Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Oct 27, 2009 10:15:24.753830000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x01c3 (451) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9da [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x7eb1 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 00 98 01 c3 00 00 80 11 f9 da a5 e3 f9 73 a5 e3 .............s.. 0020 f9 7c 01 f4 01 f4 00 84 7e b1 97 1e 0e 9d d0 fc .|......~....... 0030 17 1f 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (166 bytes on wire, 166 bytes captured) Arrival Time: Oct 27, 2009 10:15:24.753840000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 0.000010000 seconds] Frame Number: 2 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x01c3 (451) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9da [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x7eb1 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 00 98 01 c3 00 00 80 11 f9 da a5 e3 f9 73 a5 e3 .............s.. 0020 f9 7c 01 f4 01 f4 00 84 7e b1 97 1e 0e 9d d0 fc .|......~....... 0030 17 1f 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 3 (246 bytes on wire, 246 bytes captured) Arrival Time: Oct 27, 2009 10:15:24.755243000 [Time delta from previous captured frame: 0.001403000 seconds] [Time delta from previous displayed frame: 0.001403000 seconds] [Time since reference or first frame: 0.001413000 seconds] Frame Number: 3 Frame Length: 246 bytes Capture Length: 246 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 232 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb4d [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 212 Checksum: 0xc5af [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 204 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 6d a9 a5 00 0c 29 48 f8 2f 08 00 45 00 ..)m....)H./..E. 0010 00 e8 00 00 40 00 40 11 fb 4d a5 e3 f9 7c a5 e3 ....@.@..M...|.. 0020 f9 73 01 f4 01 f4 00 d4 c5 af 97 1e 0e 9d d0 fc .s.............. 0030 17 1f f3 70 c3 5d 27 29 37 a1 01 10 02 00 00 00 ...p.]')7....... 0040 00 00 00 00 00 cc 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 0090 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00a0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 00b0 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 00c0 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 00d0 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 00e0 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 00f0 96 fc 77 57 01 00 ..wW.. Frame 4 (246 bytes on wire, 246 bytes captured) Arrival Time: Oct 27, 2009 10:15:24.755256000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 0.001426000 seconds] Frame Number: 4 Frame Length: 246 bytes Capture Length: 246 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 232 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb4d [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 212 Checksum: 0xc5af [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 204 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 6d a9 a5 00 0c 29 48 f8 2f 08 00 45 00 ..)m....)H./..E. 0010 00 e8 00 00 40 00 40 11 fb 4d a5 e3 f9 7c a5 e3 ....@.@..M...|.. 0020 f9 73 01 f4 01 f4 00 d4 c5 af 97 1e 0e 9d d0 fc .s.............. 0030 17 1f f3 70 c3 5d 27 29 37 a1 01 10 02 00 00 00 ...p.]')7....... 0040 00 00 00 00 00 cc 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 0090 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00a0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 00b0 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 00c0 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 00d0 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 00e0 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 00f0 96 fc 77 57 01 00 ..wW.. Frame 5 (246 bytes on wire, 246 bytes captured) Arrival Time: Oct 27, 2009 10:15:25.257550000 [Time delta from previous captured frame: 0.502294000 seconds] [Time delta from previous displayed frame: 0.502294000 seconds] [Time since reference or first frame: 0.503720000 seconds] Frame Number: 5 Frame Length: 246 bytes Capture Length: 246 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 232 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb4d [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 212 Checksum: 0xc5af [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 204 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 6d a9 a5 00 0c 29 48 f8 2f 08 00 45 00 ..)m....)H./..E. 0010 00 e8 00 00 40 00 40 11 fb 4d a5 e3 f9 7c a5 e3 ....@.@..M...|.. 0020 f9 73 01 f4 01 f4 00 d4 c5 af 97 1e 0e 9d d0 fc .s.............. 0030 17 1f f3 70 c3 5d 27 29 37 a1 01 10 02 00 00 00 ...p.]')7....... 0040 00 00 00 00 00 cc 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 0090 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00a0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 00b0 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 00c0 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 00d0 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 00e0 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 00f0 96 fc 77 57 01 00 ..wW.. Frame 6 (246 bytes on wire, 246 bytes captured) Arrival Time: Oct 27, 2009 10:15:25.257565000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 0.503735000 seconds] Frame Number: 6 Frame Length: 246 bytes Capture Length: 246 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 232 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb4d [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 212 Checksum: 0xc5af [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 204 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 6d a9 a5 00 0c 29 48 f8 2f 08 00 45 00 ..)m....)H./..E. 0010 00 e8 00 00 40 00 40 11 fb 4d a5 e3 f9 7c a5 e3 ....@.@..M...|.. 0020 f9 73 01 f4 01 f4 00 d4 c5 af 97 1e 0e 9d d0 fc .s.............. 0030 17 1f f3 70 c3 5d 27 29 37 a1 01 10 02 00 00 00 ...p.]')7....... 0040 00 00 00 00 00 cc 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 0090 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00a0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 00b0 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 00c0 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 00d0 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 00e0 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 00f0 96 fc 77 57 01 00 ..wW.. Frame 7 (246 bytes on wire, 246 bytes captured) Arrival Time: Oct 27, 2009 10:15:26.257724000 [Time delta from previous captured frame: 1.000159000 seconds] [Time delta from previous displayed frame: 1.000159000 seconds] [Time since reference or first frame: 1.503894000 seconds] Frame Number: 7 Frame Length: 246 bytes Capture Length: 246 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 232 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb4d [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 212 Checksum: 0xc5af [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 204 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 6d a9 a5 00 0c 29 48 f8 2f 08 00 45 00 ..)m....)H./..E. 0010 00 e8 00 00 40 00 40 11 fb 4d a5 e3 f9 7c a5 e3 ....@.@..M...|.. 0020 f9 73 01 f4 01 f4 00 d4 c5 af 97 1e 0e 9d d0 fc .s.............. 0030 17 1f f3 70 c3 5d 27 29 37 a1 01 10 02 00 00 00 ...p.]')7....... 0040 00 00 00 00 00 cc 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 0090 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00a0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 00b0 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 00c0 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 00d0 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 00e0 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 00f0 96 fc 77 57 01 00 ..wW.. Frame 8 (246 bytes on wire, 246 bytes captured) Arrival Time: Oct 27, 2009 10:15:26.257737000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 1.503907000 seconds] Frame Number: 8 Frame Length: 246 bytes Capture Length: 246 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 232 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb4d [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 212 Checksum: 0xc5af [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 204 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 6d a9 a5 00 0c 29 48 f8 2f 08 00 45 00 ..)m....)H./..E. 0010 00 e8 00 00 40 00 40 11 fb 4d a5 e3 f9 7c a5 e3 ....@.@..M...|.. 0020 f9 73 01 f4 01 f4 00 d4 c5 af 97 1e 0e 9d d0 fc .s.............. 0030 17 1f f3 70 c3 5d 27 29 37 a1 01 10 02 00 00 00 ...p.]')7....... 0040 00 00 00 00 00 cc 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 0090 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00a0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 00b0 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 00c0 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 00d0 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 00e0 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 00f0 96 fc 77 57 01 00 ..wW.. Frame 9 (346 bytes on wire, 346 bytes captured) Arrival Time: Oct 27, 2009 10:15:26.729512000 [Time delta from previous captured frame: 0.471775000 seconds] [Time delta from previous displayed frame: 0.471775000 seconds] [Time since reference or first frame: 1.975682000 seconds] Frame Number: 9 Frame Length: 346 bytes Capture Length: 346 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x01c7 (455) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf922 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xa1dc [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: F3C444F46E7290F38877522A0B469774DF9D0C58 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: Vendor ID (13) Payload length: 24 Hash of address and port: B5CDFA3FCAFCE8B7BF1FEBAAFB17A12513D760ED Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 01 4c 01 c7 00 00 80 11 f9 22 a5 e3 f9 73 a5 e3 .L......."...s.. 0020 f9 7c 01 f4 01 f4 01 38 a1 dc 97 1e 0e 9d d0 fc .|.....8........ 0030 17 1f f3 70 c3 5d 27 29 37 a1 04 10 02 00 00 00 ...p.]')7....... 0040 00 00 00 00 01 30 0a 00 00 84 ca 3b 29 c3 20 d3 .....0.....;). . 0050 3b b4 3e 31 b5 a8 6c c6 44 30 b7 7e 7d 86 2d d5 ;.>1..l.D0.~}.-. 0060 83 e2 73 91 64 e7 87 2a 41 aa c6 d0 36 b9 a1 6e ..s.d..*A...6..n 0070 fb 00 a2 88 eb 18 8d e5 7b 75 7e bd d2 0b 64 48 ........{u~...dH 0080 35 a6 7a 1f 96 58 c6 bd af 92 ae a0 73 c7 2e d2 5.z..X......s... 0090 58 8d 1d de 39 b8 f8 39 dc b1 40 0e 50 91 42 84 X...9..9..@.P.B. 00a0 1d e1 0c c3 6f 0a f1 20 c3 c2 d1 aa ea 2d 9c a4 ....o.. .....-.. 00b0 f4 fc 15 15 ed ba fd 60 62 bc fa 02 38 18 c1 57 .......`b...8..W 00c0 bb 50 0d f5 4b 82 98 75 0e 19 82 00 00 18 85 98 .P..K..u........ 00d0 81 a2 ba 55 91 5d 7e 7c 5d 4f 9e 1d 14 16 13 f6 ...U.]~|]O...... 00e0 4f 24 82 00 00 18 f3 c4 44 f4 6e 72 90 f3 88 77 O$......D.nr...w 00f0 52 2a 0b 46 97 74 df 9d 0c 58 0d 00 00 18 b5 cd R*.F.t...X...... 0100 fa 3f ca fc e8 b7 bf 1f eb aa fb 17 a1 25 13 d7 .?...........%.. 0110 60 ed 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 `....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 10 (346 bytes on wire, 346 bytes captured) Arrival Time: Oct 27, 2009 10:15:26.729526000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 1.975696000 seconds] Frame Number: 10 Frame Length: 346 bytes Capture Length: 346 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x01c7 (455) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf922 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xa1dc [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: F3C444F46E7290F38877522A0B469774DF9D0C58 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: Vendor ID (13) Payload length: 24 Hash of address and port: B5CDFA3FCAFCE8B7BF1FEBAAFB17A12513D760ED Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 01 4c 01 c7 00 00 80 11 f9 22 a5 e3 f9 73 a5 e3 .L......."...s.. 0020 f9 7c 01 f4 01 f4 01 38 a1 dc 97 1e 0e 9d d0 fc .|.....8........ 0030 17 1f f3 70 c3 5d 27 29 37 a1 04 10 02 00 00 00 ...p.]')7....... 0040 00 00 00 00 01 30 0a 00 00 84 ca 3b 29 c3 20 d3 .....0.....;). . 0050 3b b4 3e 31 b5 a8 6c c6 44 30 b7 7e 7d 86 2d d5 ;.>1..l.D0.~}.-. 0060 83 e2 73 91 64 e7 87 2a 41 aa c6 d0 36 b9 a1 6e ..s.d..*A...6..n 0070 fb 00 a2 88 eb 18 8d e5 7b 75 7e bd d2 0b 64 48 ........{u~...dH 0080 35 a6 7a 1f 96 58 c6 bd af 92 ae a0 73 c7 2e d2 5.z..X......s... 0090 58 8d 1d de 39 b8 f8 39 dc b1 40 0e 50 91 42 84 X...9..9..@.P.B. 00a0 1d e1 0c c3 6f 0a f1 20 c3 c2 d1 aa ea 2d 9c a4 ....o.. .....-.. 00b0 f4 fc 15 15 ed ba fd 60 62 bc fa 02 38 18 c1 57 .......`b...8..W 00c0 bb 50 0d f5 4b 82 98 75 0e 19 82 00 00 18 85 98 .P..K..u........ 00d0 81 a2 ba 55 91 5d 7e 7c 5d 4f 9e 1d 14 16 13 f6 ...U.]~|]O...... 00e0 4f 24 82 00 00 18 f3 c4 44 f4 6e 72 90 f3 88 77 O$......D.nr...w 00f0 52 2a 0b 46 97 74 df 9d 0c 58 0d 00 00 18 b5 cd R*.F.t...X...... 0100 fa 3f ca fc e8 b7 bf 1f eb aa fb 17 a1 25 13 d7 .?...........%.. 0110 60 ed 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 `....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 11 (346 bytes on wire, 346 bytes captured) Arrival Time: Oct 27, 2009 10:15:26.729851000 [Time delta from previous captured frame: 0.000325000 seconds] [Time delta from previous displayed frame: 0.000325000 seconds] [Time since reference or first frame: 1.976021000 seconds] Frame Number: 11 Frame Length: 346 bytes Capture Length: 346 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x01c9 (457) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf920 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xa1dc [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: F3C444F46E7290F38877522A0B469774DF9D0C58 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: Vendor ID (13) Payload length: 24 Hash of address and port: B5CDFA3FCAFCE8B7BF1FEBAAFB17A12513D760ED Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 01 4c 01 c9 00 00 80 11 f9 20 a5 e3 f9 73 a5 e3 .L....... ...s.. 0020 f9 7c 01 f4 01 f4 01 38 a1 dc 97 1e 0e 9d d0 fc .|.....8........ 0030 17 1f f3 70 c3 5d 27 29 37 a1 04 10 02 00 00 00 ...p.]')7....... 0040 00 00 00 00 01 30 0a 00 00 84 ca 3b 29 c3 20 d3 .....0.....;). . 0050 3b b4 3e 31 b5 a8 6c c6 44 30 b7 7e 7d 86 2d d5 ;.>1..l.D0.~}.-. 0060 83 e2 73 91 64 e7 87 2a 41 aa c6 d0 36 b9 a1 6e ..s.d..*A...6..n 0070 fb 00 a2 88 eb 18 8d e5 7b 75 7e bd d2 0b 64 48 ........{u~...dH 0080 35 a6 7a 1f 96 58 c6 bd af 92 ae a0 73 c7 2e d2 5.z..X......s... 0090 58 8d 1d de 39 b8 f8 39 dc b1 40 0e 50 91 42 84 X...9..9..@.P.B. 00a0 1d e1 0c c3 6f 0a f1 20 c3 c2 d1 aa ea 2d 9c a4 ....o.. .....-.. 00b0 f4 fc 15 15 ed ba fd 60 62 bc fa 02 38 18 c1 57 .......`b...8..W 00c0 bb 50 0d f5 4b 82 98 75 0e 19 82 00 00 18 85 98 .P..K..u........ 00d0 81 a2 ba 55 91 5d 7e 7c 5d 4f 9e 1d 14 16 13 f6 ...U.]~|]O...... 00e0 4f 24 82 00 00 18 f3 c4 44 f4 6e 72 90 f3 88 77 O$......D.nr...w 00f0 52 2a 0b 46 97 74 df 9d 0c 58 0d 00 00 18 b5 cd R*.F.t...X...... 0100 fa 3f ca fc e8 b7 bf 1f eb aa fb 17 a1 25 13 d7 .?...........%.. 0110 60 ed 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 `....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 12 (346 bytes on wire, 346 bytes captured) Arrival Time: Oct 27, 2009 10:15:26.729862000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 1.976032000 seconds] Frame Number: 12 Frame Length: 346 bytes Capture Length: 346 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x01c9 (457) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf920 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xa1dc [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: F3C444F46E7290F38877522A0B469774DF9D0C58 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: Vendor ID (13) Payload length: 24 Hash of address and port: B5CDFA3FCAFCE8B7BF1FEBAAFB17A12513D760ED Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 01 4c 01 c9 00 00 80 11 f9 20 a5 e3 f9 73 a5 e3 .L....... ...s.. 0020 f9 7c 01 f4 01 f4 01 38 a1 dc 97 1e 0e 9d d0 fc .|.....8........ 0030 17 1f f3 70 c3 5d 27 29 37 a1 04 10 02 00 00 00 ...p.]')7....... 0040 00 00 00 00 01 30 0a 00 00 84 ca 3b 29 c3 20 d3 .....0.....;). . 0050 3b b4 3e 31 b5 a8 6c c6 44 30 b7 7e 7d 86 2d d5 ;.>1..l.D0.~}.-. 0060 83 e2 73 91 64 e7 87 2a 41 aa c6 d0 36 b9 a1 6e ..s.d..*A...6..n 0070 fb 00 a2 88 eb 18 8d e5 7b 75 7e bd d2 0b 64 48 ........{u~...dH 0080 35 a6 7a 1f 96 58 c6 bd af 92 ae a0 73 c7 2e d2 5.z..X......s... 0090 58 8d 1d de 39 b8 f8 39 dc b1 40 0e 50 91 42 84 X...9..9..@.P.B. 00a0 1d e1 0c c3 6f 0a f1 20 c3 c2 d1 aa ea 2d 9c a4 ....o.. .....-.. 00b0 f4 fc 15 15 ed ba fd 60 62 bc fa 02 38 18 c1 57 .......`b...8..W 00c0 bb 50 0d f5 4b 82 98 75 0e 19 82 00 00 18 85 98 .P..K..u........ 00d0 81 a2 ba 55 91 5d 7e 7c 5d 4f 9e 1d 14 16 13 f6 ...U.]~|]O...... 00e0 4f 24 82 00 00 18 f3 c4 44 f4 6e 72 90 f3 88 77 O$......D.nr...w 00f0 52 2a 0b 46 97 74 df 9d 0c 58 0d 00 00 18 b5 cd R*.F.t...X...... 0100 fa 3f ca fc e8 b7 bf 1f eb aa fb 17 a1 25 13 d7 .?...........%.. 0110 60 ed 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 `....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 13 (346 bytes on wire, 346 bytes captured) Arrival Time: Oct 27, 2009 10:15:26.730644000 [Time delta from previous captured frame: 0.000782000 seconds] [Time delta from previous displayed frame: 0.000782000 seconds] [Time since reference or first frame: 1.976814000 seconds] Frame Number: 13 Frame Length: 346 bytes Capture Length: 346 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x01cc (460) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf91d [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xa1dc [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: F3C444F46E7290F38877522A0B469774DF9D0C58 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: Vendor ID (13) Payload length: 24 Hash of address and port: B5CDFA3FCAFCE8B7BF1FEBAAFB17A12513D760ED Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 01 4c 01 cc 00 00 80 11 f9 1d a5 e3 f9 73 a5 e3 .L...........s.. 0020 f9 7c 01 f4 01 f4 01 38 a1 dc 97 1e 0e 9d d0 fc .|.....8........ 0030 17 1f f3 70 c3 5d 27 29 37 a1 04 10 02 00 00 00 ...p.]')7....... 0040 00 00 00 00 01 30 0a 00 00 84 ca 3b 29 c3 20 d3 .....0.....;). . 0050 3b b4 3e 31 b5 a8 6c c6 44 30 b7 7e 7d 86 2d d5 ;.>1..l.D0.~}.-. 0060 83 e2 73 91 64 e7 87 2a 41 aa c6 d0 36 b9 a1 6e ..s.d..*A...6..n 0070 fb 00 a2 88 eb 18 8d e5 7b 75 7e bd d2 0b 64 48 ........{u~...dH 0080 35 a6 7a 1f 96 58 c6 bd af 92 ae a0 73 c7 2e d2 5.z..X......s... 0090 58 8d 1d de 39 b8 f8 39 dc b1 40 0e 50 91 42 84 X...9..9..@.P.B. 00a0 1d e1 0c c3 6f 0a f1 20 c3 c2 d1 aa ea 2d 9c a4 ....o.. .....-.. 00b0 f4 fc 15 15 ed ba fd 60 62 bc fa 02 38 18 c1 57 .......`b...8..W 00c0 bb 50 0d f5 4b 82 98 75 0e 19 82 00 00 18 85 98 .P..K..u........ 00d0 81 a2 ba 55 91 5d 7e 7c 5d 4f 9e 1d 14 16 13 f6 ...U.]~|]O...... 00e0 4f 24 82 00 00 18 f3 c4 44 f4 6e 72 90 f3 88 77 O$......D.nr...w 00f0 52 2a 0b 46 97 74 df 9d 0c 58 0d 00 00 18 b5 cd R*.F.t...X...... 0100 fa 3f ca fc e8 b7 bf 1f eb aa fb 17 a1 25 13 d7 .?...........%.. 0110 60 ed 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 `....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 14 (346 bytes on wire, 346 bytes captured) Arrival Time: Oct 27, 2009 10:15:26.730653000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 1.976823000 seconds] Frame Number: 14 Frame Length: 346 bytes Capture Length: 346 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x01cc (460) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf91d [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xa1dc [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: F3C444F46E7290F38877522A0B469774DF9D0C58 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: Vendor ID (13) Payload length: 24 Hash of address and port: B5CDFA3FCAFCE8B7BF1FEBAAFB17A12513D760ED Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 01 4c 01 cc 00 00 80 11 f9 1d a5 e3 f9 73 a5 e3 .L...........s.. 0020 f9 7c 01 f4 01 f4 01 38 a1 dc 97 1e 0e 9d d0 fc .|.....8........ 0030 17 1f f3 70 c3 5d 27 29 37 a1 04 10 02 00 00 00 ...p.]')7....... 0040 00 00 00 00 01 30 0a 00 00 84 ca 3b 29 c3 20 d3 .....0.....;). . 0050 3b b4 3e 31 b5 a8 6c c6 44 30 b7 7e 7d 86 2d d5 ;.>1..l.D0.~}.-. 0060 83 e2 73 91 64 e7 87 2a 41 aa c6 d0 36 b9 a1 6e ..s.d..*A...6..n 0070 fb 00 a2 88 eb 18 8d e5 7b 75 7e bd d2 0b 64 48 ........{u~...dH 0080 35 a6 7a 1f 96 58 c6 bd af 92 ae a0 73 c7 2e d2 5.z..X......s... 0090 58 8d 1d de 39 b8 f8 39 dc b1 40 0e 50 91 42 84 X...9..9..@.P.B. 00a0 1d e1 0c c3 6f 0a f1 20 c3 c2 d1 aa ea 2d 9c a4 ....o.. .....-.. 00b0 f4 fc 15 15 ed ba fd 60 62 bc fa 02 38 18 c1 57 .......`b...8..W 00c0 bb 50 0d f5 4b 82 98 75 0e 19 82 00 00 18 85 98 .P..K..u........ 00d0 81 a2 ba 55 91 5d 7e 7c 5d 4f 9e 1d 14 16 13 f6 ...U.]~|]O...... 00e0 4f 24 82 00 00 18 f3 c4 44 f4 6e 72 90 f3 88 77 O$......D.nr...w 00f0 52 2a 0b 46 97 74 df 9d 0c 58 0d 00 00 18 b5 cd R*.F.t...X...... 0100 fa 3f ca fc e8 b7 bf 1f eb aa fb 17 a1 25 13 d7 .?...........%.. 0110 60 ed 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 `....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 15 (270 bytes on wire, 270 bytes captured) Arrival Time: Oct 27, 2009 10:15:26.737630000 [Time delta from previous captured frame: 0.006977000 seconds] [Time delta from previous displayed frame: 0.006977000 seconds] [Time since reference or first frame: 1.983800000 seconds] Frame Number: 15 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb35 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x54f0 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: B5CDFA3FCAFCE8B7BF1FEBAAFB17A12513D760ED NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: F3C444F46E7290F38877522A0B469774DF9D0C58 0000 00 0c 29 6d a9 a5 00 0c 29 48 f8 2f 08 00 45 00 ..)m....)H./..E. 0010 01 00 00 00 40 00 40 11 fb 35 a5 e3 f9 7c a5 e3 ....@.@..5...|.. 0020 f9 73 01 f4 01 f4 00 ec 54 f0 97 1e 0e 9d d0 fc .s......T....... 0030 17 1f f3 70 c3 5d 27 29 37 a1 04 10 02 00 00 00 ...p.]')7....... 0040 00 00 00 00 00 e4 0a 00 00 84 25 7a 27 be f8 de ..........%z'... 0050 fa 16 b6 b1 db 52 b2 09 19 6d 6c 80 1a 30 10 10 .....R...ml..0.. 0060 d3 86 63 0d b0 f8 76 95 66 da 28 39 f6 30 9c 79 ..c...v.f.(9.0.y 0070 fb f1 27 9b b4 f0 44 54 97 ca 24 4c c1 11 8f db ..'...DT..$L.... 0080 b2 95 33 87 6d ac 52 5d 2b 86 50 88 32 ed 34 98 ..3.m.R]+.P.2.4. 0090 5f d0 c7 f4 47 5d 75 a5 f2 09 0f 8d 7f e0 b5 ce _...G]u......... 00a0 27 cc e0 ab 03 98 b8 87 5a 1f a2 db e0 e0 1b ba '.......Z....... 00b0 98 da e2 c4 67 1c a3 fc b6 df 8e 4f c5 75 4f 6d ....g......O.uOm 00c0 4f 50 4b dd 15 d3 4b e3 0e 50 82 00 00 14 10 3e OPK...K..P.....> 00d0 44 8b c6 12 85 40 46 bc 6c 39 83 3f e7 ef 82 00 D....@F.l9.?.... 00e0 00 18 b5 cd fa 3f ca fc e8 b7 bf 1f eb aa fb 17 .....?.......... 00f0 a1 25 13 d7 60 ed 00 00 00 18 f3 c4 44 f4 6e 72 .%..`.......D.nr 0100 90 f3 88 77 52 2a 0b 46 97 74 df 9d 0c 58 ...wR*.F.t...X Frame 16 (270 bytes on wire, 270 bytes captured) Arrival Time: Oct 27, 2009 10:15:26.737645000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 1.983815000 seconds] Frame Number: 16 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb35 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x54f0 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: B5CDFA3FCAFCE8B7BF1FEBAAFB17A12513D760ED NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: F3C444F46E7290F38877522A0B469774DF9D0C58 0000 00 0c 29 6d a9 a5 00 0c 29 48 f8 2f 08 00 45 00 ..)m....)H./..E. 0010 01 00 00 00 40 00 40 11 fb 35 a5 e3 f9 7c a5 e3 ....@.@..5...|.. 0020 f9 73 01 f4 01 f4 00 ec 54 f0 97 1e 0e 9d d0 fc .s......T....... 0030 17 1f f3 70 c3 5d 27 29 37 a1 04 10 02 00 00 00 ...p.]')7....... 0040 00 00 00 00 00 e4 0a 00 00 84 25 7a 27 be f8 de ..........%z'... 0050 fa 16 b6 b1 db 52 b2 09 19 6d 6c 80 1a 30 10 10 .....R...ml..0.. 0060 d3 86 63 0d b0 f8 76 95 66 da 28 39 f6 30 9c 79 ..c...v.f.(9.0.y 0070 fb f1 27 9b b4 f0 44 54 97 ca 24 4c c1 11 8f db ..'...DT..$L.... 0080 b2 95 33 87 6d ac 52 5d 2b 86 50 88 32 ed 34 98 ..3.m.R]+.P.2.4. 0090 5f d0 c7 f4 47 5d 75 a5 f2 09 0f 8d 7f e0 b5 ce _...G]u......... 00a0 27 cc e0 ab 03 98 b8 87 5a 1f a2 db e0 e0 1b ba '.......Z....... 00b0 98 da e2 c4 67 1c a3 fc b6 df 8e 4f c5 75 4f 6d ....g......O.uOm 00c0 4f 50 4b dd 15 d3 4b e3 0e 50 82 00 00 14 10 3e OPK...K..P.....> 00d0 44 8b c6 12 85 40 46 bc 6c 39 83 3f e7 ef 82 00 D....@F.l9.?.... 00e0 00 18 b5 cd fa 3f ca fc e8 b7 bf 1f eb aa fb 17 .....?.......... 00f0 a1 25 13 d7 60 ed 00 00 00 18 f3 c4 44 f4 6e 72 .%..`.......D.nr 0100 90 f3 88 77 52 2a 0b 46 97 74 df 9d 0c 58 ...wR*.F.t...X Frame 17 (270 bytes on wire, 270 bytes captured) Arrival Time: Oct 27, 2009 10:15:27.248636000 [Time delta from previous captured frame: 0.510991000 seconds] [Time delta from previous displayed frame: 0.510991000 seconds] [Time since reference or first frame: 2.494806000 seconds] Frame Number: 17 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb35 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x54f0 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: B5CDFA3FCAFCE8B7BF1FEBAAFB17A12513D760ED NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: F3C444F46E7290F38877522A0B469774DF9D0C58 0000 00 0c 29 6d a9 a5 00 0c 29 48 f8 2f 08 00 45 00 ..)m....)H./..E. 0010 01 00 00 00 40 00 40 11 fb 35 a5 e3 f9 7c a5 e3 ....@.@..5...|.. 0020 f9 73 01 f4 01 f4 00 ec 54 f0 97 1e 0e 9d d0 fc .s......T....... 0030 17 1f f3 70 c3 5d 27 29 37 a1 04 10 02 00 00 00 ...p.]')7....... 0040 00 00 00 00 00 e4 0a 00 00 84 25 7a 27 be f8 de ..........%z'... 0050 fa 16 b6 b1 db 52 b2 09 19 6d 6c 80 1a 30 10 10 .....R...ml..0.. 0060 d3 86 63 0d b0 f8 76 95 66 da 28 39 f6 30 9c 79 ..c...v.f.(9.0.y 0070 fb f1 27 9b b4 f0 44 54 97 ca 24 4c c1 11 8f db ..'...DT..$L.... 0080 b2 95 33 87 6d ac 52 5d 2b 86 50 88 32 ed 34 98 ..3.m.R]+.P.2.4. 0090 5f d0 c7 f4 47 5d 75 a5 f2 09 0f 8d 7f e0 b5 ce _...G]u......... 00a0 27 cc e0 ab 03 98 b8 87 5a 1f a2 db e0 e0 1b ba '.......Z....... 00b0 98 da e2 c4 67 1c a3 fc b6 df 8e 4f c5 75 4f 6d ....g......O.uOm 00c0 4f 50 4b dd 15 d3 4b e3 0e 50 82 00 00 14 10 3e OPK...K..P.....> 00d0 44 8b c6 12 85 40 46 bc 6c 39 83 3f e7 ef 82 00 D....@F.l9.?.... 00e0 00 18 b5 cd fa 3f ca fc e8 b7 bf 1f eb aa fb 17 .....?.......... 00f0 a1 25 13 d7 60 ed 00 00 00 18 f3 c4 44 f4 6e 72 .%..`.......D.nr 0100 90 f3 88 77 52 2a 0b 46 97 74 df 9d 0c 58 ...wR*.F.t...X Frame 18 (270 bytes on wire, 270 bytes captured) Arrival Time: Oct 27, 2009 10:15:27.248681000 [Time delta from previous captured frame: 0.000045000 seconds] [Time delta from previous displayed frame: 0.000045000 seconds] [Time since reference or first frame: 2.494851000 seconds] Frame Number: 18 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb35 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x54f0 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: B5CDFA3FCAFCE8B7BF1FEBAAFB17A12513D760ED NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: F3C444F46E7290F38877522A0B469774DF9D0C58 0000 00 0c 29 6d a9 a5 00 0c 29 48 f8 2f 08 00 45 00 ..)m....)H./..E. 0010 01 00 00 00 40 00 40 11 fb 35 a5 e3 f9 7c a5 e3 ....@.@..5...|.. 0020 f9 73 01 f4 01 f4 00 ec 54 f0 97 1e 0e 9d d0 fc .s......T....... 0030 17 1f f3 70 c3 5d 27 29 37 a1 04 10 02 00 00 00 ...p.]')7....... 0040 00 00 00 00 00 e4 0a 00 00 84 25 7a 27 be f8 de ..........%z'... 0050 fa 16 b6 b1 db 52 b2 09 19 6d 6c 80 1a 30 10 10 .....R...ml..0.. 0060 d3 86 63 0d b0 f8 76 95 66 da 28 39 f6 30 9c 79 ..c...v.f.(9.0.y 0070 fb f1 27 9b b4 f0 44 54 97 ca 24 4c c1 11 8f db ..'...DT..$L.... 0080 b2 95 33 87 6d ac 52 5d 2b 86 50 88 32 ed 34 98 ..3.m.R]+.P.2.4. 0090 5f d0 c7 f4 47 5d 75 a5 f2 09 0f 8d 7f e0 b5 ce _...G]u......... 00a0 27 cc e0 ab 03 98 b8 87 5a 1f a2 db e0 e0 1b ba '.......Z....... 00b0 98 da e2 c4 67 1c a3 fc b6 df 8e 4f c5 75 4f 6d ....g......O.uOm 00c0 4f 50 4b dd 15 d3 4b e3 0e 50 82 00 00 14 10 3e OPK...K..P.....> 00d0 44 8b c6 12 85 40 46 bc 6c 39 83 3f e7 ef 82 00 D....@F.l9.?.... 00e0 00 18 b5 cd fa 3f ca fc e8 b7 bf 1f eb aa fb 17 .....?.......... 00f0 a1 25 13 d7 60 ed 00 00 00 18 f3 c4 44 f4 6e 72 .%..`.......D.nr 0100 90 f3 88 77 52 2a 0b 46 97 74 df 9d 0c 58 ...wR*.F.t...X Frame 19 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 27, 2009 10:15:27.480646000 [Time delta from previous captured frame: 0.231965000 seconds] [Time delta from previous displayed frame: 0.231965000 seconds] [Time since reference or first frame: 2.726816000 seconds] Frame Number: 19 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x01d0 (464) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9ed [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x72dd [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 00 78 01 d0 00 00 80 11 f9 ed a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 7c 01 f4 01 f4 00 64 72 dd 97 1e 0e 9d d0 fc .|.....dr....... 0030 17 1f f3 70 c3 5d 27 29 37 a1 05 10 02 01 00 00 ...p.]')7....... 0040 00 00 00 00 00 5c e7 38 49 83 b0 67 64 2f 73 da .....\.8I..gd/s. 0050 d7 da f3 42 1f fc 1e fb 95 b8 bf 11 2d 24 e8 c1 ...B........-$.. 0060 58 a8 e0 20 6a 72 98 e4 e7 ff 7b 17 e5 9d 04 8b X.. jr....{..... 0070 39 26 1c 41 99 ef 9e 1b c7 94 d2 a6 45 1f 82 56 9&.A........E..V 0080 46 88 76 94 3b 37 F.v.;7 Frame 20 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 27, 2009 10:15:27.480661000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 2.726831000 seconds] Frame Number: 20 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x01d0 (464) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9ed [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x72dd [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 00 78 01 d0 00 00 80 11 f9 ed a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 7c 01 f4 01 f4 00 64 72 dd 97 1e 0e 9d d0 fc .|.....dr....... 0030 17 1f f3 70 c3 5d 27 29 37 a1 05 10 02 01 00 00 ...p.]')7....... 0040 00 00 00 00 00 5c e7 38 49 83 b0 67 64 2f 73 da .....\.8I..gd/s. 0050 d7 da f3 42 1f fc 1e fb 95 b8 bf 11 2d 24 e8 c1 ...B........-$.. 0060 58 a8 e0 20 6a 72 98 e4 e7 ff 7b 17 e5 9d 04 8b X.. jr....{..... 0070 39 26 1c 41 99 ef 9e 1b c7 94 d2 a6 45 1f 82 56 9&.A........E..V 0080 46 88 76 94 3b 37 F.v.;7 Frame 21 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 27, 2009 10:15:27.481007000 [Time delta from previous captured frame: 0.000346000 seconds] [Time delta from previous displayed frame: 0.000346000 seconds] [Time since reference or first frame: 2.727177000 seconds] Frame Number: 21 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x01d2 (466) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9eb [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x72dd [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 00 78 01 d2 00 00 80 11 f9 eb a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 7c 01 f4 01 f4 00 64 72 dd 97 1e 0e 9d d0 fc .|.....dr....... 0030 17 1f f3 70 c3 5d 27 29 37 a1 05 10 02 01 00 00 ...p.]')7....... 0040 00 00 00 00 00 5c e7 38 49 83 b0 67 64 2f 73 da .....\.8I..gd/s. 0050 d7 da f3 42 1f fc 1e fb 95 b8 bf 11 2d 24 e8 c1 ...B........-$.. 0060 58 a8 e0 20 6a 72 98 e4 e7 ff 7b 17 e5 9d 04 8b X.. jr....{..... 0070 39 26 1c 41 99 ef 9e 1b c7 94 d2 a6 45 1f 82 56 9&.A........E..V 0080 46 88 76 94 3b 37 F.v.;7 Frame 22 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 27, 2009 10:15:27.481018000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 2.727188000 seconds] Frame Number: 22 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x01d2 (466) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9eb [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x72dd [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 00 78 01 d2 00 00 80 11 f9 eb a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 7c 01 f4 01 f4 00 64 72 dd 97 1e 0e 9d d0 fc .|.....dr....... 0030 17 1f f3 70 c3 5d 27 29 37 a1 05 10 02 01 00 00 ...p.]')7....... 0040 00 00 00 00 00 5c e7 38 49 83 b0 67 64 2f 73 da .....\.8I..gd/s. 0050 d7 da f3 42 1f fc 1e fb 95 b8 bf 11 2d 24 e8 c1 ...B........-$.. 0060 58 a8 e0 20 6a 72 98 e4 e7 ff 7b 17 e5 9d 04 8b X.. jr....{..... 0070 39 26 1c 41 99 ef 9e 1b c7 94 d2 a6 45 1f 82 56 9&.A........E..V 0080 46 88 76 94 3b 37 F.v.;7 Frame 23 (118 bytes on wire, 118 bytes captured) Arrival Time: Oct 27, 2009 10:15:27.481636000 [Time delta from previous captured frame: 0.000618000 seconds] [Time delta from previous displayed frame: 0.000618000 seconds] [Time since reference or first frame: 2.727806000 seconds] Frame Number: 23 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbcd [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x979f [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 6d a9 a5 00 0c 29 48 f8 2f 08 00 45 00 ..)m....)H./..E. 0010 00 68 00 00 40 00 40 11 fb cd a5 e3 f9 7c a5 e3 .h..@.@......|.. 0020 f9 73 01 f4 01 f4 00 54 97 9f 97 1e 0e 9d d0 fc .s.....T........ 0030 17 1f f3 70 c3 5d 27 29 37 a1 05 10 02 01 00 00 ...p.]')7....... 0040 00 00 00 00 00 4c 4c 84 8d 2b 15 b9 6b 5b 0e 4d .....LL..+..k[.M 0050 80 5a c5 31 06 37 1b af 7e bd bf e1 9b 2c b9 db .Z.1.7..~....,.. 0060 5e d2 93 fd 58 52 a9 51 f4 2f fb 16 f6 cd 5c d7 ^...XR.Q./....\. 0070 31 73 3f 89 6d b1 1s?.m. Frame 24 (118 bytes on wire, 118 bytes captured) Arrival Time: Oct 27, 2009 10:15:27.481645000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 2.727815000 seconds] Frame Number: 24 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbcd [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x979f [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 6d a9 a5 00 0c 29 48 f8 2f 08 00 45 00 ..)m....)H./..E. 0010 00 68 00 00 40 00 40 11 fb cd a5 e3 f9 7c a5 e3 .h..@.@......|.. 0020 f9 73 01 f4 01 f4 00 54 97 9f 97 1e 0e 9d d0 fc .s.....T........ 0030 17 1f f3 70 c3 5d 27 29 37 a1 05 10 02 01 00 00 ...p.]')7....... 0040 00 00 00 00 00 4c 4c 84 8d 2b 15 b9 6b 5b 0e 4d .....LL..+..k[.M 0050 80 5a c5 31 06 37 1b af 7e bd bf e1 9b 2c b9 db .Z.1.7..~....,.. 0060 5e d2 93 fd 58 52 a9 51 f4 2f fb 16 f6 cd 5c d7 ^...XR.Q./....\. 0070 31 73 3f 89 6d b1 1s?.m. Frame 25 (342 bytes on wire, 342 bytes captured) Arrival Time: Oct 27, 2009 10:15:29.678815000 [Time delta from previous captured frame: 2.197170000 seconds] [Time delta from previous displayed frame: 2.197170000 seconds] [Time since reference or first frame: 4.924985000 seconds] Frame Number: 25 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x01dc (476) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf911 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xb0df [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x7f9361b1 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 01 48 01 dc 00 00 80 11 f9 11 a5 e3 f9 73 a5 e3 .H...........s.. 0020 f9 7c 01 f4 01 f4 01 34 b0 df 97 1e 0e 9d d0 fc .|.....4........ 0030 17 1f f3 70 c3 5d 27 29 37 a1 08 10 20 01 7f 93 ...p.]')7... ... 0040 61 b1 00 00 01 2c 2d cc 0f 50 c2 47 30 3d 59 9c a....,-..P.G0=Y. 0050 ff 41 14 88 50 72 97 88 42 7d 76 0c c0 0d ae e4 .A..Pr..B}v..... 0060 97 d2 fe 22 3f 3a f7 79 3e 51 05 52 61 88 92 7b ..."?:.y>Q.Ra..{ 0070 71 f8 3d 05 cb 91 5b eb 49 43 cf 97 3b 02 78 0c q.=...[.IC..;.x. 0080 57 25 34 d5 e6 ee 29 37 cb 7c db df 2c a7 cb f8 W%4...)7.|..,... 0090 0f 23 04 39 3b 36 34 98 4d 45 af ef 23 ca 76 04 .#.9;64.ME..#.v. 00a0 fd bf 0a b2 85 df 30 23 07 03 81 18 ad df df dc ......0#........ 00b0 2c 95 48 9e 9f 22 18 e7 61 43 6a 0b ec 9a 3f 6b ,.H.."..aCj...?k 00c0 8f c9 d5 ac 92 c2 e9 f5 61 0f 8d ce 50 35 ea 16 ........a...P5.. 00d0 c0 54 32 84 7e b9 25 05 57 cd 14 4a 13 3e 0e 96 .T2.~.%.W..J.>.. 00e0 54 9d 3c e9 38 3f ef ed 80 37 2c 34 7e ac 07 85 T.<.8?...7,4~... 00f0 e2 d4 23 24 06 ce 73 1b 50 22 05 52 84 20 fd 47 ..#$..s.P".R. .G 0100 d6 e5 c8 79 7b b7 43 5d ed 03 2b b9 4b 9b 13 00 ...y{.C]..+.K... 0110 d8 ec 83 60 2f 1c 40 ea 64 b3 1f 05 bf c3 d1 5c ...`/.@.d......\ 0120 79 31 8e 5e c8 fb 28 ed d2 5d 1c f3 6c 26 dc 27 y1.^..(..]..l&.' 0130 8c ec 56 2b d4 36 b6 a3 9f e6 1d a2 fd ce a1 66 ..V+.6.........f 0140 59 2e 29 b3 b8 8d fe 81 1f 37 42 d0 b3 f7 76 c8 Y.)......7B...v. 0150 e0 49 a4 d9 48 2a .I..H* Frame 26 (342 bytes on wire, 342 bytes captured) Arrival Time: Oct 27, 2009 10:15:29.678830000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 4.925000000 seconds] Frame Number: 26 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x01dc (476) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf911 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xb0df [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x7f9361b1 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 01 48 01 dc 00 00 80 11 f9 11 a5 e3 f9 73 a5 e3 .H...........s.. 0020 f9 7c 01 f4 01 f4 01 34 b0 df 97 1e 0e 9d d0 fc .|.....4........ 0030 17 1f f3 70 c3 5d 27 29 37 a1 08 10 20 01 7f 93 ...p.]')7... ... 0040 61 b1 00 00 01 2c 2d cc 0f 50 c2 47 30 3d 59 9c a....,-..P.G0=Y. 0050 ff 41 14 88 50 72 97 88 42 7d 76 0c c0 0d ae e4 .A..Pr..B}v..... 0060 97 d2 fe 22 3f 3a f7 79 3e 51 05 52 61 88 92 7b ..."?:.y>Q.Ra..{ 0070 71 f8 3d 05 cb 91 5b eb 49 43 cf 97 3b 02 78 0c q.=...[.IC..;.x. 0080 57 25 34 d5 e6 ee 29 37 cb 7c db df 2c a7 cb f8 W%4...)7.|..,... 0090 0f 23 04 39 3b 36 34 98 4d 45 af ef 23 ca 76 04 .#.9;64.ME..#.v. 00a0 fd bf 0a b2 85 df 30 23 07 03 81 18 ad df df dc ......0#........ 00b0 2c 95 48 9e 9f 22 18 e7 61 43 6a 0b ec 9a 3f 6b ,.H.."..aCj...?k 00c0 8f c9 d5 ac 92 c2 e9 f5 61 0f 8d ce 50 35 ea 16 ........a...P5.. 00d0 c0 54 32 84 7e b9 25 05 57 cd 14 4a 13 3e 0e 96 .T2.~.%.W..J.>.. 00e0 54 9d 3c e9 38 3f ef ed 80 37 2c 34 7e ac 07 85 T.<.8?...7,4~... 00f0 e2 d4 23 24 06 ce 73 1b 50 22 05 52 84 20 fd 47 ..#$..s.P".R. .G 0100 d6 e5 c8 79 7b b7 43 5d ed 03 2b b9 4b 9b 13 00 ...y{.C]..+.K... 0110 d8 ec 83 60 2f 1c 40 ea 64 b3 1f 05 bf c3 d1 5c ...`/.@.d......\ 0120 79 31 8e 5e c8 fb 28 ed d2 5d 1c f3 6c 26 dc 27 y1.^..(..]..l&.' 0130 8c ec 56 2b d4 36 b6 a3 9f e6 1d a2 fd ce a1 66 ..V+.6.........f 0140 59 2e 29 b3 b8 8d fe 81 1f 37 42 d0 b3 f7 76 c8 Y.)......7B...v. 0150 e0 49 a4 d9 48 2a .I..H* Frame 27 (342 bytes on wire, 342 bytes captured) Arrival Time: Oct 27, 2009 10:15:29.683392000 [Time delta from previous captured frame: 0.004562000 seconds] [Time delta from previous displayed frame: 0.004562000 seconds] [Time since reference or first frame: 4.929562000 seconds] Frame Number: 27 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaed [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xda36 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x7f9361b1 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 6d a9 a5 00 0c 29 48 f8 2f 08 00 45 00 ..)m....)H./..E. 0010 01 48 00 00 40 00 40 11 fa ed a5 e3 f9 7c a5 e3 .H..@.@......|.. 0020 f9 73 01 f4 01 f4 01 34 da 36 97 1e 0e 9d d0 fc .s.....4.6...... 0030 17 1f f3 70 c3 5d 27 29 37 a1 08 10 20 01 7f 93 ...p.]')7... ... 0040 61 b1 00 00 01 2c fd b0 55 76 e2 9c eb 63 52 e4 a....,..Uv...cR. 0050 fe 84 97 1f b7 39 04 fd 5b 23 94 79 11 a7 00 c8 .....9..[#.y.... 0060 86 d2 fb 42 21 2c be 1d cb c6 55 28 e3 62 88 2a ...B!,....U(.b.* 0070 da 07 97 5f 33 04 4a cd 4f 50 97 92 e3 4a 92 bb ..._3.J.OP...J.. 0080 3f a8 31 f7 4a d2 15 ad 23 12 c6 5f 08 7c a8 e9 ?.1.J...#.._.|.. 0090 90 39 5a cd e0 e0 8e 39 b5 ae 45 99 5f af ea 25 .9Z....9..E._..% 00a0 0f 5d b3 42 93 a6 99 01 f4 c1 17 ab f4 6a 6b 3a .].B.........jk: 00b0 ed d2 36 db 16 9a 54 34 a4 f3 a0 47 d8 85 15 67 ..6...T4...G...g 00c0 c9 13 30 5e ce dd c2 c1 c0 ad 3c 87 fb f1 50 42 ..0^......<...PB 00d0 67 02 d8 1a aa 1e 92 83 35 42 83 9e d8 94 fa c6 g.......5B...... 00e0 98 2d d5 3c 6d 2c 18 a2 e2 e0 e9 b4 77 c4 6c 1d .-.....b.... 0130 24 ee 81 bd 2f b8 12 92 59 69 bb 71 95 0b ea 2d $.../...Yi.q...- 0140 59 77 89 45 ee 17 00 7a 78 1d 30 cb 67 dc 49 3b Yw.E...zx.0.g.I; 0150 2f 54 f5 80 18 10 /T.... Frame 28 (342 bytes on wire, 342 bytes captured) Arrival Time: Oct 27, 2009 10:15:29.683404000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 4.929574000 seconds] Frame Number: 28 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaed [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xda36 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x7f9361b1 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 6d a9 a5 00 0c 29 48 f8 2f 08 00 45 00 ..)m....)H./..E. 0010 01 48 00 00 40 00 40 11 fa ed a5 e3 f9 7c a5 e3 .H..@.@......|.. 0020 f9 73 01 f4 01 f4 01 34 da 36 97 1e 0e 9d d0 fc .s.....4.6...... 0030 17 1f f3 70 c3 5d 27 29 37 a1 08 10 20 01 7f 93 ...p.]')7... ... 0040 61 b1 00 00 01 2c fd b0 55 76 e2 9c eb 63 52 e4 a....,..Uv...cR. 0050 fe 84 97 1f b7 39 04 fd 5b 23 94 79 11 a7 00 c8 .....9..[#.y.... 0060 86 d2 fb 42 21 2c be 1d cb c6 55 28 e3 62 88 2a ...B!,....U(.b.* 0070 da 07 97 5f 33 04 4a cd 4f 50 97 92 e3 4a 92 bb ..._3.J.OP...J.. 0080 3f a8 31 f7 4a d2 15 ad 23 12 c6 5f 08 7c a8 e9 ?.1.J...#.._.|.. 0090 90 39 5a cd e0 e0 8e 39 b5 ae 45 99 5f af ea 25 .9Z....9..E._..% 00a0 0f 5d b3 42 93 a6 99 01 f4 c1 17 ab f4 6a 6b 3a .].B.........jk: 00b0 ed d2 36 db 16 9a 54 34 a4 f3 a0 47 d8 85 15 67 ..6...T4...G...g 00c0 c9 13 30 5e ce dd c2 c1 c0 ad 3c 87 fb f1 50 42 ..0^......<...PB 00d0 67 02 d8 1a aa 1e 92 83 35 42 83 9e d8 94 fa c6 g.......5B...... 00e0 98 2d d5 3c 6d 2c 18 a2 e2 e0 e9 b4 77 c4 6c 1d .-.....b.... 0130 24 ee 81 bd 2f b8 12 92 59 69 bb 71 95 0b ea 2d $.../...Yi.q...- 0140 59 77 89 45 ee 17 00 7a 78 1d 30 cb 67 dc 49 3b Yw.E...zx.0.g.I; 0150 2f 54 f5 80 18 10 /T.... Frame 29 (102 bytes on wire, 102 bytes captured) Arrival Time: Oct 27, 2009 10:15:29.686150000 [Time delta from previous captured frame: 0.002746000 seconds] [Time delta from previous displayed frame: 0.002746000 seconds] [Time since reference or first frame: 4.932320000 seconds] Frame Number: 29 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x01e1 (481) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9fc [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x6d75 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x7f9361b1 Length: 60 Encrypted payload (32 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 00 58 01 e1 00 00 80 11 f9 fc a5 e3 f9 73 a5 e3 .X...........s.. 0020 f9 7c 01 f4 01 f4 00 44 6d 75 97 1e 0e 9d d0 fc .|.....Dmu...... 0030 17 1f f3 70 c3 5d 27 29 37 a1 08 10 20 01 7f 93 ...p.]')7... ... 0040 61 b1 00 00 00 3c c3 c1 0d b3 e5 2f 50 bd 5c 02 a....<...../P.\. 0050 99 42 13 66 65 16 0b eb d0 91 62 62 66 2a 32 bb .B.fe.....bbf*2. 0060 a7 79 ac 92 01 5a .y...Z Frame 30 (102 bytes on wire, 102 bytes captured) Arrival Time: Oct 27, 2009 10:15:29.686163000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 4.932333000 seconds] Frame Number: 30 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x01e1 (481) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9fc [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x6d75 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 971E0E9DD0FC171F Responder cookie: F370C35D272937A1 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x7f9361b1 Length: 60 Encrypted payload (32 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 00 58 01 e1 00 00 80 11 f9 fc a5 e3 f9 73 a5 e3 .X...........s.. 0020 f9 7c 01 f4 01 f4 00 44 6d 75 97 1e 0e 9d d0 fc .|.....Dmu...... 0030 17 1f f3 70 c3 5d 27 29 37 a1 08 10 20 01 7f 93 ...p.]')7... ... 0040 61 b1 00 00 00 3c c3 c1 0d b3 e5 2f 50 bd 5c 02 a....<...../P.\. 0050 99 42 13 66 65 16 0b eb d0 91 62 62 66 2a 32 bb .B.fe.....bbf*2. 0060 a7 79 ac 92 01 5a .y...Z Frame 31 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 27, 2009 10:15:45.692940000 [Time delta from previous captured frame: 16.006777000 seconds] [Time delta from previous displayed frame: 16.006777000 seconds] [Time since reference or first frame: 20.939110000 seconds] Frame Number: 31 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb9b [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0x0379147a ESP Sequence: 1 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 00 78 00 01 00 00 80 32 fb 9b a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 7c 03 79 14 7a 00 00 00 01 16 0d 5e d8 f3 d5 .|.y.z......^... 0030 9f ba 23 46 86 36 c2 d2 67 14 2f 06 0b b5 e2 e3 ..#F.6..g./..... 0040 8b 1d 87 bc 8c c4 d2 15 27 da 35 f6 d0 6e df 57 ........'.5..n.W 0050 37 72 10 fb f8 7e c6 a9 85 0b f4 29 d8 78 a3 36 7r...~.....).x.6 0060 32 b5 b1 01 45 13 01 5a 52 dd df 38 ec 37 1c 1a 2...E..ZR..8.7.. 0070 42 54 98 fd 62 14 da b7 31 8b 46 01 7b ae 05 e8 BT..b...1.F.{... 0080 f3 2d 83 03 a5 74 .-...t Frame 32 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 27, 2009 10:15:45.692952000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 20.939122000 seconds] Frame Number: 32 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb9b [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0x0379147a ESP Sequence: 1 0000 00 0c 29 48 f8 2f 00 0c 29 6d a9 a5 08 00 45 00 ..)H./..)m....E. 0010 00 78 00 01 00 00 80 32 fb 9b a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 7c 03 79 14 7a 00 00 00 01 16 0d 5e d8 f3 d5 .|.y.z......^... 0030 9f ba 23 46 86 36 c2 d2 67 14 2f 06 0b b5 e2 e3 ..#F.6..g./..... 0040 8b 1d 87 bc 8c c4 d2 15 27 da 35 f6 d0 6e df 57 ........'.5..n.W 0050 37 72 10 fb f8 7e c6 a9 85 0b f4 29 d8 78 a3 36 7r...~.....).x.6 0060 32 b5 b1 01 45 13 01 5a 52 dd df 38 ec 37 1c 1a 2...E..ZR..8.7.. 0070 42 54 98 fd 62 14 da b7 31 8b 46 01 7b ae 05 e8 BT..b...1.F.{... 0080 f3 2d 83 03 a5 74 .-...t Frame 33 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 27, 2009 10:15:45.693881000 [Time delta from previous captured frame: 0.000929000 seconds] [Time delta from previous displayed frame: 0.000929000 seconds] [Time since reference or first frame: 20.940051000 seconds] Frame Number: 33 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0011 (17) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b8b [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0x45fa0d6d ESP Sequence: 1 0000 00 0c 29 6d a9 a5 00 0c 29 48 f8 2f 08 00 45 00 ..)m....)H./..E. 0010 00 78 00 11 00 00 f0 32 8b 8b a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 73 45 fa 0d 6d 00 00 00 01 8f f0 9e 63 09 e3 .sE..m.......c.. 0030 5f 41 fb 3e 56 34 c8 30 2d 2a e1 b9 be 9c 18 f5 _A.>V4.0-*...... 0040 8b bf 11 70 39 95 93 85 8b 99 f0 28 32 2c c0 24 ...p9......(2,.$ 0050 1d 09 5d eb cf 0a a7 4c f6 51 a7 a2 52 79 47 16 ..]....L.Q..RyG. 0060 41 ad 1d d1 8f ac 17 d6 64 1f 3f 42 15 30 6f e1 A.......d.?B.0o. 0070 09 5c 85 1d 4c c4 a8 e9 32 45 28 e7 73 a9 a4 f3 .\..L...2E(.s... 0080 34 00 aa a0 f9 89 4..... Frame 34 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 27, 2009 10:15:45.693890000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 20.940060000 seconds] Frame Number: 34 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0011 (17) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b8b [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0x45fa0d6d ESP Sequence: 1 0000 00 0c 29 6d a9 a5 00 0c 29 48 f8 2f 08 00 45 00 ..)m....)H./..E. 0010 00 78 00 11 00 00 f0 32 8b 8b a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 73 45 fa 0d 6d 00 00 00 01 8f f0 9e 63 09 e3 .sE..m.......c.. 0030 5f 41 fb 3e 56 34 c8 30 2d 2a e1 b9 be 9c 18 f5 _A.>V4.0-*...... 0040 8b bf 11 70 39 95 93 85 8b 99 f0 28 32 2c c0 24 ...p9......(2,.$ 0050 1d 09 5d eb cf 0a a7 4c f6 51 a7 a2 52 79 47 16 ..]....L.Q..RyG. 0060 41 ad 1d d1 8f ac 17 d6 64 1f 3f 42 15 30 6f e1 A.......d.?B.0o. 0070 09 5c 85 1d 4c c4 a8 e9 32 45 28 e7 73 a9 a4 f3 .\..L...2E(.s... 0080 34 00 aa a0 f9 89 4.....