Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Mar 24, 2008 09:31:48.600010000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 166 bytes Capture Length: 166 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x03ef (1007) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf7b5 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x1dd5 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE5A31C254D9D3CE4 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 14 f6 e0 0a 87 00 0c 29 ab 06 ab 08 00 45 00 ........).....E. 0010 00 98 03 ef 00 00 80 11 f7 b5 a5 e3 f9 73 a5 e3 .............s.. 0020 f9 75 01 f4 01 f4 00 84 1d d5 e5 a3 1c 25 4d 9d .u...........%M. 0030 3c e4 00 00 00 00 00 00 00 00 01 10 02 00 00 00 <............... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (202 bytes on wire, 202 bytes captured) Arrival Time: Mar 24, 2008 09:31:48.607694000 Time delta from previous packet: 0.007684000 seconds Time since reference or first frame: 0.007684000 seconds Frame Number: 2 Packet Length: 202 bytes Capture Length: 202 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 188 Identification: 0x1220 (4640) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x2961 [correct] Good: True Bad : False Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 168 Checksum: 0xa128 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE5A31C254D9D3CE4 Responder cookie: 0x7D1CA8F198D20B6C Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 160 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Key-Length (14): Key-Length (128) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 32 Vendor ID: unknown vendor ID: 0x1EBD0C4B9FC0ADF036608456DA16A98734C6FCCD00000013... Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID payload Next payload: NONE (0) Length: 24 Vendor ID: unknown vendor ID: 0x4865617274426561745F4E6F74696679386B0100 0000 00 0c 29 ab 06 ab 00 14 f6 e0 0a 87 08 00 45 00 ..)...........E. 0010 00 bc 12 20 00 00 40 11 29 61 a5 e3 f9 75 a5 e3 ... ..@.)a...u.. 0020 f9 73 01 f4 01 f4 00 a8 a1 28 e5 a3 1c 25 4d 9d .s.......(...%M. 0030 3c e4 7d 1c a8 f1 98 d2 0b 6c 01 10 02 00 00 00 <.}......l...... 0040 00 00 00 00 00 a0 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0e 00 80 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 20 1e bd 0c 4b 9f c0 ad f0 36 60 84 56 da 16 . ...K....6`.V.. 0090 a9 87 34 c6 fc cd 00 00 00 13 00 00 06 0a 0d 00 ..4............. 00a0 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00b0 01 00 00 00 00 18 48 65 61 72 74 42 65 61 74 5f ......HeartBeat_ 00c0 4e 6f 74 69 66 79 38 6b 01 00 Notify8k.. Frame 3 (298 bytes on wire, 298 bytes captured) Arrival Time: Mar 24, 2008 09:31:50.956428000 Time delta from previous packet: 2.348734000 seconds Time since reference or first frame: 2.356418000 seconds Frame Number: 3 Packet Length: 298 bytes Capture Length: 298 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x03f2 (1010) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf72e [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0x4b9d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE5A31C254D9D3CE4 Responder cookie: 0x7D1CA8F198D20B6C Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 14 f6 e0 0a 87 00 0c 29 ab 06 ab 08 00 45 00 ........).....E. 0010 01 1c 03 f2 00 00 80 11 f7 2e a5 e3 f9 73 a5 e3 .............s.. 0020 f9 75 01 f4 01 f4 01 08 4b 9d e5 a3 1c 25 4d 9d .u......K....%M. 0030 3c e4 7d 1c a8 f1 98 d2 0b 6c 04 10 02 00 00 00 <.}......l...... 0040 00 00 00 00 01 00 0a 00 00 84 9e 72 df a2 b7 01 ...........r.... 0050 86 7f 6e 3b b0 fe 18 85 9b 43 27 cb ce 81 1d 62 ..n;.....C'....b 0060 1c 6b c8 95 f9 4c 6d c3 01 83 56 23 22 e8 32 1f .k...Lm...V#".2. 0070 04 cd 11 87 25 44 62 72 d7 62 c8 04 ac 77 49 da ....%Dbr.b...wI. 0080 3d 77 41 01 0c 34 2e 17 fc e3 21 fe f1 e5 7d 44 =wA..4....!...}D 0090 ac 06 39 5e fe 5e c3 59 d1 c9 e2 c1 62 b5 4b f5 ..9^.^.Y....b.K. 00a0 a9 7a d9 cc 0d 47 f5 4f 7b 72 54 a2 13 a6 f4 e1 .z...G.O{rT..... 00b0 59 25 da f5 91 da 02 5b 87 74 2c 1d aa 6c db de Y%.....[.t,..l.. 00c0 fd 2d 01 66 15 c2 5d 87 a8 8a 0d 00 00 18 5e 25 .-.f..].......^% 00d0 3e 8b ce bc 9f 2c c6 8e eb ba 44 4f 89 68 5f 9a >....,....DO.h_. 00e0 9e bb 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 4 (226 bytes on wire, 226 bytes captured) Arrival Time: Mar 24, 2008 09:31:50.995332000 Time delta from previous packet: 0.038904000 seconds Time since reference or first frame: 2.395322000 seconds Frame Number: 4 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x1223 (4643) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x2946 [correct] Good: True Bad : False Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x5697 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE5A31C254D9D3CE4 Responder cookie: 0x7D1CA8F198D20B6C Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 24 Nonce Data 0000 00 0c 29 ab 06 ab 00 14 f6 e0 0a 87 08 00 45 00 ..)...........E. 0010 00 d4 12 23 00 00 40 11 29 46 a5 e3 f9 75 a5 e3 ...#..@.)F...u.. 0020 f9 73 01 f4 01 f4 00 c0 56 97 e5 a3 1c 25 4d 9d .s......V....%M. 0030 3c e4 7d 1c a8 f1 98 d2 0b 6c 04 10 02 00 00 00 <.}......l...... 0040 00 00 00 00 00 b8 0a 00 00 84 46 7f 9c f0 f0 49 ..........F....I 0050 9b c9 dd 74 ef dd ae f0 b0 33 55 52 ed ee a0 f6 ...t.....3UR.... 0060 c1 6e a6 fe 04 78 d9 bc 4a 19 cf 70 f7 65 9b 9e .n...x..J..p.e.. 0070 76 1e 22 b6 e6 3d 16 54 b3 fe d1 96 02 72 e6 19 v."..=.T.....r.. 0080 33 97 18 36 a8 3f 29 46 cc 9f c1 fb f1 cb c3 47 3..6.?)F.......G 0090 c9 4f 58 30 6e 09 e3 44 42 a0 a2 86 6c d3 db 34 .OX0n..DB...l..4 00a0 29 c3 dd 32 e3 d9 18 b7 59 b3 32 88 e4 55 82 81 )..2....Y.2..U.. 00b0 0e 86 fd a3 0c 9a b4 04 00 e1 ef fb 39 dd 20 03 ............9. . 00c0 80 8c 36 92 bc 93 3c 80 de 09 00 00 00 18 46 0f ..6...<.......F. 00d0 d5 2f a5 15 97 63 c4 64 56 fc 71 e1 24 5a bc 4d ./...c.dV.q.$Z.M 00e0 23 58 #X Frame 5 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 24, 2008 09:31:51.968625000 Time delta from previous packet: 0.973293000 seconds Time since reference or first frame: 3.368615000 seconds Frame Number: 5 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x03f6 (1014) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf7ce [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x85b2 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE5A31C254D9D3CE4 Responder cookie: 0x7D1CA8F198D20B6C Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 14 f6 e0 0a 87 00 0c 29 ab 06 ab 08 00 45 00 ........).....E. 0010 00 78 03 f6 00 00 80 11 f7 ce a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 75 01 f4 01 f4 00 64 85 b2 e5 a3 1c 25 4d 9d .u.....d.....%M. 0030 3c e4 7d 1c a8 f1 98 d2 0b 6c 05 10 02 01 00 00 <.}......l...... 0040 00 00 00 00 00 5c dd 2c 54 4a 4c 92 30 65 63 f4 .....\.,TJL.0ec. 0050 cb 86 1f f0 bc f0 6c 76 a6 08 16 71 60 e0 81 15 ......lv...q`... 0060 92 e1 74 10 02 b8 49 b3 ac c6 96 e7 da 97 c7 fb ..t...I......... 0070 77 8e f6 60 04 33 b8 9a 05 34 b9 dd 99 84 ee 9e w..`.3...4...... 0080 73 5f 21 65 d2 cf s_!e.. Frame 6 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 24, 2008 09:31:51.973893000 Time delta from previous packet: 0.005268000 seconds Time since reference or first frame: 3.373883000 seconds Frame Number: 6 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x1225 (4645) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x29a0 [correct] Good: True Bad : False Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xafd8 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE5A31C254D9D3CE4 Responder cookie: 0x7D1CA8F198D20B6C Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 ab 06 ab 00 14 f6 e0 0a 87 08 00 45 00 ..)...........E. 0010 00 78 12 25 00 00 40 11 29 a0 a5 e3 f9 75 a5 e3 .x.%..@.)....u.. 0020 f9 73 01 f4 01 f4 00 64 af d8 e5 a3 1c 25 4d 9d .s.....d.....%M. 0030 3c e4 7d 1c a8 f1 98 d2 0b 6c 05 10 02 01 00 00 <.}......l...... 0040 00 00 00 00 00 5c 93 f3 ee 8f 03 74 3d 2a bf fb .....\.....t=*.. 0050 86 ac 10 ca 9b 08 cf ba 7c df d1 0d 52 c9 7d a6 ........|...R.}. 0060 ed b6 d9 00 f2 7a 32 b6 55 2e c6 93 ab 25 e3 d5 .....z2.U....%.. 0070 ea 82 41 af 20 42 44 2a c6 7b 8d 1a 26 b3 b0 18 ..A. BD*.{..&... 0080 39 b4 02 9a 7d 06 9...}. Frame 7 (326 bytes on wire, 326 bytes captured) Arrival Time: Mar 24, 2008 09:31:53.174521000 Time delta from previous packet: 1.200628000 seconds Time since reference or first frame: 4.574511000 seconds Frame Number: 7 Packet Length: 326 bytes Capture Length: 326 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0409 (1033) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf6fb [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x3f6c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE5A31C254D9D3CE4 Responder cookie: 0x7D1CA8F198D20B6C Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x85E7E8D8 Length: 284 Encrypted payload (256 bytes) 0000 00 14 f6 e0 0a 87 00 0c 29 ab 06 ab 08 00 45 00 ........).....E. 0010 01 38 04 09 00 00 80 11 f6 fb a5 e3 f9 73 a5 e3 .8...........s.. 0020 f9 75 01 f4 01 f4 01 24 3f 6c e5 a3 1c 25 4d 9d .u.....$?l...%M. 0030 3c e4 7d 1c a8 f1 98 d2 0b 6c 08 10 20 01 85 e7 <.}......l.. ... 0040 e8 d8 00 00 01 1c 6a 66 8c 37 df a5 27 7e 12 90 ......jf.7..'~.. 0050 37 e1 b7 39 29 ad 58 0b 81 08 c7 6a 10 39 9e 8f 7..9).X....j.9.. 0060 1c 9d ae 24 43 c7 37 4f fa 37 41 ab 89 ab 66 da ...$C.7O.7A...f. 0070 2a 0a 8c 92 6d e7 0a e4 9c c8 f9 7d e0 9e d0 ad *...m......}.... 0080 6d 10 a4 73 79 3d bd e4 27 2b 85 87 1f 05 f9 ea m..sy=..'+...... 0090 57 de 39 c1 1e c2 ec 7b 6a bd 85 77 c2 b2 64 7a W.9....{j..w..dz 00a0 aa 0b e6 62 77 69 e3 6b e9 73 53 94 3d e9 23 56 ...bwi.k.sS.=.#V 00b0 bb f2 ca 39 9a b1 c9 87 cc 1b 36 22 49 db a4 e5 ...9......6"I... 00c0 b6 53 6c 7f 7a d3 23 34 a8 54 6b 6f ba 5c db ce .Sl.z.#4.Tko.\.. 00d0 9f bb 64 d8 07 c4 da 92 77 7e ce de 5d da 6e 33 ..d.....w~..].n3 00e0 06 84 5f 3c d0 7d 33 b2 e1 27 9e e3 a7 4a 44 92 .._<.}3..'...JD. 00f0 db 76 c0 6c 61 bd 2f ca a3 ad 19 c2 5c 31 6e 23 .v.la./.....\1n# 0100 57 c6 f0 10 ce 40 c1 5d a3 28 72 4d 7d e0 c5 10 W....@.].(rM}... 0110 53 08 e8 8e aa e2 4d e3 22 d3 10 4f ca ce 25 3d S.....M."..O..%= 0120 5a 4b 58 76 c4 56 2a d4 f5 be 38 03 38 9f 1e 55 ZKXv.V*...8.8..U 0130 c8 93 dd dd 7e d4 09 cc c9 04 e5 26 fd 51 65 4e ....~......&.QeN 0140 eb 93 36 18 05 46 ..6..F Frame 8 (358 bytes on wire, 358 bytes captured) Arrival Time: Mar 24, 2008 09:31:53.218612000 Time delta from previous packet: 0.044091000 seconds Time since reference or first frame: 4.618602000 seconds Frame Number: 8 Packet Length: 358 bytes Capture Length: 358 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 344 Identification: 0x1227 (4647) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x28be [correct] Good: True Bad : False Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 324 Checksum: 0xc169 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE5A31C254D9D3CE4 Responder cookie: 0x7D1CA8F198D20B6C Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x85E7E8D8 Length: 316 Encrypted payload (288 bytes) 0000 00 0c 29 ab 06 ab 00 14 f6 e0 0a 87 08 00 45 00 ..)...........E. 0010 01 58 12 27 00 00 40 11 28 be a5 e3 f9 75 a5 e3 .X.'..@.(....u.. 0020 f9 73 01 f4 01 f4 01 44 c1 69 e5 a3 1c 25 4d 9d .s.....D.i...%M. 0030 3c e4 7d 1c a8 f1 98 d2 0b 6c 08 10 20 01 85 e7 <.}......l.. ... 0040 e8 d8 00 00 01 3c 17 92 50 32 94 a8 82 dc 23 6f .....<..P2....#o 0050 88 51 67 b9 cd 3f f2 14 b9 55 9d 5c 42 88 a0 e8 .Qg..?...U.\B... 0060 b7 7f 4f 71 0f 5b 9b f9 5d be 68 09 7f 5d d1 5b ..Oq.[..].h..].[ 0070 44 a6 ad 89 b3 09 93 13 5e 3a 5b e1 cc 4d 83 70 D.......^:[..M.p 0080 5b fd f7 fb 70 6e 78 4b 04 70 4f 1a c5 c3 3c 5c [...pnxK.pO...<\ 0090 88 0f 8b 17 6a af c3 3d fd 02 46 c1 6d b2 03 62 ....j..=..F.m..b 00a0 05 dd f4 f0 ab 01 33 45 c1 cb c7 87 5b 3f 5c 39 ......3E....[?\9 00b0 7d f7 ab 58 02 b7 ec 97 0d b5 d3 be 8d 25 29 81 }..X.........%). 00c0 c0 08 17 cd fe f1 17 a3 6e 74 5f 61 76 b4 f8 d7 ........nt_av... 00d0 2f 08 4e f8 10 61 f7 5f a5 f0 1e da c5 97 6f e0 /.N..a._......o. 00e0 34 30 47 a1 27 b4 7e 24 a5 9f 0d 63 c9 10 de c6 40G.'.~$...c.... 00f0 5f e3 d5 a3 89 9f 42 45 1f b2 e1 bd a8 a6 ac 1f _.....BE........ 0100 b8 e0 22 d7 41 49 61 e0 f0 14 46 4d 4b 00 3b cf ..".AIa...FMK.;. 0110 bb 0e 98 b8 9c 62 50 4d d8 39 5c a8 52 7f ac fb .....bPM.9\.R... 0120 7c 26 9a ca 6a 5a d1 b3 77 d7 99 c8 69 bd 7f 39 |&..jZ..w...i..9 0130 95 7f 38 e7 3c eb fb bb dc 87 de 4e 84 85 0b b7 ..8.<......N.... 0140 c7 b5 6c 43 de 70 be 10 24 a7 c1 d0 73 ab e0 ea ..lC.p..$...s... 0150 bc af f1 f8 5e d1 1f c9 49 34 d0 95 3b 89 2e 13 ....^...I4..;... 0160 e1 d6 5c 10 55 fe ..\.U. Frame 9 (102 bytes on wire, 102 bytes captured) Arrival Time: Mar 24, 2008 09:31:53.218614000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 4.618604000 seconds Frame Number: 9 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x040d (1037) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf7d7 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x3e8b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE5A31C254D9D3CE4 Responder cookie: 0x7D1CA8F198D20B6C Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x85E7E8D8 Length: 60 Encrypted payload (32 bytes) 0000 00 14 f6 e0 0a 87 00 0c 29 ab 06 ab 08 00 45 00 ........).....E. 0010 00 58 04 0d 00 00 80 11 f7 d7 a5 e3 f9 73 a5 e3 .X...........s.. 0020 f9 75 01 f4 01 f4 00 44 3e 8b e5 a3 1c 25 4d 9d .u.....D>....%M. 0030 3c e4 7d 1c a8 f1 98 d2 0b 6c 08 10 20 01 85 e7 <.}......l.. ... 0040 e8 d8 00 00 00 3c db 22 ca 0c 53 4f 09 13 1c 05 .....<."..SO.... 0050 8b 4e 85 98 25 63 82 3f 08 7d d0 92 2e f3 34 ac .N..%c.?.}....4. 0060 f0 ec 15 45 77 9b ...Ew. Frame 10 (118 bytes on wire, 118 bytes captured) Arrival Time: Mar 24, 2008 09:32:02.496691000 Time delta from previous packet: 9.278077000 seconds Time since reference or first frame: 13.896681000 seconds Frame Number: 10 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x1231 (4657) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x2983 [correct] Good: True Bad : False Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x1c915518 Sequence: 1 Data (76 bytes) 0000 00 0c 29 ab 06 ab 00 14 f6 e0 0a 87 08 00 45 00 ..)...........E. 0010 00 68 12 31 00 00 40 32 29 83 a5 e3 f9 75 a5 e3 .h.1..@2)....u.. 0020 f9 73 1c 91 55 18 00 00 00 01 e6 e6 6b fe 2c 78 .s..U.......k.,x 0030 54 de 98 f1 d7 6b b1 69 f8 5f 24 3a 68 72 11 7f T....k.i._$:hr.. 0040 48 60 5e ae 94 f1 3d 2b 69 b8 9b a8 8d f5 ed d6 H`^...=+i....... 0050 37 5c ed 35 fa 7a e8 81 76 7a 25 fc ed de a5 d7 7\.5.z..vz%..... 0060 e9 6d 53 9e 4d 72 26 8b ca 54 39 0c b5 0c be 08 .mS.Mr&..T9..... 0070 f4 78 6a 67 f7 c1 .xjg.. Frame 11 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 24, 2008 09:32:02.863680000 Time delta from previous packet: 0.366989000 seconds Time since reference or first frame: 14.263670000 seconds Frame Number: 11 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfba2 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.117 (165.227.249.117) Encapsulating Security Payload SPI: 0x31e48915 Sequence: 1 Data (92 bytes) 0000 00 14 f6 e0 0a 87 00 0c 29 ab 06 ab 08 00 45 00 ........).....E. 0010 00 78 00 01 00 00 80 32 fb a2 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 75 31 e4 89 15 00 00 00 01 3a 0b 01 31 65 7b .u1.......:..1e{ 0030 5f 87 84 cb 8f 52 e7 39 ec 17 37 e1 2c f7 6a c1 _....R.9..7.,.j. 0040 67 5d a9 14 b0 45 98 07 f0 c4 03 a6 00 a0 57 80 g]...E........W. 0050 00 c7 f6 f0 02 c7 bc 36 33 e3 18 f6 e9 c2 eb 3a .......63......: 0060 76 6a 84 95 55 32 6c 03 66 10 ca 94 cf 39 fa 17 vj..U2l.f....9.. 0070 64 6a 04 24 f8 03 12 19 b7 23 5b b5 13 24 9b fd dj.$.....#[..$.. 0080 a1 06 7b c7 ea 08 ..{... Frame 12 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 24, 2008 09:32:02.867930000 Time delta from previous packet: 0.004250000 seconds Time since reference or first frame: 14.267920000 seconds Frame Number: 12 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x1233 (4659) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x2971 [correct] Good: True Bad : False Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x1c915518 Sequence: 2 Data (92 bytes) 0000 00 0c 29 ab 06 ab 00 14 f6 e0 0a 87 08 00 45 00 ..)...........E. 0010 00 78 12 33 00 00 40 32 29 71 a5 e3 f9 75 a5 e3 .x.3..@2)q...u.. 0020 f9 73 1c 91 55 18 00 00 00 02 f9 52 8b 9d a0 2e .s..U......R.... 0030 90 2f c8 12 4e be 37 0e 7c 67 ba c9 08 ec 73 03 ./..N.7.|g....s. 0040 28 06 ce 18 04 6d 19 2b fb 91 df 2b 5e 72 65 98 (....m.+...+^re. 0050 a6 12 85 35 33 25 d9 35 05 cb 8f a4 82 ba 5d 6b ...53%.5......]k 0060 33 66 55 51 b3 30 8a 83 fc ba 49 2b 38 c1 2a 7c 3fUQ.0....I+8.*| 0070 96 73 60 d8 fb 77 8f 4b b9 78 0a fb 7b ed dd 20 .s`..w.K.x..{.. 0080 7b 81 f0 85 35 b5 {...5.