Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Nov 30, 2010 10:10:48.161327000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0225 (549) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf97e [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0xecd6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: CD4D5C81F4D89E9F Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 c8 4c 75 18 34 40 00 0c 29 3f 71 77 08 00 45 00 .Lu.4@..)?qw..E. 0010 00 98 02 25 00 00 80 11 f9 7e a5 e3 f9 73 a5 e3 ...%.....~...s.. 0020 f9 76 01 f4 01 f4 00 84 ec d6 cd 4d 5c 81 f4 d8 .v.........M\... 0030 9e 9f 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (166 bytes on wire, 166 bytes captured) Arrival Time: Nov 30, 2010 10:10:48.161354000 [Time delta from previous captured frame: 0.000027000 seconds] [Time delta from previous displayed frame: 0.000027000 seconds] [Time since reference or first frame: 0.000027000 seconds] Frame Number: 2 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0225 (549) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf97e [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0xecd6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: CD4D5C81F4D89E9F Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 c8 4c 75 18 34 40 00 0c 29 3f 71 77 08 00 45 00 .Lu.4@..)?qw..E. 0010 00 98 02 25 00 00 80 11 f9 7e a5 e3 f9 73 a5 e3 ...%.....~...s.. 0020 f9 76 01 f4 01 f4 00 84 ec d6 cd 4d 5c 81 f4 d8 .v.........M\... 0030 9e 9f 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 3 (146 bytes on wire, 146 bytes captured) Arrival Time: Nov 30, 2010 10:10:48.164294000 [Time delta from previous captured frame: 0.002940000 seconds] [Time delta from previous displayed frame: 0.002940000 seconds] [Time since reference or first frame: 0.002967000 seconds] Frame Number: 3 Frame Length: 146 bytes Capture Length: 146 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: c8:4c:75:18:34:40 (c8:4c:75:18:34:40), Dst: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Destination: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.118 (165.227.249.118), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00) 1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x013b (315) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7abc [correct] [Good: True] [Bad : False] Source: 165.227.249.118 (165.227.249.118) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0xa23c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: CD4D5C81F4D89E9F Responder cookie: 37371D48F3036612 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 0c 29 3f 71 77 c8 4c 75 18 34 40 08 00 45 c0 ..)?qw.Lu.4@..E. 0010 00 84 01 3b 00 00 ff 11 7a bc a5 e3 f9 76 a5 e3 ...;....z....v.. 0020 f9 73 01 f4 01 f4 00 70 a2 3c cd 4d 5c 81 f4 d8 .s.....p.<.M\... 0030 9e 9f 37 37 1d 48 f3 03 66 12 01 10 02 00 00 00 ..77.H..f....... 0040 00 00 00 00 00 68 0d 00 00 38 00 00 00 01 00 00 .....h...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 70 80 00 00 ............p... 0080 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 ......>.in.c...B 0090 7b 1f {. Frame 4 (346 bytes on wire, 346 bytes captured) Arrival Time: Nov 30, 2010 10:10:50.272366000 [Time delta from previous captured frame: 2.108072000 seconds] [Time delta from previous displayed frame: 2.108072000 seconds] [Time since reference or first frame: 2.111039000 seconds] Frame Number: 4 Frame Length: 346 bytes Capture Length: 346 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x0226 (550) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8c9 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xd020 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: CD4D5C81F4D89E9F Responder cookie: 37371D48F3036612 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: 6FE6C664BE4F4B59D35AB2EF45F44BFA474B410E NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: Vendor ID (13) Payload length: 24 Hash of address and port: 53987BD79423F4A24D4555117ABD0E6DA6795EB5 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 c8 4c 75 18 34 40 00 0c 29 3f 71 77 08 00 45 00 .Lu.4@..)?qw..E. 0010 01 4c 02 26 00 00 80 11 f8 c9 a5 e3 f9 73 a5 e3 .L.&.........s.. 0020 f9 76 01 f4 01 f4 01 38 d0 20 cd 4d 5c 81 f4 d8 .v.....8. .M\... 0030 9e 9f 37 37 1d 48 f3 03 66 12 04 10 02 00 00 00 ..77.H..f....... 0040 00 00 00 00 01 30 0a 00 00 84 98 5f 0e bc 15 87 .....0....._.... 0050 44 0c 77 3b 8f 31 aa eb 4e 28 31 9b 8e b3 a8 ad D.w;.1..N(1..... 0060 11 3a 2d f3 7d df f0 61 36 ad c3 f9 b6 46 15 d8 .:-.}..a6....F.. 0070 cc f9 f9 cf f2 6f c3 c4 61 70 a9 9a 12 19 58 be .....o..ap....X. 0080 4b 5a 86 55 f0 0a f9 6c 81 89 e8 1f 1c 5f ec a9 KZ.U...l....._.. 0090 ae e4 5f 34 19 ea aa 10 2b b1 ce df 21 3e 8a c2 .._4....+...!>.. 00a0 75 21 e0 83 55 44 d4 a0 92 0f 5a e2 bd e1 e9 08 u!..UD....Z..... 00b0 6b a1 92 7b 1f eb 41 b9 24 41 12 65 22 98 49 58 k..{..A.$A.e".IX 00c0 b6 fd f9 2c 4a a8 34 e7 28 38 82 00 00 18 97 e9 ...,J.4.(8...... 00d0 8f 49 fe fc cc 4d 39 d2 2f 56 96 87 48 6b ae fe .I...M9./V..Hk.. 00e0 4e ef 82 00 00 18 6f e6 c6 64 be 4f 4b 59 d3 5a N.....o..d.OKY.Z 00f0 b2 ef 45 f4 4b fa 47 4b 41 0e 0d 00 00 18 53 98 ..E.K.GKA.....S. 0100 7b d7 94 23 f4 a2 4d 45 55 11 7a bd 0e 6d a6 79 {..#..MEU.z..m.y 0110 5e b5 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 ^....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 5 (346 bytes on wire, 346 bytes captured) Arrival Time: Nov 30, 2010 10:10:50.272396000 [Time delta from previous captured frame: 0.000030000 seconds] [Time delta from previous displayed frame: 0.000030000 seconds] [Time since reference or first frame: 2.111069000 seconds] Frame Number: 5 Frame Length: 346 bytes Capture Length: 346 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x0226 (550) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8c9 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xd020 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: CD4D5C81F4D89E9F Responder cookie: 37371D48F3036612 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: 6FE6C664BE4F4B59D35AB2EF45F44BFA474B410E NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: Vendor ID (13) Payload length: 24 Hash of address and port: 53987BD79423F4A24D4555117ABD0E6DA6795EB5 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 c8 4c 75 18 34 40 00 0c 29 3f 71 77 08 00 45 00 .Lu.4@..)?qw..E. 0010 01 4c 02 26 00 00 80 11 f8 c9 a5 e3 f9 73 a5 e3 .L.&.........s.. 0020 f9 76 01 f4 01 f4 01 38 d0 20 cd 4d 5c 81 f4 d8 .v.....8. .M\... 0030 9e 9f 37 37 1d 48 f3 03 66 12 04 10 02 00 00 00 ..77.H..f....... 0040 00 00 00 00 01 30 0a 00 00 84 98 5f 0e bc 15 87 .....0....._.... 0050 44 0c 77 3b 8f 31 aa eb 4e 28 31 9b 8e b3 a8 ad D.w;.1..N(1..... 0060 11 3a 2d f3 7d df f0 61 36 ad c3 f9 b6 46 15 d8 .:-.}..a6....F.. 0070 cc f9 f9 cf f2 6f c3 c4 61 70 a9 9a 12 19 58 be .....o..ap....X. 0080 4b 5a 86 55 f0 0a f9 6c 81 89 e8 1f 1c 5f ec a9 KZ.U...l....._.. 0090 ae e4 5f 34 19 ea aa 10 2b b1 ce df 21 3e 8a c2 .._4....+...!>.. 00a0 75 21 e0 83 55 44 d4 a0 92 0f 5a e2 bd e1 e9 08 u!..UD....Z..... 00b0 6b a1 92 7b 1f eb 41 b9 24 41 12 65 22 98 49 58 k..{..A.$A.e".IX 00c0 b6 fd f9 2c 4a a8 34 e7 28 38 82 00 00 18 97 e9 ...,J.4.(8...... 00d0 8f 49 fe fc cc 4d 39 d2 2f 56 96 87 48 6b ae fe .I...M9./V..Hk.. 00e0 4e ef 82 00 00 18 6f e6 c6 64 be 4f 4b 59 d3 5a N.....o..d.OKY.Z 00f0 b2 ef 45 f4 4b fa 47 4b 41 0e 0d 00 00 18 53 98 ..E.K.GKA.....S. 0100 7b d7 94 23 f4 a2 4d 45 55 11 7a bd 0e 6d a6 79 {..#..MEU.z..m.y 0110 5e b5 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 ^....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 6 (346 bytes on wire, 346 bytes captured) Arrival Time: Nov 30, 2010 10:10:50.302580000 [Time delta from previous captured frame: 0.030184000 seconds] [Time delta from previous displayed frame: 0.030184000 seconds] [Time since reference or first frame: 2.141253000 seconds] Frame Number: 6 Frame Length: 346 bytes Capture Length: 346 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: c8:4c:75:18:34:40 (c8:4c:75:18:34:40), Dst: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Destination: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.118 (165.227.249.118), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00) 1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x013c (316) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x79f3 [correct] [Good: True] [Bad : False] Source: 165.227.249.118 (165.227.249.118) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0x3b2a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: CD4D5C81F4D89E9F Responder cookie: 37371D48F3036612 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: CISCO-UNITY-1.0 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: CISCO-UNITY-1.0 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID: C2F0BA55F3026612BD7BA813B25DAB9E Next payload: Vendor ID (13) Payload length: 20 Vendor ID: C2F0BA55F3026612BD7BA813B25DAB9E Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: 53987BD79423F4A24D4555117ABD0E6DA6795EB5 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: 6FE6C664BE4F4B59D35AB2EF45F44BFA474B410E 0000 00 0c 29 3f 71 77 c8 4c 75 18 34 40 08 00 45 c0 ..)?qw.Lu.4@..E. 0010 01 4c 01 3c 00 00 ff 11 79 f3 a5 e3 f9 76 a5 e3 .L.<....y....v.. 0020 f9 73 01 f4 01 f4 01 38 3b 2a cd 4d 5c 81 f4 d8 .s.....8;*.M\... 0030 9e 9f 37 37 1d 48 f3 03 66 12 04 10 02 00 00 00 ..77.H..f....... 0040 00 00 00 00 01 30 0a 00 00 84 3b 05 2f 6b 42 42 .....0....;./kBB 0050 0a a9 a8 9d 7b be 84 85 3a 79 f4 7a 38 3e 76 4b ....{...:y.z8>vK 0060 67 fb 23 16 04 60 93 e9 66 f7 4b 8a 25 3b 41 84 g.#..`..f.K.%;A. 0070 9b 76 37 85 5d 99 66 a4 05 5c 22 39 25 74 64 4c .v7.].f..\"9%tdL 0080 0f 03 71 1c 7e 45 fe 64 36 ce da c2 da a1 b6 ee ..q.~E.d6....... 0090 5a 3d 32 14 72 8a d1 85 96 69 54 d9 f3 b3 2e 15 Z=2.r....iT..... 00a0 e8 cb ec 21 27 3a b9 e5 23 93 38 ef 91 c8 cf 06 ...!':..#.8..... 00b0 b9 3f de 99 2c a0 cd 6d 94 2b 9f 22 4c c5 59 0a .?..,..m.+."L.Y. 00c0 65 0f c7 c9 e2 02 bb 8b d5 66 0d 00 00 18 90 e4 e........f...... 00d0 3d 29 24 a5 71 c8 e1 aa 69 ed 15 57 92 3e f3 10 =)$.q...i..W.>.. 00e0 61 f4 0d 00 00 14 12 f5 f2 8c 45 71 68 a9 70 2d a.........Eqh.p- 00f0 9f e2 74 cc 01 00 0d 00 00 14 af ca d7 13 68 a1 ..t...........h. 0100 f1 c9 6b 86 96 fc 77 57 01 00 0d 00 00 14 c2 f0 ..k...wW........ 0110 ba 55 f3 02 66 12 bd 7b a8 13 b2 5d ab 9e 82 00 .U..f..{...].... 0120 00 0c 09 00 26 89 df d6 b7 12 82 00 00 18 53 98 ....&.........S. 0130 7b d7 94 23 f4 a2 4d 45 55 11 7a bd 0e 6d a6 79 {..#..MEU.z..m.y 0140 5e b5 00 00 00 18 6f e6 c6 64 be 4f 4b 59 d3 5a ^.....o..d.OKY.Z 0150 b2 ef 45 f4 4b fa 47 4b 41 0e ..E.K.GKA. Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 30, 2010 10:10:51.324352000 [Time delta from previous captured frame: 1.021772000 seconds] [Time delta from previous displayed frame: 1.021772000 seconds] [Time since reference or first frame: 3.163025000 seconds] Frame Number: 7 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0227 (551) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf99c [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xf9be [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: CD4D5C81F4D89E9F Responder cookie: 37371D48F3036612 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 c8 4c 75 18 34 40 00 0c 29 3f 71 77 08 00 45 00 .Lu.4@..)?qw..E. 0010 00 78 02 27 00 00 80 11 f9 9c a5 e3 f9 73 a5 e3 .x.'.........s.. 0020 f9 76 01 f4 01 f4 00 64 f9 be cd 4d 5c 81 f4 d8 .v.....d...M\... 0030 9e 9f 37 37 1d 48 f3 03 66 12 05 10 02 01 00 00 ..77.H..f....... 0040 00 00 00 00 00 5c 28 e4 c8 13 35 75 ee 60 bc a0 .....\(...5u.`.. 0050 96 0c 42 28 08 29 68 45 c4 86 ca a4 f6 a8 b2 63 ..B(.)hE.......c 0060 6b 38 3e 9e 1f 87 9e 4b 8d c7 98 fa 49 ec a7 ab k8>....K....I... 0070 72 1a 14 81 41 04 c4 cd d2 aa 52 e6 1d d8 fe 4c r...A.....R....L 0080 b2 af c3 92 39 cf ....9. Frame 8 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 30, 2010 10:10:51.324377000 [Time delta from previous captured frame: 0.000025000 seconds] [Time delta from previous displayed frame: 0.000025000 seconds] [Time since reference or first frame: 3.163050000 seconds] Frame Number: 8 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0227 (551) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf99c [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xf9be [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: CD4D5C81F4D89E9F Responder cookie: 37371D48F3036612 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 c8 4c 75 18 34 40 00 0c 29 3f 71 77 08 00 45 00 .Lu.4@..)?qw..E. 0010 00 78 02 27 00 00 80 11 f9 9c a5 e3 f9 73 a5 e3 .x.'.........s.. 0020 f9 76 01 f4 01 f4 00 64 f9 be cd 4d 5c 81 f4 d8 .v.....d...M\... 0030 9e 9f 37 37 1d 48 f3 03 66 12 05 10 02 01 00 00 ..77.H..f....... 0040 00 00 00 00 00 5c 28 e4 c8 13 35 75 ee 60 bc a0 .....\(...5u.`.. 0050 96 0c 42 28 08 29 68 45 c4 86 ca a4 f6 a8 b2 63 ..B(.)hE.......c 0060 6b 38 3e 9e 1f 87 9e 4b 8d c7 98 fa 49 ec a7 ab k8>....K....I... 0070 72 1a 14 81 41 04 c4 cd d2 aa 52 e6 1d d8 fe 4c r...A.....R....L 0080 b2 af c3 92 39 cf ....9. Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: Nov 30, 2010 10:10:51.325903000 [Time delta from previous captured frame: 0.001526000 seconds] [Time delta from previous displayed frame: 0.001526000 seconds] [Time since reference or first frame: 3.164576000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: c8:4c:75:18:34:40 (c8:4c:75:18:34:40), Dst: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Destination: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.118 (165.227.249.118), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00) 1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x013d (317) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7ad6 [correct] [Good: True] [Bad : False] Source: 165.227.249.118 (165.227.249.118) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x519e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: CD4D5C81F4D89E9F Responder cookie: 37371D48F3036612 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 3f 71 77 c8 4c 75 18 34 40 08 00 45 c0 ..)?qw.Lu.4@..E. 0010 00 68 01 3d 00 00 ff 11 7a d6 a5 e3 f9 76 a5 e3 .h.=....z....v.. 0020 f9 73 01 f4 01 f4 00 54 51 9e cd 4d 5c 81 f4 d8 .s.....TQ..M\... 0030 9e 9f 37 37 1d 48 f3 03 66 12 05 10 02 01 00 00 ..77.H..f....... 0040 00 00 00 00 00 4c ca 5e 37 19 77 77 35 b9 ac d4 .....L.^7.ww5... 0050 1c e5 ab 94 32 8e e5 2c 36 d3 d5 ab eb 25 40 57 ....2..,6....%@W 0060 e0 c5 1d b1 f5 58 a8 da 28 69 68 db 31 99 ca 94 .....X..(ih.1... 0070 c9 9d ac 00 e5 69 .....i Frame 10 (326 bytes on wire, 326 bytes captured) Arrival Time: Nov 30, 2010 10:10:53.529309000 [Time delta from previous captured frame: 2.203406000 seconds] [Time delta from previous displayed frame: 2.203406000 seconds] [Time since reference or first frame: 5.367982000 seconds] Frame Number: 10 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0228 (552) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8db [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x45dc [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: CD4D5C81F4D89E9F Responder cookie: 37371D48F3036612 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xaa60d61f Length: 284 Encrypted payload (256 bytes) 0000 c8 4c 75 18 34 40 00 0c 29 3f 71 77 08 00 45 00 .Lu.4@..)?qw..E. 0010 01 38 02 28 00 00 80 11 f8 db a5 e3 f9 73 a5 e3 .8.(.........s.. 0020 f9 76 01 f4 01 f4 01 24 45 dc cd 4d 5c 81 f4 d8 .v.....$E..M\... 0030 9e 9f 37 37 1d 48 f3 03 66 12 08 10 20 01 aa 60 ..77.H..f... ..` 0040 d6 1f 00 00 01 1c c4 b1 eb 9e f0 ec 19 86 97 64 ...............d 0050 bb f7 0f 37 3d 30 df f4 70 bf 6c ac 7c 71 09 95 ...7=0..p.l.|q.. 0060 49 76 44 f1 69 4c 45 41 69 c5 52 79 ea 9e b6 10 IvD.iLEAi.Ry.... 0070 73 27 93 f4 eb 70 f2 d7 6d d8 39 7c 9f 5e e8 6e s'...p..m.9|.^.n 0080 eb bf da 14 5b 9c ef 46 e6 24 da 3c 97 3f 89 61 ....[..F.$.<.?.a 0090 25 d7 00 ee 7c 4a e9 6b 16 02 f1 ee 42 23 59 22 %...|J.k....B#Y" 00a0 1d 66 c3 6e 1a 66 f9 8e ec 21 ba b8 cf 6d a6 32 .f.n.f...!...m.2 00b0 4d bb 90 e7 d3 ca 84 b7 5d b4 01 d5 bf 4b cc ef M.......]....K.. 00c0 6e 11 a9 59 74 8d 9a c2 7f c8 ba 71 4e f9 61 e8 n..Yt......qN.a. 00d0 0e c2 5b 97 56 6e 5e 61 01 dd 45 36 9c b1 54 bf ..[.Vn^a..E6..T. 00e0 d7 90 74 04 f1 02 28 01 50 44 02 5a 66 8d 20 fc ..t...(.PD.Zf. . 00f0 1a 77 56 71 90 9a 82 d0 28 39 6b e2 0a a2 1c 20 .wVq....(9k.... 0100 51 12 ed 58 1c 19 44 7a c6 0b 7f 71 87 08 01 38 Q..X..Dz...q...8 0110 3a fd 27 fd 90 0a fe 35 f5 4b f6 d1 8e 2b d6 0f :.'....5.K...+.. 0120 e9 bf 59 41 a0 ff 3a c1 13 89 3f a5 ab f6 3c e8 ..YA..:...?...<. 0130 bd 81 a9 d2 fd 0c 3b da 0a f6 5a 2b 6c 01 a3 e7 ......;...Z+l... 0140 72 cf 2a 19 1b ea r.*... Frame 11 (326 bytes on wire, 326 bytes captured) Arrival Time: Nov 30, 2010 10:10:53.529335000 [Time delta from previous captured frame: 0.000026000 seconds] [Time delta from previous displayed frame: 0.000026000 seconds] [Time since reference or first frame: 5.368008000 seconds] Frame Number: 11 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0228 (552) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8db [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x45dc [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: CD4D5C81F4D89E9F Responder cookie: 37371D48F3036612 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xaa60d61f Length: 284 Encrypted payload (256 bytes) 0000 c8 4c 75 18 34 40 00 0c 29 3f 71 77 08 00 45 00 .Lu.4@..)?qw..E. 0010 01 38 02 28 00 00 80 11 f8 db a5 e3 f9 73 a5 e3 .8.(.........s.. 0020 f9 76 01 f4 01 f4 01 24 45 dc cd 4d 5c 81 f4 d8 .v.....$E..M\... 0030 9e 9f 37 37 1d 48 f3 03 66 12 08 10 20 01 aa 60 ..77.H..f... ..` 0040 d6 1f 00 00 01 1c c4 b1 eb 9e f0 ec 19 86 97 64 ...............d 0050 bb f7 0f 37 3d 30 df f4 70 bf 6c ac 7c 71 09 95 ...7=0..p.l.|q.. 0060 49 76 44 f1 69 4c 45 41 69 c5 52 79 ea 9e b6 10 IvD.iLEAi.Ry.... 0070 73 27 93 f4 eb 70 f2 d7 6d d8 39 7c 9f 5e e8 6e s'...p..m.9|.^.n 0080 eb bf da 14 5b 9c ef 46 e6 24 da 3c 97 3f 89 61 ....[..F.$.<.?.a 0090 25 d7 00 ee 7c 4a e9 6b 16 02 f1 ee 42 23 59 22 %...|J.k....B#Y" 00a0 1d 66 c3 6e 1a 66 f9 8e ec 21 ba b8 cf 6d a6 32 .f.n.f...!...m.2 00b0 4d bb 90 e7 d3 ca 84 b7 5d b4 01 d5 bf 4b cc ef M.......]....K.. 00c0 6e 11 a9 59 74 8d 9a c2 7f c8 ba 71 4e f9 61 e8 n..Yt......qN.a. 00d0 0e c2 5b 97 56 6e 5e 61 01 dd 45 36 9c b1 54 bf ..[.Vn^a..E6..T. 00e0 d7 90 74 04 f1 02 28 01 50 44 02 5a 66 8d 20 fc ..t...(.PD.Zf. . 00f0 1a 77 56 71 90 9a 82 d0 28 39 6b e2 0a a2 1c 20 .wVq....(9k.... 0100 51 12 ed 58 1c 19 44 7a c6 0b 7f 71 87 08 01 38 Q..X..Dz...q...8 0110 3a fd 27 fd 90 0a fe 35 f5 4b f6 d1 8e 2b d6 0f :.'....5.K...+.. 0120 e9 bf 59 41 a0 ff 3a c1 13 89 3f a5 ab f6 3c e8 ..YA..:...?...<. 0130 bd 81 a9 d2 fd 0c 3b da 0a f6 5a 2b 6c 01 a3 e7 ......;...Z+l... 0140 72 cf 2a 19 1b ea r.*... Frame 12 (374 bytes on wire, 374 bytes captured) Arrival Time: Nov 30, 2010 10:10:53.578810000 [Time delta from previous captured frame: 0.049475000 seconds] [Time delta from previous displayed frame: 0.049475000 seconds] [Time since reference or first frame: 5.417483000 seconds] Frame Number: 12 Frame Length: 374 bytes Capture Length: 374 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: c8:4c:75:18:34:40 (c8:4c:75:18:34:40), Dst: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Destination: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.118 (165.227.249.118), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00) 1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 360 Identification: 0x013e (318) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x79d5 [correct] [Good: True] [Bad : False] Source: 165.227.249.118 (165.227.249.118) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 340 Checksum: 0x10b3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: CD4D5C81F4D89E9F Responder cookie: 37371D48F3036612 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xaa60d61f Length: 332 Encrypted payload (304 bytes) 0000 00 0c 29 3f 71 77 c8 4c 75 18 34 40 08 00 45 c0 ..)?qw.Lu.4@..E. 0010 01 68 01 3e 00 00 ff 11 79 d5 a5 e3 f9 76 a5 e3 .h.>....y....v.. 0020 f9 73 01 f4 01 f4 01 54 10 b3 cd 4d 5c 81 f4 d8 .s.....T...M\... 0030 9e 9f 37 37 1d 48 f3 03 66 12 08 10 20 01 aa 60 ..77.H..f... ..` 0040 d6 1f 00 00 01 4c 10 e9 1a be 0b 51 54 9c 32 ff .....L.....QT.2. 0050 49 0d f9 cc 5e 59 12 a0 94 4a ea 9e 85 cc a2 67 I...^Y...J.....g 0060 43 61 dd 6d c5 4b fe 03 e1 40 94 2d f8 95 87 a0 Ca.m.K...@.-.... 0070 49 a5 8b 5d d4 77 ee 78 fa 9e ed 79 b4 3b 0e 16 I..].w.x...y.;.. 0080 10 3f f4 8c 26 f7 f8 72 34 3c 07 e4 b0 8f 81 cd .?..&..r4<...... 0090 51 24 f8 96 04 19 5f b9 88 35 6f 1c 62 8c 94 7d Q$...._..5o.b..} 00a0 f2 f2 43 7b 1e f9 6f 8e b9 5e ed 6a 87 1c a5 09 ..C{..o..^.j.... 00b0 04 78 23 9c ff 6f 56 af e4 52 36 db 80 c5 f4 78 .x#..oV..R6....x 00c0 91 72 ef 3d 56 98 1b 8c 69 51 09 eb 7e 65 d3 73 .r.=V...iQ..~e.s 00d0 ca 0d a4 f9 ac 10 4e ee ac ac b9 ab 96 13 b4 b3 ......N......... 00e0 10 18 a5 4e c7 fa 7d 62 ea d5 70 3e bb e9 e4 8e ...N..}b..p>.... 00f0 b5 a5 60 93 19 72 32 74 df 81 ee 74 8c ee 07 58 ..`..r2t...t...X 0100 3c a6 b3 0e ad 55 7d b9 d1 d2 00 4b 55 d8 91 01 <....U}....KU... 0110 79 22 70 f8 be 83 e0 f5 fd b9 b2 c7 8e 77 65 0a y"p..........we. 0120 62 2d 8a 01 2d 1d 1c 8c 84 e2 e2 78 8b b8 22 34 b-..-......x.."4 0130 85 2c 53 c6 a5 30 8c 8f 4f 20 82 81 4c c0 b0 ae .,S..0..O ..L... 0140 7d ef 71 d9 cb 2f 20 27 f9 45 0d ec 4f 68 d9 43 }.q../ '.E..Oh.C 0150 08 ed 65 b0 cd 12 16 da d9 13 e0 b4 4e 3b 91 57 ..e.........N;.W 0160 ac 84 89 97 ee 27 1f cd cb 1f 06 a6 98 e8 d7 ca .....'.......... 0170 d7 36 09 14 78 c4 .6..x. Frame 13 (102 bytes on wire, 102 bytes captured) Arrival Time: Nov 30, 2010 10:10:53.581524000 [Time delta from previous captured frame: 0.002714000 seconds] [Time delta from previous displayed frame: 0.002714000 seconds] [Time since reference or first frame: 5.420197000 seconds] Frame Number: 13 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x022a (554) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9b9 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x8a64 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: CD4D5C81F4D89E9F Responder cookie: 37371D48F3036612 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xaa60d61f Length: 60 Encrypted payload (32 bytes) 0000 c8 4c 75 18 34 40 00 0c 29 3f 71 77 08 00 45 00 .Lu.4@..)?qw..E. 0010 00 58 02 2a 00 00 80 11 f9 b9 a5 e3 f9 73 a5 e3 .X.*.........s.. 0020 f9 76 01 f4 01 f4 00 44 8a 64 cd 4d 5c 81 f4 d8 .v.....D.d.M\... 0030 9e 9f 37 37 1d 48 f3 03 66 12 08 10 20 01 aa 60 ..77.H..f... ..` 0040 d6 1f 00 00 00 3c df 8a 85 b9 a2 8d 41 7f d1 dc .....<......A... 0050 41 c0 ff 04 c4 31 90 82 f2 03 2e 30 c1 6f 9b 40 A....1.....0.o.@ 0060 4a 39 0d db 99 1c J9.... Frame 14 (102 bytes on wire, 102 bytes captured) Arrival Time: Nov 30, 2010 10:10:53.581552000 [Time delta from previous captured frame: 0.000028000 seconds] [Time delta from previous displayed frame: 0.000028000 seconds] [Time since reference or first frame: 5.420225000 seconds] Frame Number: 14 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x022a (554) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9b9 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x8a64 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: CD4D5C81F4D89E9F Responder cookie: 37371D48F3036612 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xaa60d61f Length: 60 Encrypted payload (32 bytes) 0000 c8 4c 75 18 34 40 00 0c 29 3f 71 77 08 00 45 00 .Lu.4@..)?qw..E. 0010 00 58 02 2a 00 00 80 11 f9 b9 a5 e3 f9 73 a5 e3 .X.*.........s.. 0020 f9 76 01 f4 01 f4 00 44 8a 64 cd 4d 5c 81 f4 d8 .v.....D.d.M\... 0030 9e 9f 37 37 1d 48 f3 03 66 12 08 10 20 01 aa 60 ..77.H..f... ..` 0040 d6 1f 00 00 00 3c df 8a 85 b9 a2 8d 41 7f d1 dc .....<......A... 0050 41 c0 ff 04 c4 31 90 82 f2 03 2e 30 c1 6f 9b 40 A....1.....0.o.@ 0060 4a 39 0d db 99 1c J9.... Frame 15 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 30, 2010 10:11:05.093521000 [Time delta from previous captured frame: 11.511969000 seconds] [Time delta from previous displayed frame: 11.511969000 seconds] [Time since reference or first frame: 16.932194000 seconds] Frame Number: 15 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfba1 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.118 (165.227.249.118) Encapsulating Security Payload ESP SPI: 0x3a9c3344 ESP Sequence: 1 0000 c8 4c 75 18 34 40 00 0c 29 3f 71 77 08 00 45 00 .Lu.4@..)?qw..E. 0010 00 78 00 01 00 00 80 32 fb a1 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 76 3a 9c 33 44 00 00 00 01 2e 01 3f a1 71 4d .v:.3D......?.qM 0030 68 1a 77 8d 16 2e 1d b1 a0 72 91 d6 7b de 3f 3e h.w......r..{.?> 0040 da 84 cc c6 18 da 0a 6d ed 9e d2 2b 2e e8 5f ca .......m...+.._. 0050 5e 11 4d 6f 87 c3 35 f8 23 b7 6b fa ea 3b 89 04 ^.Mo..5.#.k..;.. 0060 a0 77 0c be 76 7a 6e 6e 74 bc 63 f7 38 9c a5 68 .w..vznnt.c.8..h 0070 82 59 96 35 f6 4c f0 6d e2 22 17 2a 3f f5 b6 b9 .Y.5.L.m.".*?... 0080 73 3b 26 95 43 c1 s;&.C. Frame 16 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 30, 2010 10:11:05.093532000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 16.932205000 seconds] Frame Number: 16 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfba1 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.118 (165.227.249.118) Encapsulating Security Payload ESP SPI: 0x3a9c3344 ESP Sequence: 1 0000 c8 4c 75 18 34 40 00 0c 29 3f 71 77 08 00 45 00 .Lu.4@..)?qw..E. 0010 00 78 00 01 00 00 80 32 fb a1 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 76 3a 9c 33 44 00 00 00 01 2e 01 3f a1 71 4d .v:.3D......?.qM 0030 68 1a 77 8d 16 2e 1d b1 a0 72 91 d6 7b de 3f 3e h.w......r..{.?> 0040 da 84 cc c6 18 da 0a 6d ed 9e d2 2b 2e e8 5f ca .......m...+.._. 0050 5e 11 4d 6f 87 c3 35 f8 23 b7 6b fa ea 3b 89 04 ^.Mo..5.#.k..;.. 0060 a0 77 0c be 76 7a 6e 6e 74 bc 63 f7 38 9c a5 68 .w..vznnt.c.8..h 0070 82 59 96 35 f6 4c f0 6d e2 22 17 2a 3f f5 b6 b9 .Y.5.L.m.".*?... 0080 73 3b 26 95 43 c1 s;&.C. Frame 17 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 30, 2010 10:11:05.096268000 [Time delta from previous captured frame: 0.002736000 seconds] [Time delta from previous displayed frame: 0.002736000 seconds] [Time since reference or first frame: 16.934941000 seconds] Frame Number: 17 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: c8:4c:75:18:34:40 (c8:4c:75:18:34:40), Dst: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Destination: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.118 (165.227.249.118), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0140 (320) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7b62 [correct] [Good: True] [Bad : False] Source: 165.227.249.118 (165.227.249.118) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0xdce44cb5 ESP Sequence: 1 0000 00 0c 29 3f 71 77 c8 4c 75 18 34 40 08 00 45 00 ..)?qw.Lu.4@..E. 0010 00 78 01 40 00 00 ff 32 7b 62 a5 e3 f9 76 a5 e3 .x.@...2{b...v.. 0020 f9 73 dc e4 4c b5 00 00 00 01 43 3c 59 d6 45 b4 .s..L.....C*F.RB..v... 0040 d2 f1 6b 23 49 e6 01 85 a8 42 2d 7c dc f0 3b 69 ..k#I....B-|..;i 0050 4f bc 5b 69 be a2 b6 1f c5 41 bf 9a c9 9e 5b df O.[i.....A....[. 0060 f1 2c cc 4d 4c 0c bd 72 64 2d 95 9d f5 f0 02 1d .,.ML..rd-...... 0070 66 b4 9a 1c eb 5d 24 a1 80 f8 8d c5 c8 66 b4 c7 f....]$......f.. 0080 23 5d 65 64 66 fd #]edf. Frame 18 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 30, 2010 10:11:06.094453000 [Time delta from previous captured frame: 0.998185000 seconds] [Time delta from previous displayed frame: 0.998185000 seconds] [Time since reference or first frame: 17.933126000 seconds] Frame Number: 18 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfba0 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.118 (165.227.249.118) Encapsulating Security Payload ESP SPI: 0x3a9c3344 ESP Sequence: 2 0000 c8 4c 75 18 34 40 00 0c 29 3f 71 77 08 00 45 00 .Lu.4@..)?qw..E. 0010 00 78 00 02 00 00 80 32 fb a0 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 76 3a 9c 33 44 00 00 00 02 63 f7 38 9c a5 68 .v:.3D....c.8..h 0030 82 59 96 35 f6 4c f0 6d e2 22 94 37 fc ad 94 4b .Y.5.L.m.".7...K 0040 2e 9f bb 86 2f 20 33 9e 63 d8 f8 b1 ee 73 30 79 ..../ 3.c....s0y 0050 30 e8 26 0e 02 f5 46 fc b4 6d 70 77 5a 82 14 53 0.&...F..mpwZ..S 0060 a4 7b 2f 2e c1 cf 33 d7 d8 a5 78 30 18 32 da 4c .{/...3...x0.2.L 0070 1b 03 b9 31 99 4f ed 1c 30 c1 69 2d 66 28 09 74 ...1.O..0.i-f(.t 0080 99 09 60 ff c2 c4 ..`... Frame 19 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 30, 2010 10:11:06.094482000 [Time delta from previous captured frame: 0.000029000 seconds] [Time delta from previous displayed frame: 0.000029000 seconds] [Time since reference or first frame: 17.933155000 seconds] Frame Number: 19 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfba0 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.118 (165.227.249.118) Encapsulating Security Payload ESP SPI: 0x3a9c3344 ESP Sequence: 2 0000 c8 4c 75 18 34 40 00 0c 29 3f 71 77 08 00 45 00 .Lu.4@..)?qw..E. 0010 00 78 00 02 00 00 80 32 fb a0 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 76 3a 9c 33 44 00 00 00 02 63 f7 38 9c a5 68 .v:.3D....c.8..h 0030 82 59 96 35 f6 4c f0 6d e2 22 94 37 fc ad 94 4b .Y.5.L.m.".7...K 0040 2e 9f bb 86 2f 20 33 9e 63 d8 f8 b1 ee 73 30 79 ..../ 3.c....s0y 0050 30 e8 26 0e 02 f5 46 fc b4 6d 70 77 5a 82 14 53 0.&...F..mpwZ..S 0060 a4 7b 2f 2e c1 cf 33 d7 d8 a5 78 30 18 32 da 4c .{/...3...x0.2.L 0070 1b 03 b9 31 99 4f ed 1c 30 c1 69 2d 66 28 09 74 ...1.O..0.i-f(.t 0080 99 09 60 ff c2 c4 ..`... Frame 20 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 30, 2010 10:11:06.096929000 [Time delta from previous captured frame: 0.002447000 seconds] [Time delta from previous displayed frame: 0.002447000 seconds] [Time since reference or first frame: 17.935602000 seconds] Frame Number: 20 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: c8:4c:75:18:34:40 (c8:4c:75:18:34:40), Dst: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Destination: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.118 (165.227.249.118), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0141 (321) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7b61 [correct] [Good: True] [Bad : False] Source: 165.227.249.118 (165.227.249.118) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0xdce44cb5 ESP Sequence: 2 0000 00 0c 29 3f 71 77 c8 4c 75 18 34 40 08 00 45 00 ..)?qw.Lu.4@..E. 0010 00 78 01 41 00 00 ff 32 7b 61 a5 e3 f9 76 a5 e3 .x.A...2{a...v.. 0020 f9 73 dc e4 4c b5 00 00 00 02 f3 80 93 9c 23 cc .s..L.........#. 0030 fc 1a 36 31 d9 2f a2 5e c9 b6 99 5b 32 e7 8a 6d ..61./.^...[2..m 0040 6d b0 38 d7 40 b4 0b c7 ef 5a 76 8f 5c 43 3f e2 m.8.@....Zv.\C?. 0050 4f ef 61 41 93 04 fe 3c f1 f7 e1 8e 67 90 7d 7e O.aA...<....g.}~ 0060 3a ef 00 57 80 43 6e df 2d 4b 61 63 c4 d9 68 b2 :..W.Cn.-Kac..h. 0070 64 bb 46 84 ce 1e d8 6b 70 0e 0d 89 7f 24 8f 50 d.F....kp....$.P 0080 e0 6e 6a 5a 1b b8 .njZ..