 48 c8 43 39 .!p\...\.n..H.C9 0070 62 2e 25 46 15 5b 76 60 f0 8d ce 0a 6e 03 f8 99 b.%F.[v`....n... 0080 84 ef e1 7c 02 69 ...|.i Frame 8 (342 bytes on wire, 342 bytes captured) Arrival Time: Oct 18, 2007 14:53:21.578501000 Time delta from previous packet: 2.195775000 seconds Time since reference or first frame: 5.889241000 seconds Frame Number: 8 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Destination: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x03b4 (948) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf748 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.109 (165.227.249.109) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x4723 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5F98211E47A85EBD Responder cookie: 0xAF33E90FB6427AF8 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xE11F4A57 Length: 300 Encrypted payload (272 bytes) 0000 00 1b 2f 42 bd 75 00 0c 29 ab 06 ab 08 00 45 00 ../B.u..).....E. 0010 01 48 03 b4 00 00 80 11 f7 48 a5 e3 f9 73 a5 e3 .H.......H...s.. 0020 f9 6d 01 f4 01 f4 01 34 47 23 5f 98 21 1e 47 a8 .m.....4G#_.!.G. 0030 5e bd af 33 e9 0f b6 42 7a f8 08 10 20 01 e1 1f ^..3...Bz... ... 0040 4a 57 00 00 01 2c 34 db c6 d9 ab b5 fd 6e 52 98 JW...,4......nR. 0050 74 ae 7d 2c 48 45 58 aa a7 15 59 cc 31 0c ba 3f t.},HEX...Y.1..? 0060 b0 1a cd c6 5f 57 52 60 32 3a 56 4e e6 7a e6 75 ...._WR`2:VN.z.u 0070 5f 78 f0 51 df 60 10 eb a8 4b e4 03 10 96 36 e7 _x.Q.`...K....6. 0080 6c 98 ba b4 bd 9c 31 46 d5 ed 4c 10 1f 59 fd b6 l.....1F..L..Y.. 0090 90 71 67 ef 07 c8 c9 4d fc 91 43 ed 32 17 b9 c5 .qg....M..C.2... 00a0 99 18 dc b3 b7 27 6c 64 65 f0 a2 c0 e0 1f a2 14 .....'lde....... 00b0 bc f0 4c a4 87 44 b2 f4 20 4e a0 ac 1a a0 da c6 ..L..D.. N...... 00c0 8a b6 0d fc f8 fd cb d4 7b 7c b6 a8 da 64 fa cd ........{|...d.. 00d0 49 63 72 ed 6f 6d a7 e9 21 07 d0 c5 76 7e e0 60 Icr.om..!...v~.` 00e0 76 00 dd 31 e7 a1 cf fb f5 ec 88 e5 29 d5 22 54 v..1........)."T 00f0 db a4 88 a5 77 eb 84 7e d4 e9 bf 5c 40 fb 26 0f ....w..~...\@.&. 0100 c5 4f 7e 4b 09 5c ab 7f 99 f8 13 21 14 2a 2b f4 .O~K.\.....!.*+. 0110 f1 6d c5 9d f9 1f d6 1b 02 57 ac 4e f1 6c 28 d1 .m.......W.N.l(. 0120 b7 00 25 f8 0b 61 a2 41 2e 33 16 9c 1f b6 83 b4 ..%..a.A.3...... 0130 9e 4f fa b4 c9 81 89 dc 14 ed 29 d3 d5 75 10 bd .O........)..u.. 0140 40 79 9c 9d fa 43 86 60 2e 4f 38 8c 7b 2f 57 b5 @y...C.`.O8.{/W. 0150 d0 4e a0 f3 40 dd .N..@. Frame 9 (342 bytes on wire, 342 bytes captured) Arrival Time: Oct 18, 2007 14:53:22.136960000 Time delta from previous packet: 0.558459000 seconds Time since reference or first frame: 6.447700000 seconds Frame Number: 9 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.109 (165.227.249.109), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0af9 (2809) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3004 [correct] Good: True Bad : False Source: 165.227.249.109 (165.227.249.109) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x5429 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5F98211E47A85EBD Responder cookie: 0xAF33E90FB6427AF8 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xE11F4A57 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 ab 06 ab 00 1b 2f 42 bd 75 08 00 45 00 ..)...../B.u..E. 0010 01 48 0a f9 00 00 40 11 30 04 a5 e3 f9 6d a5 e3 .H....@.0....m.. 0020 f9 73 01 f4 01 f4 01 34 54 29 5f 98 21 1e 47 a8 .s.....4T)_.!.G. 0030 5e bd af 33 e9 0f b6 42 7a f8 08 10 20 01 e1 1f ^..3...Bz... ... 0040 4a 57 00 00 01 2c 14 8a f4 6e 0e 06 e9 de 7e 99 JW...,...n....~. 0050 6f 8e 06 50 78 bf e0 d6 d8 d6 7b b4 58 54 6d 99 o..Px.....{.XTm. 0060 a7 19 b5 a5 83 a1 98 ec 72 a5 86 6c a8 01 55 4d ........r..l..UM 0070 ed 62 ae 14 3d 56 b0 26 6f 10 e0 3a 63 e1 82 88 .b..=V.&o..:c... 0080 e6 7a fe 8c de 6e 3f c9 9a 10 07 45 c9 f3 c3 c0 .z...n?....E.... 0090 2c 27 a3 4f 3c c0 1c 3d e2 67 b9 6f 45 3a a2 e9 ,'.O<..=.g.oE:.. 00a0 6f 72 21 5f 93 ec bf 43 b6 75 f1 50 5b 2f 69 a8 or!_...C.u.P[/i. 00b0 a7 0a e3 c4 a9 12 37 f1 1a 6c a3 4c 8f d3 e2 b4 ......7..l.L.... 00c0 4f 2f a9 0b 52 d1 5b 70 c0 43 1b c3 27 a3 9e 24 O/..R.[p.C..'..$ 00d0 fb 5c 8b b5 9e fd 28 c3 eb 10 ef 22 bc b8 9c 0e .\....(....".... 00e0 9d 39 c3 ed 71 ed 3b a8 59 63 5a 65 db 57 99 29 .9..q.;.YcZe.W.) 00f0 08 fa b9 18 71 2a 3d ec 17 70 a6 de 21 dc af 1e ....q*=..p..!... 0100 1f 8c 84 c3 95 c9 94 13 bf 82 00 92 84 3e 81 40 .............>.@ 0110 57 51 8b 7c 63 2d 5d 42 9c 6e b9 88 ff e3 95 e8 WQ.|c-]B.n...... 0120 3b ae 76 eb d5 4f 03 58 3c bc 07 c9 d9 58 03 f6 ;.v..O.X<....X.. 0130 51 5b 8c 4e c0 92 04 20 5f 0b ff 0d 34 6c e1 d4 Q[.N... _...4l.. 0140 27 9f 87 04 c1 93 3d 72 7f cc 37 a9 52 87 09 04 '.....=r..7.R... 0150 21 a9 2c b9 c7 20 !.,.. Frame 10 (102 bytes on wire, 102 bytes captured) Arrival Time: Oct 18, 2007 14:53:22.141874000 Time delta from previous packet: 0.004914000 seconds Time since reference or first frame: 6.452614000 seconds Frame Number: 10 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Destination: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x03b5 (949) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf837 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.109 (165.227.249.109) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x3b6e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5F98211E47A85EBD Responder cookie: 0xAF33E90FB6427AF8 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xE11F4A57 Length: 60 Encrypted payload (32 bytes) 0000 00 1b 2f 42 bd 75 00 0c 29 ab 06 ab 08 00 45 00 ../B.u..).....E. 0010 00 58 03 b5 00 00 80 11 f8 37 a5 e3 f9 73 a5 e3 .X.......7...s.. 0020 f9 6d 01 f4 01 f4 00 44 3b 6e 5f 98 21 1e 47 a8 .m.....D;n_.!.G. 0030 5e bd af 33 e9 0f b6 42 7a f8 08 10 20 01 e1 1f ^..3...Bz... ... 0040 4a 57 00 00 00 3c 25 e2 e5 de bc 0e 4b cc b6 a5 JW...<%.....K... 0050 85 3b 48 1e 28 13 56 9d 8d a3 d8 52 a7 89 0c e9 .;H.(.V....R.... 0060 20 4a bb 50 30 b8 J.P0. Frame 11 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 18, 2007 14:53:26.136988000 Time delta from previous packet: 3.995114000 seconds Time since reference or first frame: 10.447728000 seconds Frame Number: 11 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Destination: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfbaa [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.109 (165.227.249.109) Encapsulating Security Payload SPI: 0x00608890 Sequence: 1 Data (92 bytes) 0000 00 1b 2f 42 bd 75 00 0c 29 ab 06 ab 08 00 45 00 ../B.u..).....E. 0010 00 78 00 01 00 00 80 32 fb aa a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 6d 00 60 88 90 00 00 00 01 59 02 b5 eb 62 76 .m.`......Y...bv 0030 5e 3b 34 02 a0 c1 ea 9c 03 b3 b7 92 c0 fb 9f f2 ^;4............. 0040 0e 02 f5 8b 57 9d 8b 26 e0 02 eb 9d 4d e0 47 7f ....W..&....M.G. 0050 8c c5 a8 c0 fb fb 68 5a 74 da 2b 88 ed e9 fd 8c ......hZt.+..... 0060 5e bb 36 17 79 7a 56 ad 09 80 f5 fa a1 88 60 91 ^.6.yzV.......`. 0070 a9 3e 74 54 ef 93 29 32 22 93 86 60 da 1c b6 dc .>tT..)2"..`.... 0080 a9 b8 31 07 d5 dc ..1... Frame 12 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 18, 2007 14:53:26.141882000 Time delta from previous packet: 0.004894000 seconds Time since reference or first frame: 10.452622000 seconds Frame Number: 12 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.109 (165.227.249.109), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0afa (2810) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x30b2 [correct] Good: True Bad : False Source: 165.227.249.109 (165.227.249.109) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x82e68900 Sequence: 1 Data (92 bytes) 0000 00 0c 29 ab 06 ab 00 1b 2f 42 bd 75 08 00 45 00 ..)...../B.u..E. 0010 00 78 0a fa 00 00 40 32 30 b2 a5 e3 f9 6d a5 e3 .x....@20....m.. 0020 f9 73 82 e6 89 00 00 00 00 01 5b 87 63 ad 32 f5 .s........[.c.2. 0030 b9 c0 17 bb c3 ea b3 c9 d6 52 2b 56 42 43 bb 6d .........R+VBC.m 0040 51 88 ba a8 71 53 d6 3a b4 b3 a7 ec 02 16 6c 34 Q...qS.:......l4 0050 ac 4c 3f eb 0b 22 2f 25 ab cf ec fa 15 93 a2 e5 .L?.."/%........ 0060 30 40 cb 59 5c 30 dd 7a a0 2c f4 4c 25 cc cf 88 0@.Y\0.z.,.L%... 0070 54 57 e2 21 27 a5 1a 3f 4a 96 fe 1d 6b 8a df 97 TW.!'..?J...k... 0080 2b d8 7c cf f8 e8 +.|... Frame 13 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 18, 2007 14:53:27.117627000 Time delta from previous packet: 0.975745000 seconds Time since reference or first frame: 11.428367000 seconds Frame Number: 13 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Destination: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfba9 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.109 (165.227.249.109) Encapsulating Security Payload SPI: 0x00608890 Sequence: 2 Data (92 bytes) 0000 00 1b 2f 42 bd 75 00 0c 29 ab 06 ab 08 00 45 00 ../B.u..).....E. 0010 00 78 00 02 00 00 80 32 fb a9 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 6d 00 60 88 90 00 00 00 02 f5 fa a1 88 60 91 .m.`..........`. 0030 a9 3e 74 54 ef 93 29 32 22 93 bb e0 5c 59 22 30 .>tT..)2"...\Y"0 0040 fc b3 69 4f 81 72 15 43 ae fd a4 e7 df d0 05 14 ..iO.r.C........ 0050 69 2b d1 51 c4 3b ab 1f cf b1 6f 09 9a e8 47 b3 i+.Q.;....o...G. 0060 33 85 0e 27 13 b5 6c 6e e4 7a 52 03 43 fb 74 42 3..'..ln.zR.C.tB 0070 ae 06 7f 4d 36 82 63 88 ca 5c ea 24 44 91 e5 a1 ...M6.c..\.$D... 0080 dd 51 8b 9a 72 33 .Q..r3 Frame 14 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 18, 2007 14:53:27.124187000 Time delta from previous packet: 0.006560000 seconds Time since reference or first frame: 11.434927000 seconds Frame Number: 14 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:1b:2f:42:bd:75 (00:1b:2f:42:bd:75) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.109 (165.227.249.109), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0afb (2811) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x30b1 [correct] Good: True Bad : False Source: 165.227.249.109 (165.227.249.109) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x82e68900 Sequence: 2 Data (92 bytes) 0000 00 0c 29 ab 06 ab 00 1b 2f 42 bd 75 08 00 45 00 ..)...../B.u..E. 0010 00 78 0a fb 00 00 40 32 30 b1 a5 e3 f9 6d a5 e3 .x....@20....m.. 0020 f9 73 82 e6 89 00 00 00 00 02 d1 3a f7 3c cf 5b .s.........:.<.[ 0030 c6 ca 7f 2f a9 b8 e2 0c c0 4d 2b 96 3c 71 65 c0 .../.....M+.+.'.. 0060 10 12 fa 80 6c cf 2d fc cc 7a c5 8a a6 98 43 23 ....l.-..z....C# 0070 7a 67 42 21 2c 74 d7 a2 e2 5f d2 28 c5 2e 89 a8 zgB!,t..._.(.... 0080 ef db fb 41 1b cc ...A..