Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Feb 23, 2009 13:59:53.253505000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 166 bytes Capture Length: 166 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Destination: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.114 (165.227.249.114) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0557 (1367) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf650 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.114 (165.227.249.114) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x691d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7A68EBB3F5D04788 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 a0 1e a0 13 e1 00 0c 29 6d a9 a5 08 00 45 00 ........)m....E. 0010 00 98 05 57 00 00 80 11 f6 50 a5 e3 f9 73 a5 e3 ...W.....P...s.. 0020 f9 72 01 f4 01 f4 00 84 69 1d 7a 68 eb b3 f5 d0 .r......i.zh.... 0030 47 88 00 00 00 00 00 00 00 00 01 10 02 00 00 00 G............... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (126 bytes on wire, 126 bytes captured) Arrival Time: Feb 23, 2009 13:59:53.262248000 Time delta from previous packet: 0.008743000 seconds Time since reference or first frame: 0.008743000 seconds Frame Number: 2 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Source: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.114 (165.227.249.114), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x06c6 (1734) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x350a [correct] Good: True Bad : False Source: 165.227.249.114 (165.227.249.114) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0x6daa [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7A68EBB3F5D04788 Responder cookie: 0x986EB466E207E7E2 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 84 Security Association payload Next payload: NONE (0) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Key-Length (14): Key-Length (128) 0000 00 0c 29 6d a9 a5 00 a0 1e a0 13 e1 08 00 45 00 ..)m..........E. 0010 00 70 06 c6 00 00 40 11 35 0a a5 e3 f9 72 a5 e3 .p....@.5....r.. 0020 f9 73 01 f4 01 f4 00 5c 6d aa 7a 68 eb b3 f5 d0 .s.....\m.zh.... 0030 47 88 98 6e b4 66 e2 07 e7 e2 01 10 02 00 00 00 G..n.f.......... 0040 00 00 00 00 00 54 00 00 00 38 00 00 00 01 00 00 .....T...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 80 0c 0e 10 80 0e 00 80 .............. Frame 3 (298 bytes on wire, 298 bytes captured) Arrival Time: Feb 23, 2009 13:59:55.167192000 Time delta from previous packet: 1.904944000 seconds Time since reference or first frame: 1.913687000 seconds Frame Number: 3 Packet Length: 298 bytes Capture Length: 298 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Destination: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.114 (165.227.249.114) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x055a (1370) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf5c9 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.114 (165.227.249.114) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xd9aa [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7A68EBB3F5D04788 Responder cookie: 0x986EB466E207E7E2 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 a0 1e a0 13 e1 00 0c 29 6d a9 a5 08 00 45 00 ........)m....E. 0010 01 1c 05 5a 00 00 80 11 f5 c9 a5 e3 f9 73 a5 e3 ...Z.........s.. 0020 f9 72 01 f4 01 f4 01 08 d9 aa 7a 68 eb b3 f5 d0 .r........zh.... 0030 47 88 98 6e b4 66 e2 07 e7 e2 04 10 02 00 00 00 G..n.f.......... 0040 00 00 00 00 01 00 0a 00 00 84 2b 13 1b 7f ba a5 ..........+..... 0050 8b da db 3b fe 4a 0f 2a 00 22 3c d4 3a 68 6d 70 ...;.J.*."<.:hmp 0060 fa e1 c8 1a ee d8 e7 06 b7 84 70 f5 6d 21 9a e1 ..........p.m!.. 0070 5c 5e 97 03 ad 8f fb 96 82 5f fa a8 4c 36 42 96 \^......._..L6B. 0080 74 9c c9 6b e4 1e 3a b1 41 39 63 73 27 60 8b a4 t..k..:.A9cs'`.. 0090 00 f6 63 32 46 48 ed 3c 37 dd 02 a5 4f 43 e1 1a ..c2FH.<7...OC.. 00a0 d7 25 5a 20 db 62 2b 4f e8 5d 21 51 75 f7 ae fa .%Z .b+O.]!Qu... 00b0 cc f1 ed 91 a4 01 49 ad 35 c3 f4 81 a9 c9 c7 4e ......I.5......N 00c0 c1 54 1e d6 34 9d b3 53 e8 5a 0d 00 00 18 82 35 .T..4..S.Z.....5 00d0 17 25 df 4c 23 ea 87 0b ab 9d 9a d1 92 44 8c 70 .%.L#........D.p 00e0 cb 86 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 4 (270 bytes on wire, 270 bytes captured) Arrival Time: Feb 23, 2009 13:59:55.546430000 Time delta from previous packet: 0.379238000 seconds Time since reference or first frame: 2.292925000 seconds Frame Number: 4 Packet Length: 270 bytes Capture Length: 270 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Source: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.114 (165.227.249.114), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x06c8 (1736) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3478 [correct] Good: True Bad : False Source: 165.227.249.114 (165.227.249.114) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0xfebe [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7A68EBB3F5D04788 Responder cookie: 0x986EB466E207E7E2 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 68 Nonce Data 0000 00 0c 29 6d a9 a5 00 a0 1e a0 13 e1 08 00 45 00 ..)m..........E. 0010 01 00 06 c8 00 00 40 11 34 78 a5 e3 f9 72 a5 e3 ......@.4x...r.. 0020 f9 73 01 f4 01 f4 00 ec fe be 7a 68 eb b3 f5 d0 .s........zh.... 0030 47 88 98 6e b4 66 e2 07 e7 e2 04 10 02 00 00 00 G..n.f.......... 0040 00 00 00 00 00 e4 0a 00 00 84 c5 d7 85 f2 f0 35 ...............5 0050 18 0f e9 a5 a4 be 5e 02 96 13 a6 af af c5 6d 7c ......^.......m| 0060 fd f7 a0 5f b9 ca 98 b5 a9 44 f0 41 6e 81 d2 36 ..._.....D.An..6 0070 58 d9 4d 80 94 4f ff e4 a7 2a 77 ef ad b2 1b 4e X.M..O...*w....N 0080 7c fe 76 f2 3f 54 b7 78 73 b9 47 70 a3 a0 54 50 |.v.?T.xs.Gp..TP 0090 90 7a 62 9a c2 16 bd 9b b1 b1 e9 65 87 cd 69 20 .zb........e..i 00a0 cb 21 57 fd 56 7b e6 41 e7 d8 06 65 71 27 2e 5d .!W.V{.A...eq'.] 00b0 b3 e9 20 dc c7 ef 7c 39 07 06 5c a4 1d dc 90 21 .. ...|9..\....! 00c0 e1 99 15 8c 7f ce e1 89 72 85 00 00 00 44 3f 87 ........r....D?. 00d0 24 a8 05 02 aa 25 3f c6 96 f6 7a d0 38 09 31 08 $....%?...z.8.1. 00e0 e8 a1 93 cb 31 16 52 f2 b7 56 62 c4 5c 43 58 9d ....1.R..Vb.\CX. 00f0 54 2e d3 a1 d8 b8 05 a1 52 b5 d3 37 15 6e ce e5 T.......R..7.n.. 0100 6c 66 91 03 cc 00 83 73 b6 53 84 4b b3 64 lf.....s.S.K.d Frame 5 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 23, 2009 13:59:56.276688000 Time delta from previous packet: 0.730258000 seconds Time since reference or first frame: 3.023183000 seconds Frame Number: 5 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Destination: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.114 (165.227.249.114) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x055d (1373) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf66a [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.114 (165.227.249.114) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xb197 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7A68EBB3F5D04788 Responder cookie: 0x986EB466E207E7E2 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 a0 1e a0 13 e1 00 0c 29 6d a9 a5 08 00 45 00 ........)m....E. 0010 00 78 05 5d 00 00 80 11 f6 6a a5 e3 f9 73 a5 e3 .x.].....j...s.. 0020 f9 72 01 f4 01 f4 00 64 b1 97 7a 68 eb b3 f5 d0 .r.....d..zh.... 0030 47 88 98 6e b4 66 e2 07 e7 e2 05 10 02 01 00 00 G..n.f.......... 0040 00 00 00 00 00 5c 9e 86 6d 3a e9 cc fd 29 d5 ea .....\..m:...).. 0050 04 05 0f fe 05 2b e0 b1 a0 ac 9e 4a dc e3 eb a5 .....+.....J.... 0060 ea 74 09 6b 96 9e 4e bd f1 d9 96 15 c4 49 36 8a .t.k..N......I6. 0070 7e b0 0e 88 ba 76 58 cb a2 3c 29 e1 7c bd d5 36 ~....vX..<).|..6 0080 fa d6 81 cf e8 1f ...... Frame 6 (118 bytes on wire, 118 bytes captured) Arrival Time: Feb 23, 2009 13:59:56.284370000 Time delta from previous packet: 0.007682000 seconds Time since reference or first frame: 3.030865000 seconds Frame Number: 6 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Source: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.114 (165.227.249.114), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x06c9 (1737) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x350f [correct] Good: True Bad : False Source: 165.227.249.114 (165.227.249.114) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x8f3a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7A68EBB3F5D04788 Responder cookie: 0x986EB466E207E7E2 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 6d a9 a5 00 a0 1e a0 13 e1 08 00 45 00 ..)m..........E. 0010 00 68 06 c9 00 00 40 11 35 0f a5 e3 f9 72 a5 e3 .h....@.5....r.. 0020 f9 73 01 f4 01 f4 00 54 8f 3a 7a 68 eb b3 f5 d0 .s.....T.:zh.... 0030 47 88 98 6e b4 66 e2 07 e7 e2 05 10 02 01 00 00 G..n.f.......... 0040 00 00 00 00 00 4c f0 f9 6b 78 2a 2f 62 a5 93 15 .....L..kx*/b... 0050 57 33 ad 5c 48 03 83 7c c9 9b 87 fb 87 32 17 cd W3.\H..|.....2.. 0060 09 a5 a7 ef d8 36 bd 5d 49 be 5a c7 57 39 93 cb .....6.]I.Z.W9.. 0070 3f b6 0d 0f 0b 67 ?....g Frame 7 (342 bytes on wire, 342 bytes captured) Arrival Time: Feb 23, 2009 13:59:57.751751000 Time delta from previous packet: 1.467381000 seconds Time since reference or first frame: 4.498246000 seconds Frame Number: 7 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Destination: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.114 (165.227.249.114) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0567 (1383) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf590 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.114 (165.227.249.114) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xd3e0 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7A68EBB3F5D04788 Responder cookie: 0x986EB466E207E7E2 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xF17B5562 Length: 300 Encrypted payload (272 bytes) 0000 00 a0 1e a0 13 e1 00 0c 29 6d a9 a5 08 00 45 00 ........)m....E. 0010 01 48 05 67 00 00 80 11 f5 90 a5 e3 f9 73 a5 e3 .H.g.........s.. 0020 f9 72 01 f4 01 f4 01 34 d3 e0 7a 68 eb b3 f5 d0 .r.....4..zh.... 0030 47 88 98 6e b4 66 e2 07 e7 e2 08 10 20 01 f1 7b G..n.f...... ..{ 0040 55 62 00 00 01 2c 08 5f 72 fc cb 9d 5f 1b 8f f1 Ub...,._r..._... 0050 2a 78 a1 2e d8 8e 55 66 91 aa 33 3f 26 dd 18 5f *x....Uf..3?&.._ 0060 25 e3 aa 70 ce b5 29 63 99 58 3c 0b a8 13 65 eb %..p..)c.X<...e. 0070 36 fd b4 3b 75 8b 51 77 cb 49 76 b2 54 87 99 49 6..;u.Qw.Iv.T..I 0080 b7 94 ae 7a 36 d9 f6 c7 fa 09 20 e5 97 22 db 6f ...z6..... ..".o 0090 7b 29 d6 ed 9b 4d c8 18 c7 cb 23 29 2f 77 c2 87 {)...M....#)/w.. 00a0 f2 42 90 66 fb 45 5d 6a ab 43 05 82 f3 bd a2 ab .B.f.E]j.C...... 00b0 c3 3d 83 f5 fe 1d 7e 38 f1 0c 68 b3 c1 06 bf 59 .=....~8..h....Y 00c0 dc 7b 94 76 9f 1f 7c c0 51 3c 0b e8 94 6a ea a6 .{.v..|.Q<...j.. 00d0 4a d7 da e6 a9 dc b4 4f e1 35 f7 ad 61 3a 0c 86 J......O.5..a:.. 00e0 ba 19 1f 65 56 f0 0c ad 45 dd 8b b5 b7 89 30 f2 ...eV...E.....0. 00f0 be 6c c2 b9 05 21 6c 70 7e 31 44 2d fd 09 f1 46 .l...!lp~1D-...F 0100 79 27 11 c9 5a 9b cb 20 57 ec 14 34 cc f2 b3 d9 y'..Z.. W..4.... 0110 ae 76 6e ab f4 cb d2 74 9a 44 ef 44 cb 4d 7a 73 .vn....t.D.D.Mzs 0120 b2 75 d4 a4 d7 46 f6 93 d7 32 34 ea 41 ad 5a 06 .u...F...24.A.Z. 0130 37 53 61 d2 22 87 4b 2c 91 75 54 be e1 f2 a9 cb 7Sa.".K,.uT..... 0140 8f 85 5a b7 9b 87 30 fc 7a 52 43 5a 6e 12 14 94 ..Z...0.zRCZn... 0150 06 44 4d 78 a7 73 .DMx.s Frame 8 (390 bytes on wire, 390 bytes captured) Arrival Time: Feb 23, 2009 13:59:58.128125000 Time delta from previous packet: 0.376374000 seconds Time since reference or first frame: 4.874620000 seconds Frame Number: 8 Packet Length: 390 bytes Capture Length: 390 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Source: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.114 (165.227.249.114), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 376 Identification: 0x06ca (1738) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x33fe [correct] Good: True Bad : False Source: 165.227.249.114 (165.227.249.114) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 356 Checksum: 0x29cd [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7A68EBB3F5D04788 Responder cookie: 0x986EB466E207E7E2 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xF17B5562 Length: 348 Encrypted payload (320 bytes) 0000 00 0c 29 6d a9 a5 00 a0 1e a0 13 e1 08 00 45 00 ..)m..........E. 0010 01 78 06 ca 00 00 40 11 33 fe a5 e3 f9 72 a5 e3 .x....@.3....r.. 0020 f9 73 01 f4 01 f4 01 64 29 cd 7a 68 eb b3 f5 d0 .s.....d).zh.... 0030 47 88 98 6e b4 66 e2 07 e7 e2 08 10 20 01 f1 7b G..n.f...... ..{ 0040 55 62 00 00 01 5c f5 70 7a 2e f7 57 91 1f 25 33 Ub...\.pz..W..%3 0050 44 e5 ac 7b 34 65 12 d9 56 a9 c5 32 99 7b 3b 4f D..{4e..V..2.{;O 0060 f3 54 23 69 85 3b f8 07 b5 48 f3 a7 9b 37 be 71 .T#i.;...H...7.q 0070 f2 4f 51 47 8a a7 65 8e c9 93 16 19 f9 52 c7 69 .OQG..e......R.i 0080 ca 79 af 5f 8a b5 76 c9 0a 7c 70 d0 6f 6a 6b 79 .y._..v..|p.ojky 0090 04 b4 8e 0d 3c b2 33 62 7b f3 26 3e 76 df 78 62 ....<.3b{.&>v.xb 00a0 69 e2 c7 a4 f6 92 e3 4d 79 62 fd 2f 3e ae da ed i......Myb./>... 00b0 f3 bb b7 40 d7 29 64 b8 06 fa 2f f6 c3 5b 59 0c ...@.)d.../..[Y. 00c0 b6 48 fb 6d 1c 60 01 c5 b5 a8 23 ed 6b 29 f7 0e .H.m.`....#.k).. 00d0 e3 b2 02 22 c0 70 ac fe d7 ea 38 1e 6f 81 56 09 ...".p....8.o.V. 00e0 4b e2 07 38 9b 35 bf 60 9f a2 6a fb 19 35 7b 5d K..8.5.`..j..5{] 00f0 86 91 4d 8f a5 85 d8 fc 66 d5 ae 11 7c 90 1c 6f ..M.....f...|..o 0100 30 2e 3a db e7 1a 0b 2e 9b 9e 66 03 f1 f8 8a 42 0.:.......f....B 0110 5a 26 6f a6 b3 fd db 77 88 e9 f5 ad ef 54 3b 4f Z&o....w.....T;O 0120 17 e2 f8 70 f7 3d 20 42 c4 bb 16 90 bb 17 24 02 ...p.= B......$. 0130 1a 8b b1 b2 1b 1a b2 41 b9 40 ab 4a 34 3e 6a 6e .......A.@.J4>jn 0140 f8 5d a4 f2 37 95 2f 3d f7 8b a9 57 65 61 91 49 .]..7./=...Wea.I 0150 b2 a3 36 02 e7 ef a2 94 18 4e f0 92 66 de c2 f6 ..6......N..f... 0160 df c8 b5 7a 3f 6c c8 da 66 ea 90 18 66 cf 2e b4 ...z?l..f...f... 0170 b8 dc 41 24 ed 68 1d 1e 37 d4 cf 0b 89 ba 28 95 ..A$.h..7.....(. 0180 dd 4a 77 4c 1c a7 .JwL.. Frame 9 (102 bytes on wire, 102 bytes captured) Arrival Time: Feb 23, 2009 13:59:58.133188000 Time delta from previous packet: 0.005063000 seconds Time since reference or first frame: 4.879683000 seconds Frame Number: 9 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Destination: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.114 (165.227.249.114) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x056b (1387) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf67c [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.114 (165.227.249.114) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xceaf [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7A68EBB3F5D04788 Responder cookie: 0x986EB466E207E7E2 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xF17B5562 Length: 60 Encrypted payload (32 bytes) 0000 00 a0 1e a0 13 e1 00 0c 29 6d a9 a5 08 00 45 00 ........)m....E. 0010 00 58 05 6b 00 00 80 11 f6 7c a5 e3 f9 73 a5 e3 .X.k.....|...s.. 0020 f9 72 01 f4 01 f4 00 44 ce af 7a 68 eb b3 f5 d0 .r.....D..zh.... 0030 47 88 98 6e b4 66 e2 07 e7 e2 08 10 20 01 f1 7b G..n.f...... ..{ 0040 55 62 00 00 00 3c c1 74 ef 4b 15 eb 4a a0 ae 94 Ub...<.t.K..J... 0050 f7 a0 85 8c a7 87 13 50 6c f4 40 d2 94 f5 d3 40 .......Pl.@....@ 0060 c5 e7 85 e3 6b 11 ....k. Frame 10 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 23, 2009 14:00:08.842627000 Time delta from previous packet: 10.709439000 seconds Time since reference or first frame: 15.589122000 seconds Frame Number: 10 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Destination: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.114 (165.227.249.114) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfba5 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.114 (165.227.249.114) Encapsulating Security Payload SPI: 0x4abc050f Sequence: 1 Data (92 bytes) 0000 00 a0 1e a0 13 e1 00 0c 29 6d a9 a5 08 00 45 00 ........)m....E. 0010 00 78 00 01 00 00 80 32 fb a5 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 72 4a bc 05 0f 00 00 00 01 a2 6d 19 2b e1 da .rJ........m.+.. 0030 70 0b 21 5c f1 d2 58 ab 65 f2 85 88 aa bf 89 aa p.!\..X.e....... 0040 b8 26 26 2e 10 a8 d5 44 ee 8d ff 46 26 4c e6 b8 .&&....D...F&L.. 0050 58 fa 98 20 2a 9b d1 74 dc bc 34 d4 b6 c9 1d 63 X.. *..t..4....c 0060 d3 a8 ed ca 1d 51 5c 7f 4a 89 a2 76 cd cd bb 56 .....Q\.J..v...V 0070 48 de a1 b3 c1 a5 56 1a 34 b0 ea dd 55 a1 00 bc H.....V.4...U... 0080 a0 f1 f7 ed 34 4b ....4K Frame 11 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 23, 2009 14:00:08.844971000 Time delta from previous packet: 0.002344000 seconds Time since reference or first frame: 15.591466000 seconds Frame Number: 11 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Source: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.114 (165.227.249.114), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x06cd (1741) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: ESP (0x32) Header checksum: 0xf5d9 [correct] Good: True Bad : False Source: 165.227.249.114 (165.227.249.114) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x5b07eb4e Sequence: 1 Data (92 bytes) 0000 00 0c 29 6d a9 a5 00 a0 1e a0 13 e1 08 00 45 00 ..)m..........E. 0010 00 78 06 cd 00 00 7f 32 f5 d9 a5 e3 f9 72 a5 e3 .x.....2.....r.. 0020 f9 73 5b 07 eb 4e 00 00 00 01 ae 41 37 9d 5b f7 .s[..N.....A7.[. 0030 df 46 6a c6 49 93 64 c6 ad 6a 48 1c 93 64 97 86 .Fj.I.d..jH..d.. 0040 76 33 7e 93 1f f8 a0 bd e0 fb 5d 0c 02 b3 0c 20 v3~.......].... 0050 a9 ba 19 9d 1e ce 27 04 91 6b 8d 0b f6 78 85 85 ......'..k...x.. 0060 36 8e a9 30 63 cf 2f 54 cd a6 3f 6a a6 db 0e e4 6..0c./T..?j.... 0070 57 1a 76 25 99 07 9e d1 e3 2f 97 4b 23 14 9d b3 W.v%...../.K#... 0080 10 9c 05 db 4e 57 ....NW Frame 12 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 23, 2009 14:00:09.851106000 Time delta from previous packet: 1.006135000 seconds Time since reference or first frame: 16.597601000 seconds Frame Number: 12 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Destination: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.114 (165.227.249.114) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfba4 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.114 (165.227.249.114) Encapsulating Security Payload SPI: 0x4abc050f Sequence: 2 Data (92 bytes) 0000 00 a0 1e a0 13 e1 00 0c 29 6d a9 a5 08 00 45 00 ........)m....E. 0010 00 78 00 02 00 00 80 32 fb a4 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 72 4a bc 05 0f 00 00 00 02 a2 76 cd cd bb 56 .rJ........v...V 0030 48 de a1 b3 c1 a5 56 1a 34 b0 80 57 93 8a 5f 4d H.....V.4..W.._M 0040 15 a4 46 a4 f6 2d 6f e5 91 dd 92 83 79 00 5f 7b ..F..-o.....y._{ 0050 b2 41 83 62 7b ac 67 60 36 f3 ec 15 df f5 64 8b .A.b{.g`6.....d. 0060 61 3b 7d 3e 68 7a 64 ca 9d 6c 43 b8 14 95 8f c9 a;}>hzd..lC..... 0070 f4 26 b0 92 ae c1 74 74 e0 98 76 6b 08 c5 ea c9 .&....tt..vk.... 0080 3e 65 da 4e 03 f7 >e.N.. Frame 13 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 23, 2009 14:00:09.852528000 Time delta from previous packet: 0.001422000 seconds Time since reference or first frame: 16.599023000 seconds Frame Number: 13 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Source: 00:a0:1e:a0:13:e1 (00:a0:1e:a0:13:e1) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.114 (165.227.249.114), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x06d0 (1744) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: ESP (0x32) Header checksum: 0xf5d6 [correct] Good: True Bad : False Source: 165.227.249.114 (165.227.249.114) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x5b07eb4e Sequence: 2 Data (92 bytes) 0000 00 0c 29 6d a9 a5 00 a0 1e a0 13 e1 08 00 45 00 ..)m..........E. 0010 00 78 06 d0 00 00 7f 32 f5 d6 a5 e3 f9 72 a5 e3 .x.....2.....r.. 0020 f9 73 5b 07 eb 4e 00 00 00 02 ae 41 37 9d 5b f7 .s[..N.....A7.[. 0030 df 46 6a c6 49 93 64 c6 ad 6a 22 d3 48 8f d1 7d .Fj.I.d..j".H..} 0040 51 ce 41 90 87 07 f2 bf 20 25 86 ae 12 13 21 e8 Q.A..... %....!. 0050 36 31 36 e2 15 2b 58 74 c2 dd 47 c5 51 f3 b5 c3 616..+Xt..G.Q... 0060 dd 94 94 9b d9 18 3c c5 9e 3c 83 45 ca 29 ec c2 ......<..<.E.).. 0070 51 3d bc 52 7e 94 c0 16 fd 5d 03 ab 8b 9f d4 5c Q=.R~....].....\ 0080 53 bf e5 0b 39 90 S...9.