Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Dec 13, 2006 12:28:05.900242000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 166 bytes Capture Length: 166 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Destination: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.123 (165.227.249.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x01a3 (419) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9fb [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.123 (165.227.249.123) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0xaa8f [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9B91592CC9B0A38B Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 14 6c 8c 6d 16 00 0c 29 ab 06 ab 08 00 45 00 ..l.m...).....E. 0010 00 98 01 a3 00 00 80 11 f9 fb a5 e3 f9 73 a5 e3 .............s.. 0020 f9 7b 01 f4 01 f4 00 84 aa 8f 9b 91 59 2c c9 b0 .{..........Y,.. 0030 a3 8b 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (146 bytes on wire, 146 bytes captured) Arrival Time: Dec 13, 2006 12:28:06.018739000 Time delta from previous packet: 0.118497000 seconds Time since reference or first frame: 0.118497000 seconds Frame Number: 2 Packet Length: 146 bytes Capture Length: 146 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.123 (165.227.249.123), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x0091 (145) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb21 [correct] Good: True Bad : False Source: 165.227.249.123 (165.227.249.123) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0x82ae [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9B91592CC9B0A38B Responder cookie: 0x9140BB1E82AD7396 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 ab 06 ab 00 14 6c 8c 6d 16 08 00 45 00 ..).....l.m...E. 0010 00 84 00 91 40 00 40 11 fb 21 a5 e3 f9 7b a5 e3 ....@.@..!...{.. 0020 f9 73 01 f4 01 f4 00 70 82 ae 9b 91 59 2c c9 b0 .s.....p....Y,.. 0030 a3 8b 91 40 bb 1e 82 ad 73 96 01 10 02 00 00 00 ...@....s....... 0040 00 00 00 00 00 68 0d 00 00 38 00 00 00 01 00 00 .....h...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 00 00 ................ 0080 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 0090 8b 35 .5 Frame 3 (298 bytes on wire, 298 bytes captured) Arrival Time: Dec 13, 2006 12:28:07.869573000 Time delta from previous packet: 1.850834000 seconds Time since reference or first frame: 1.969331000 seconds Frame Number: 3 Packet Length: 298 bytes Capture Length: 298 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Destination: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.123 (165.227.249.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x01a5 (421) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf975 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.123 (165.227.249.123) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0x56eb [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9B91592CC9B0A38B Responder cookie: 0x9140BB1E82AD7396 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 14 6c 8c 6d 16 00 0c 29 ab 06 ab 08 00 45 00 ..l.m...).....E. 0010 01 1c 01 a5 00 00 80 11 f9 75 a5 e3 f9 73 a5 e3 .........u...s.. 0020 f9 7b 01 f4 01 f4 01 08 56 eb 9b 91 59 2c c9 b0 .{......V...Y,.. 0030 a3 8b 91 40 bb 1e 82 ad 73 96 04 10 02 00 00 00 ...@....s....... 0040 00 00 00 00 01 00 0a 00 00 84 6b 9c 1b 01 c3 3f ..........k....? 0050 d1 f8 13 3c fe 28 ca 1a ba 36 4c 3f b7 1e f4 45 ...<.(...6L?...E 0060 ce 83 22 19 da 6a e1 7c 22 62 96 f2 93 1b f0 1c .."..j.|"b...... 0070 18 18 bb 5a 5f 32 54 3a e9 92 0f 3c 2c e7 85 92 ...Z_2T:...<,... 0080 b7 7f 7c 7f dc e9 8c ba 6f 51 ad 58 1f ee c7 1d ..|.....oQ.X.... 0090 a1 15 80 08 aa 99 b6 ff 69 e9 ca cd b4 a1 d7 8c ........i....... 00a0 6e 76 2b 35 1c d9 65 9f 2b 6f 80 e1 62 c0 49 f0 nv+5..e.+o..b.I. 00b0 ab 53 40 bc f6 ba f4 f4 4f 80 d4 86 4e 0a 19 89 .S@.....O...N... 00c0 95 c5 13 b8 ce 1c 71 2b 98 33 0d 00 00 18 60 de ......q+.3....`. 00d0 d0 4d 62 2b 0d 0f 74 11 6b 62 24 ca 83 18 1d c7 .Mb+..t.kb$..... 00e0 82 39 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .9...0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 4 (242 bytes on wire, 242 bytes captured) Arrival Time: Dec 13, 2006 12:28:08.122727000 Time delta from previous packet: 0.253154000 seconds Time since reference or first frame: 2.222485000 seconds Frame Number: 4 Packet Length: 242 bytes Capture Length: 242 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.123 (165.227.249.123), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0092 (146) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfac0 [correct] Good: True Bad : False Source: 165.227.249.123 (165.227.249.123) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0x7a33 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9B91592CC9B0A38B Responder cookie: 0x9140BB1E82AD7396 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 20 Nonce Data Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 ab 06 ab 00 14 6c 8c 6d 16 08 00 45 00 ..).....l.m...E. 0010 00 e4 00 92 40 00 40 11 fa c0 a5 e3 f9 7b a5 e3 ....@.@......{.. 0020 f9 73 01 f4 01 f4 00 d0 7a 33 9b 91 59 2c c9 b0 .s......z3..Y,.. 0030 a3 8b 91 40 bb 1e 82 ad 73 96 04 10 02 00 00 00 ...@....s....... 0040 00 00 00 00 00 c8 0a 00 00 84 11 50 5b ee c3 8a ...........P[... 0050 97 f8 6a e5 39 82 7b 35 67 39 50 b6 f7 cc fa 8e ..j.9.{5g9P..... 0060 fe 35 93 ff f6 fe 1b cf f1 ac 2e a3 b9 9e ee 85 .5.............. 0070 3e c8 77 94 eb 56 f8 7a eb 37 83 57 10 ad f1 74 >.w..V.z.7.W...t 0080 43 16 73 42 e8 cc cc 01 e9 45 30 4d fd 4d 0e 18 C.sB.....E0M.M.. 0090 1a 83 78 2e 7b b7 90 42 3f e0 fc 40 5c d0 28 86 ..x.{..B?..@\.(. 00a0 fe 08 d8 33 ef 76 8b 35 34 d4 34 40 e2 1b c7 85 ...3.v.54.4@.... 00b0 87 eb 8e f2 28 c6 60 82 c6 f4 c4 ca b5 18 41 45 ....(.`.......AE 00c0 18 9e 79 ac c2 4f ef 2b 5f c1 0d 00 00 14 e4 49 ..y..O.+_......I 00d0 91 ed 51 c2 09 31 e2 95 92 67 e1 89 3e bb 00 00 ..Q..1...g..>... 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 5 (134 bytes on wire, 134 bytes captured) Arrival Time: Dec 13, 2006 12:28:09.073868000 Time delta from previous packet: 0.951141000 seconds Time since reference or first frame: 3.173626000 seconds Frame Number: 5 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Destination: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.123 (165.227.249.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x01a6 (422) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa18 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.123 (165.227.249.123) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x76cc [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9B91592CC9B0A38B Responder cookie: 0x9140BB1E82AD7396 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 14 6c 8c 6d 16 00 0c 29 ab 06 ab 08 00 45 00 ..l.m...).....E. 0010 00 78 01 a6 00 00 80 11 fa 18 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 7b 01 f4 01 f4 00 64 76 cc 9b 91 59 2c c9 b0 .{.....dv...Y,.. 0030 a3 8b 91 40 bb 1e 82 ad 73 96 05 10 02 01 00 00 ...@....s....... 0040 00 00 00 00 00 5c 80 d2 29 9d f5 56 9c 0e 7a 7d .....\..)..V..z} 0050 dc 09 87 46 be e8 38 36 db 29 b5 79 42 b8 36 87 ...F..86.).yB.6. 0060 6d e2 b7 85 e9 7a e5 a5 46 b7 94 9b c3 9a 46 3b m....z..F.....F; 0070 1e e8 cd 9c e6 48 a3 9b 18 97 53 e9 1f e7 0b 78 .....H....S....x 0080 22 95 6c 63 08 18 ".lc.. Frame 6 (118 bytes on wire, 118 bytes captured) Arrival Time: Dec 13, 2006 12:28:09.139484000 Time delta from previous packet: 0.065616000 seconds Time since reference or first frame: 3.239242000 seconds Frame Number: 6 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.123 (165.227.249.123), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0093 (147) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb3b [correct] Good: True Bad : False Source: 165.227.249.123 (165.227.249.123) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x56df [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9B91592CC9B0A38B Responder cookie: 0x9140BB1E82AD7396 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 ab 06 ab 00 14 6c 8c 6d 16 08 00 45 00 ..).....l.m...E. 0010 00 68 00 93 40 00 40 11 fb 3b a5 e3 f9 7b a5 e3 .h..@.@..;...{.. 0020 f9 73 01 f4 01 f4 00 54 56 df 9b 91 59 2c c9 b0 .s.....TV...Y,.. 0030 a3 8b 91 40 bb 1e 82 ad 73 96 05 10 02 01 00 00 ...@....s....... 0040 00 00 00 00 00 4c 76 92 d5 a5 ff 5e 70 85 05 24 .....Lv....^p..$ 0050 ee 81 d7 05 31 93 a2 d3 e3 a4 8b 7e 84 cf 34 fd ....1......~..4. 0060 11 5e 57 02 ff 1d 5b 06 02 b2 e3 d8 44 34 61 d8 .^W...[.....D4a. 0070 c1 52 85 ff 9f 3f .R...? Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Dec 13, 2006 12:28:09.175101000 Time delta from previous packet: 0.035617000 seconds Time since reference or first frame: 3.274859000 seconds Frame Number: 7 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.123 (165.227.249.123), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0094 (148) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb2a [correct] Good: True Bad : False Source: 165.227.249.123 (165.227.249.123) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x8564 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9B91592CC9B0A38B Responder cookie: 0x9140BB1E82AD7396 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x9CC25FBA Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 ab 06 ab 00 14 6c 8c 6d 16 08 00 45 00 ..).....l.m...E. 0010 00 78 00 94 40 00 40 11 fb 2a a5 e3 f9 7b a5 e3 .x..@.@..*...{.. 0020 f9 73 01 f4 01 f4 00 64 85 64 9b 91 59 2c c9 b0 .s.....d.d..Y,.. 0030 a3 8b 91 40 bb 1e 82 ad 73 96 08 10 05 01 9c c2 ...@....s....... 0040 5f ba 00 00 00 5c 15 f8 1e 8b dc eb c1 f8 6f 90 _....\........o. 0050 2f 81 36 1c 60 af 51 a0 4c fc f7 1f 24 21 6b 6b /.6.`.Q.L...$!kk 0060 0b 6b 2d 5a ee 86 9c 32 56 db ba e2 cc 14 9b a4 .k-Z...2V....... 0070 a5 30 f5 be 74 fd 0b 8e 34 bd 75 92 41 ad 59 b6 .0..t...4.u.A.Y. 0080 01 74 13 f6 a6 7e .t...~ Frame 8 (342 bytes on wire, 342 bytes captured) Arrival Time: Dec 13, 2006 12:28:11.431302000 Time delta from previous packet: 2.256201000 seconds Time since reference or first frame: 5.531060000 seconds Frame Number: 8 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Destination: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.123 (165.227.249.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x01a8 (424) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf946 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.123 (165.227.249.123) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x6570 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9B91592CC9B0A38B Responder cookie: 0x9140BB1E82AD7396 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x3650B8B5 Length: 300 Encrypted payload (272 bytes) 0000 00 14 6c 8c 6d 16 00 0c 29 ab 06 ab 08 00 45 00 ..l.m...).....E. 0010 01 48 01 a8 00 00 80 11 f9 46 a5 e3 f9 73 a5 e3 .H.......F...s.. 0020 f9 7b 01 f4 01 f4 01 34 65 70 9b 91 59 2c c9 b0 .{.....4ep..Y,.. 0030 a3 8b 91 40 bb 1e 82 ad 73 96 08 10 20 01 36 50 ...@....s... .6P 0040 b8 b5 00 00 01 2c 6a 6b 3c c3 01 bb 1d 31 47 b9 .....,jk<....1G. 0050 94 b1 8b bb 4f 2a ce 9d ed 2d 24 cf 86 b5 9c 0d ....O*...-$..... 0060 63 14 8f c4 5e 88 83 8e d6 7c 8d 6a c0 95 c4 79 c...^....|.j...y 0070 c2 5e 6e e0 c2 f9 81 90 20 e6 e3 d0 68 fa 6f f9 .^n..... ...h.o. 0080 17 c4 a7 4e 74 8c 64 1c 47 05 e2 b5 fd bb dc 71 ...Nt.d.G......q 0090 d4 76 29 0e c3 ed 21 b8 55 6f 2a 6f bf 88 27 63 .v)...!.Uo*o..'c 00a0 2a 92 ad c6 63 89 85 b4 11 c7 f5 85 34 46 2c e6 *...c.......4F,. 00b0 f9 99 b9 e2 67 b1 51 e9 b3 e1 19 97 76 d8 51 c9 ....g.Q.....v.Q. 00c0 eb 9c 94 95 f4 9e cf 45 98 d0 ff f0 26 af 19 9f .......E....&... 00d0 9b f6 07 5a aa 46 78 f8 be b8 9f 4d fb 24 84 5e ...Z.Fx....M.$.^ 00e0 d2 68 bd 1e 4b 77 dc 07 00 9c 54 94 63 35 97 41 .h..Kw....T.c5.A 00f0 94 44 fd c5 a7 f4 f1 23 8a 95 2d b4 87 99 09 3f .D.....#..-....? 0100 1d fc ca c3 38 1a a6 8d 7c 52 cc 36 87 a8 79 c0 ....8...|R.6..y. 0110 ad 40 e0 1f 65 67 85 9c 48 7c 2c 47 af ec 44 55 .@..eg..H|,G..DU 0120 7a 4c 27 be ee 09 d6 6e a7 86 4b 17 8a ea d8 bf zL'....n..K..... 0130 e2 48 42 7d d8 28 d6 4a 77 3f 31 0a 12 a8 8b dd .HB}.(.Jw?1..... 0140 69 94 6a 21 a5 79 df e0 6b a1 ff c6 72 92 37 83 i.j!.y..k...r.7. 0150 f8 ed 4b 32 3b 1a ..K2;. Frame 9 (342 bytes on wire, 342 bytes captured) Arrival Time: Dec 13, 2006 12:28:11.918017000 Time delta from previous packet: 0.486715000 seconds Time since reference or first frame: 6.017775000 seconds Frame Number: 9 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.123 (165.227.249.123), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0095 (149) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa59 [correct] Good: True Bad : False Source: 165.227.249.123 (165.227.249.123) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x0cdd [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9B91592CC9B0A38B Responder cookie: 0x9140BB1E82AD7396 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x3650B8B5 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 ab 06 ab 00 14 6c 8c 6d 16 08 00 45 00 ..).....l.m...E. 0010 01 48 00 95 40 00 40 11 fa 59 a5 e3 f9 7b a5 e3 .H..@.@..Y...{.. 0020 f9 73 01 f4 01 f4 01 34 0c dd 9b 91 59 2c c9 b0 .s.....4....Y,.. 0030 a3 8b 91 40 bb 1e 82 ad 73 96 08 10 20 01 36 50 ...@....s... .6P 0040 b8 b5 00 00 01 2c c3 fb fa 8b 56 cc d2 0d bf 45 .....,....V....E 0050 ed fc 37 a0 7a 42 49 f4 1d 06 2b 94 a1 00 63 53 ..7.zBI...+...cS 0060 0e 65 57 b9 e5 15 a0 dd 4d d2 3a ae d3 95 a7 eb .eW.....M.:..... 0070 78 29 22 bf 81 88 9f 71 1c 1f 09 0a 5c bb 68 24 x)"....q....\.h$ 0080 b8 1b d8 ac 3a c0 e9 32 43 9a 43 5a 7a 59 00 67 ....:..2C.CZzY.g 0090 76 16 57 db 75 82 93 92 0a 44 5b 03 1a 06 b7 19 v.W.u....D[..... 00a0 8c dc 1b f8 a6 ba 7e 27 4c d9 f8 34 50 9b f8 0d ......~'L..4P... 00b0 a4 fb fe d8 3c 39 03 59 63 32 61 d7 48 19 e8 a1 ....<9.Yc2a.H... 00c0 78 9e 15 a0 85 c1 55 52 03 d6 0e 0e 7b fe 0a 73 x.....UR....{..s 00d0 b8 ce 1f 42 60 20 a1 9f 01 bd 01 cb a7 c2 e2 f3 ...B` .......... 00e0 2d d4 59 1a 8c d9 44 97 72 06 72 eb fd 47 47 df -.Y...D.r.r..GG. 00f0 bb 16 68 eb aa db 7e 33 9d ac 81 04 20 cf 7a 5c ..h...~3.... .z\ 0100 c9 88 99 ac 40 77 5f ec 04 19 d4 59 bf 1c 26 e2 ....@w_....Y..&. 0110 b7 0f 81 00 a1 12 ce ff 36 68 c3 d3 b3 83 d9 41 ........6h.....A 0120 8f 1c 15 e4 8a d1 90 e1 ff c2 e1 f7 52 c8 ca d3 ............R... 0130 c8 0b 3b 9c 6c 02 86 78 16 f7 0b 40 27 68 51 d9 ..;.l..x...@'hQ. 0140 98 7c cd 90 b1 24 40 50 ce 70 c1 db ae 82 10 ae .|...$@P.p...... 0150 74 e8 e7 c6 4b a5 t...K. Frame 10 (102 bytes on wire, 102 bytes captured) Arrival Time: Dec 13, 2006 12:28:11.918019000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 6.017777000 seconds Frame Number: 10 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Destination: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.123 (165.227.249.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x01aa (426) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa34 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.123 (165.227.249.123) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xd855 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9B91592CC9B0A38B Responder cookie: 0x9140BB1E82AD7396 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x3650B8B5 Length: 60 Encrypted payload (32 bytes) 0000 00 14 6c 8c 6d 16 00 0c 29 ab 06 ab 08 00 45 00 ..l.m...).....E. 0010 00 58 01 aa 00 00 80 11 fa 34 a5 e3 f9 73 a5 e3 .X.......4...s.. 0020 f9 7b 01 f4 01 f4 00 44 d8 55 9b 91 59 2c c9 b0 .{.....D.U..Y,.. 0030 a3 8b 91 40 bb 1e 82 ad 73 96 08 10 20 01 36 50 ...@....s... .6P 0040 b8 b5 00 00 00 3c 31 c7 ce e9 3f 1d e7 ef d5 24 .....<1...?....$ 0050 17 33 43 57 81 70 69 d4 fe df 0d 2a 53 48 88 56 .3CW.pi....*SH.V 0060 9c af a1 30 c0 45 ...0.E Frame 11 (134 bytes on wire, 134 bytes captured) Arrival Time: Dec 13, 2006 12:28:15.680844000 Time delta from previous packet: 3.762825000 seconds Time since reference or first frame: 9.780602000 seconds Frame Number: 11 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Destination: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.123 (165.227.249.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb9c [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.123 (165.227.249.123) Encapsulating Security Payload SPI: 0x076fc3c2 Sequence: 1 Data (92 bytes) 0000 00 14 6c 8c 6d 16 00 0c 29 ab 06 ab 08 00 45 00 ..l.m...).....E. 0010 00 78 00 01 00 00 80 32 fb 9c a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 7b 07 6f c3 c2 00 00 00 01 13 6c 28 e9 bf 41 .{.o.......l(..A 0030 de a8 95 d1 97 19 be 45 53 ff 3f 00 b4 02 cf f8 .......ES.?..... 0040 2f 68 47 30 71 c2 8c d5 bd b4 1a 61 97 5d f5 3b /hG0q......a.].; 0050 55 77 7e 30 28 8f 90 f7 ec 44 a5 37 84 c6 84 95 Uw~0(....D.7.... 0060 68 f6 46 58 6a b8 3d 95 b2 3d 82 a2 28 a3 d7 d1 h.FXj.=..=..(... 0070 a3 8b e4 fa 6e 21 67 33 9b 32 74 5c 6e 45 3b 58 ....n!g3.2t\nE;X 0080 81 d0 24 ef b1 d5 ..$... Frame 12 (134 bytes on wire, 134 bytes captured) Arrival Time: Dec 13, 2006 12:28:15.682826000 Time delta from previous packet: 0.001982000 seconds Time since reference or first frame: 9.782584000 seconds Frame Number: 12 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.123 (165.227.249.123), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0xf6c8 (63176) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x44d5 [correct] Good: True Bad : False Source: 165.227.249.123 (165.227.249.123) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x356243b5 Sequence: 1 Data (92 bytes) 0000 00 0c 29 ab 06 ab 00 14 6c 8c 6d 16 08 00 45 00 ..).....l.m...E. 0010 00 78 f6 c8 00 00 40 32 44 d5 a5 e3 f9 7b a5 e3 .x....@2D....{.. 0020 f9 73 35 62 43 b5 00 00 00 01 dd f1 e9 77 f6 25 .s5bC........w.% 0030 e9 5b 17 d5 8f 7e 7e bc 6d 7d fd f4 10 2f 12 01 .[...~~.m}.../.. 0040 6a bf 5c 49 1c 49 f4 14 e7 f0 ec 1e 88 11 ef f5 j.\I.I.......... 0050 60 f0 bb be 3d 51 e6 25 e1 8f 35 18 0f d8 5c f6 `...=Q.%..5...\. 0060 f2 7a 26 0c 61 03 4a 1e 66 54 d2 6d 03 e6 d4 7f .z&.a.J.fT.m.... 0070 64 f2 9e 3a 46 4c 18 e5 54 a9 62 ca c8 2c dc ed d..:FL..T.b..,.. 0080 3f d3 3a 1c c1 8e ?.:... Frame 13 (134 bytes on wire, 134 bytes captured) Arrival Time: Dec 13, 2006 12:28:16.692138000 Time delta from previous packet: 1.009312000 seconds Time since reference or first frame: 10.791896000 seconds Frame Number: 13 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Destination: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.123 (165.227.249.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb9b [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.123 (165.227.249.123) Encapsulating Security Payload SPI: 0x076fc3c2 Sequence: 2 Data (92 bytes) 0000 00 14 6c 8c 6d 16 00 0c 29 ab 06 ab 08 00 45 00 ..l.m...).....E. 0010 00 78 00 02 00 00 80 32 fb 9b a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 7b 07 6f c3 c2 00 00 00 02 82 a2 28 a3 d7 d1 .{.o........(... 0030 a3 8b e4 fa 6e 21 67 33 9b 32 8b 3c 39 3b 7a c2 ....n!g3.2.<9;z. 0040 0a 42 82 7e 5b 33 dd eb 15 45 85 15 61 06 af 4c .B.~[3...E..a..L 0050 7e 31 d3 b0 92 66 b2 26 ab ec 79 43 18 aa 45 75 ~1...f.&..yC..Eu 0060 37 79 ba 3e 5d 01 73 eb cb 11 7a 87 11 5d 39 b8 7y.>].s...z..]9. 0070 45 f3 57 b8 c9 ab af d7 ab 5c ee fb 96 f5 9b 56 E.W......\.....V 0080 0d cd aa 13 ef 0f ...... Frame 14 (134 bytes on wire, 134 bytes captured) Arrival Time: Dec 13, 2006 12:28:16.698665000 Time delta from previous packet: 0.006527000 seconds Time since reference or first frame: 10.798423000 seconds Frame Number: 14 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:6c:8c:6d:16 (00:14:6c:8c:6d:16) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.123 (165.227.249.123), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0xf5ed (62957) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x45b0 [correct] Good: True Bad : False Source: 165.227.249.123 (165.227.249.123) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x356243b5 Sequence: 2 Data (92 bytes) 0000 00 0c 29 ab 06 ab 00 14 6c 8c 6d 16 08 00 45 00 ..).....l.m...E. 0010 00 78 f5 ed 00 00 40 32 45 b0 a5 e3 f9 7b a5 e3 .x....@2E....{.. 0020 f9 73 35 62 43 b5 00 00 00 02 dd f1 e9 77 f6 25 .s5bC........w.% 0030 e9 5b 17 d5 8f 7e 7e bc 6d 7d 46 fb 41 e3 8d 50 .[...~~.m}F.A..P 0040 d5 c6 9f f4 14 2c a6 4d 20 73 3e fd 64 cb 1c 61 .....,.M s>.d..a 0050 29 ff 72 7c 64 78 9a 6e a0 af 87 04 ec 4c e4 5f ).r|dx.n.....L._ 0060 1b 29 fa 33 0c c2 1e df 02 8e ba 2a 90 f0 6d 30 .).3.......*..m0 0070 9d 83 f8 35 05 8b 91 29 4b e8 db 06 84 3b fa 00 ...5...)K....;.. 0080 52 fc d8 02 59 55 R...YU