Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Jun 23, 2007 15:31:07.678217000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 166 bytes Capture Length: 166 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x02dc (732) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8be [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.127 (165.227.249.127) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x54fe [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x8AB9F1D05D98DD64 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 19 e1 68 8e 01 00 0c 29 ab 06 ab 08 00 45 00 ...h....).....E. 0010 00 98 02 dc 00 00 80 11 f8 be a5 e3 f9 73 a5 e3 .............s.. 0020 f9 7f 01 f4 01 f4 00 84 54 fe 8a b9 f1 d0 5d 98 ........T.....]. 0030 dd 64 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .d.............. 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (166 bytes on wire, 166 bytes captured) Arrival Time: Jun 23, 2007 15:31:07.679996000 Time delta from previous packet: 0.001779000 seconds Time since reference or first frame: 0.001779000 seconds Frame Number: 2 Packet Length: 166 bytes Capture Length: 166 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.127 (165.227.249.127), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x03bc (956) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x37df [correct] Good: True Bad : False Source: 165.227.249.127 (165.227.249.127) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x30e7 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x8AB9F1D05D98DD64 Responder cookie: 0x619CFA4B9066314F Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 ab 06 ab 00 19 e1 68 8e 01 08 00 45 00 ..)......h....E. 0010 00 98 03 bc 00 00 40 11 37 df a5 e3 f9 7f a5 e3 ......@.7....... 0020 f9 73 01 f4 01 f4 00 84 30 e7 8a b9 f1 d0 5d 98 .s......0.....]. 0030 dd 64 61 9c fa 4b 90 66 31 4f 01 10 02 00 00 00 .da..K.f1O...... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 ......>.in.c...B 0090 7b 1f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 {.........h...k. 00a0 96 fc 77 57 01 00 ..wW.. Frame 3 (346 bytes on wire, 346 bytes captured) Arrival Time: Jun 23, 2007 15:31:09.958016000 Time delta from previous packet: 2.278020000 seconds Time since reference or first frame: 2.279799000 seconds Frame Number: 3 Packet Length: 346 bytes Capture Length: 346 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x02dd (733) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf809 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.127 (165.227.249.127) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0x3482 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x8AB9F1D05D98DD64 Responder cookie: 0x619CFA4B9066314F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: 3AB5379F12E2699FF0CDC8535FC66A2D4DF210CE NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: Vendor ID (13) Length: 24 Hash of address and port: 578A7A24FA2A7E9F1F0DA9806225FD21FE32AD39 Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 19 e1 68 8e 01 00 0c 29 ab 06 ab 08 00 45 00 ...h....).....E. 0010 01 4c 02 dd 00 00 80 11 f8 09 a5 e3 f9 73 a5 e3 .L...........s.. 0020 f9 7f 01 f4 01 f4 01 38 34 82 8a b9 f1 d0 5d 98 .......84.....]. 0030 dd 64 61 9c fa 4b 90 66 31 4f 04 10 02 00 00 00 .da..K.f1O...... 0040 00 00 00 00 01 30 0a 00 00 84 0b fb 7e 0b 47 31 .....0......~.G1 0050 50 68 5c b4 f9 ab 7b a4 ce 39 0e 95 23 bd 20 aa Ph\...{..9..#. . 0060 dc c2 88 7e ad 5c 08 b7 b4 ad 82 94 b0 0b ee ab ...~.\.......... 0070 dc 7f fe d7 4b 96 a5 39 be 4d dc 79 dc ef 6a 5d ....K..9.M.y..j] 0080 6c 3e 49 c8 98 c8 bb e5 69 1a cf 8c 6d 0d 1e c5 l>I.....i...m... 0090 6c e9 c8 e9 9f 82 a5 f9 4e a1 e0 71 0c d4 51 f5 l.......N..q..Q. 00a0 0b 77 a8 7c 31 ed a6 3b a7 4d c0 8b 22 7f f1 8b .w.|1..;.M.."... 00b0 9b 9b 1e 00 69 ba 6a 27 ca 32 4d 00 cc 6e d6 cd ....i.j'.2M..n.. 00c0 b9 6d 41 3e 55 67 b3 df 69 f8 82 00 00 18 0e e1 .mA>Ug..i....... 00d0 a1 b1 b0 aa 9f 54 d9 e5 3c 47 d7 03 61 d2 ff 4a .....T.........8m...! 0060 82 e0 1e 9d a9 22 8b 8b 08 df d1 2b 8e 04 37 16 .....".....+..7. 0070 80 39 b4 44 22 9c 18 c5 3f 48 39 b2 6e 5a a2 de .9.D"...?H9.nZ.. 0080 df d8 f8 be 27 b4 13 8c 6a b2 a1 94 a9 07 16 ff ....'...j....... 0090 89 d7 01 08 34 2d 47 6f 5f c3 e5 32 1a 50 ab 48 ....4-Go_..2.P.H 00a0 9e 7f 60 bc ad 49 4d 41 5f d2 8b 80 df 2f 13 02 ..`..IMA_..../.. 00b0 36 9c 02 83 47 df 9c 1b df 81 df 93 64 4e 15 b8 6...G.......dN.. 00c0 c8 7c 81 81 3e 52 29 40 1e 58 82 00 00 0c a7 4b .|..>R)@.X.....K 00d0 e1 f6 a1 a5 18 49 82 00 00 18 57 8a 7a 24 fa 2a .....I....W.z$.* 00e0 7e 9f 1f 0d a9 80 62 25 fd 21 fe 32 ad 39 00 00 ~.....b%.!.2.9.. 00f0 00 18 3a b5 37 9f 12 e2 69 9f f0 cd c8 53 5f c6 ..:.7...i....S_. 0100 6a 2d 4d f2 10 ce j-M... Frame 5 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 23, 2007 15:31:11.181933000 Time delta from previous packet: 0.975192000 seconds Time since reference or first frame: 3.503716000 seconds Frame Number: 5 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x02de (734) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8dc [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.127 (165.227.249.127) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xd542 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x8AB9F1D05D98DD64 Responder cookie: 0x619CFA4B9066314F Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 19 e1 68 8e 01 00 0c 29 ab 06 ab 08 00 45 00 ...h....).....E. 0010 00 78 02 de 00 00 80 11 f8 dc a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 7f 01 f4 01 f4 00 64 d5 42 8a b9 f1 d0 5d 98 .......d.B....]. 0030 dd 64 61 9c fa 4b 90 66 31 4f 05 10 02 01 00 00 .da..K.f1O...... 0040 00 00 00 00 00 5c 45 3f c1 3e 2a e0 b5 5a 6f c7 .....\E?.>*..Zo. 0050 fc cb d1 c7 55 d4 e7 56 48 d5 9f 66 ad 2c 33 c0 ....U..VH..f.,3. 0060 d5 2f 5b 9b d2 d5 f7 df 9c 0c 30 db b6 4f 4c 39 ./[.......0..OL9 0070 9c 99 e5 1e 3b d5 6e 37 db 8d 9a d2 2c 64 7c 36 ....;.n7....,d|6 0080 35 75 38 89 5b 95 5u8.[. Frame 6 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 23, 2007 15:31:11.480340000 Time delta from previous packet: 0.298407000 seconds Time since reference or first frame: 3.802123000 seconds Frame Number: 6 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.127 (165.227.249.127), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x03be (958) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x37fd [correct] Good: True Bad : False Source: 165.227.249.127 (165.227.249.127) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x387a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x8AB9F1D05D98DD64 Responder cookie: 0x619CFA4B9066314F Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 ab 06 ab 00 19 e1 68 8e 01 08 00 45 00 ..)......h....E. 0010 00 78 03 be 00 00 40 11 37 fd a5 e3 f9 7f a5 e3 .x....@.7....... 0020 f9 73 01 f4 01 f4 00 64 38 7a 8a b9 f1 d0 5d 98 .s.....d8z....]. 0030 dd 64 61 9c fa 4b 90 66 31 4f 05 10 02 01 00 00 .da..K.f1O...... 0040 00 00 00 00 00 5c 6d 88 ed 76 50 0c 0c 43 89 89 .....\m..vP..C.. 0050 03 38 a0 df 74 72 ee cb 33 a1 ad a5 e1 4b ac a2 .8..tr..3....K.. 0060 ae b5 eb 76 8e 30 19 a1 35 65 09 df 41 df 50 7b ...v.0..5e..A.P{ 0070 62 00 af cd 22 b1 6d b6 30 8d 92 07 85 0d da ef b...".m.0....... 0080 68 13 87 18 28 82 h...(. Frame 7 (342 bytes on wire, 342 bytes captured) Arrival Time: Jun 23, 2007 15:31:13.757493000 Time delta from previous packet: 2.277153000 seconds Time since reference or first frame: 6.079276000 seconds Frame Number: 7 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x02e1 (737) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf809 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.127 (165.227.249.127) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x3fe9 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x8AB9F1D05D98DD64 Responder cookie: 0x619CFA4B9066314F Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x943E0812 Length: 300 Encrypted payload (272 bytes) 0000 00 19 e1 68 8e 01 00 0c 29 ab 06 ab 08 00 45 00 ...h....).....E. 0010 01 48 02 e1 00 00 80 11 f8 09 a5 e3 f9 73 a5 e3 .H...........s.. 0020 f9 7f 01 f4 01 f4 01 34 3f e9 8a b9 f1 d0 5d 98 .......4?.....]. 0030 dd 64 61 9c fa 4b 90 66 31 4f 08 10 20 01 94 3e .da..K.f1O.. ..> 0040 08 12 00 00 01 2c c9 d0 c3 2e 33 1f 70 dd a2 3f .....,....3.p..? 0050 9b f9 5a 3e ad 88 21 30 98 51 4d 05 a4 51 2e a2 ..Z>..!0.QM..Q.. 0060 9f 39 a6 1e ea 23 f0 9c 57 d9 f5 24 51 d1 d7 55 .9...#..W..$Q..U 0070 f3 8f ca 32 7e a3 02 9a 7d 2c 67 21 30 d2 0c 6a ...2~...},g!0..j 0080 d1 93 bb f2 10 72 55 73 6c 31 76 41 a9 5b 6a ba .....rUsl1vA.[j. 0090 70 79 04 a2 75 1c 75 7e 1a c6 27 b9 2f da 08 1c py..u.u~..'./... 00a0 f7 a6 23 ba da 45 b6 f7 92 d6 fd fe 79 28 0a cb ..#..E......y(.. 00b0 1e b1 5f 62 19 8c 8a dd 49 68 e9 f6 22 c6 ca 0e .._b....Ih.."... 00c0 40 a2 35 9a 92 2f eb d2 bc 8a dd 7a d4 0c b1 7f @.5../.....z.... 00d0 a5 bf 7d 32 51 1b 3c ec be 94 65 70 c7 87 23 0d ..}2Q.<...ep..#. 00e0 a4 e3 8d ec ef 48 2f 2c 07 8b 01 75 59 b5 78 55 .....H/,...uY.xU 00f0 e7 02 ff 01 4b 3e 26 6a 7c 6e 6a 54 be d5 64 b7 ....K>&j|njT..d. 0100 db 27 f9 60 08 b8 e9 4c 96 5f 58 c7 6d d4 e0 a4 .'.`...L._X.m... 0110 7d 0a b6 c5 5b 4e 18 a5 7f 87 5d e7 a2 5b 61 3b }...[N....]..[a; 0120 c3 59 98 1f ce 8e 28 3c 8e ae c7 93 2b 8f 66 56 .Y....(<....+.fV 0130 06 1d 77 f8 99 42 81 e9 9d 6f 63 08 8d a5 cd b7 ..w..B...oc..... 0140 b2 10 45 dc c1 cc a9 f6 40 b4 11 bc d6 fe b9 ae ..E.....@....... 0150 d7 a7 8b f0 08 39 .....9 Frame 8 (326 bytes on wire, 326 bytes captured) Arrival Time: Jun 23, 2007 15:31:14.021895000 Time delta from previous packet: 0.264402000 seconds Time since reference or first frame: 6.343678000 seconds Frame Number: 8 Packet Length: 326 bytes Capture Length: 326 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.127 (165.227.249.127), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x03c3 (963) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3738 [correct] Good: True Bad : False Source: 165.227.249.127 (165.227.249.127) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x3b93 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x8AB9F1D05D98DD64 Responder cookie: 0x619CFA4B9066314F Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x943E0812 Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 ab 06 ab 00 19 e1 68 8e 01 08 00 45 00 ..)......h....E. 0010 01 38 03 c3 00 00 40 11 37 38 a5 e3 f9 7f a5 e3 .8....@.78...... 0020 f9 73 01 f4 01 f4 01 24 3b 93 8a b9 f1 d0 5d 98 .s.....$;.....]. 0030 dd 64 61 9c fa 4b 90 66 31 4f 08 10 20 01 94 3e .da..K.f1O.. ..> 0040 08 12 00 00 01 1c c0 b2 95 bc f0 ad 68 19 38 b5 ............h.8. 0050 4c 0f 55 7c 6b d2 2c 01 5f 26 a5 b7 c6 fa 67 e6 L.U|k.,._&....g. 0060 92 b4 ff de dd 92 f7 5a ec 28 40 a2 e4 ec 95 8f .......Z.(@..... 0070 7e fe 0e a5 d9 ab da d3 14 14 f2 52 a7 ec ca f8 ~..........R.... 0080 23 b0 0c 8b 61 fc 35 68 63 b0 bf 9c d2 93 b0 13 #...a.5hc....... 0090 6d d3 da 67 88 7f a2 eb 7f 91 60 39 12 39 8c b0 m..g......`9.9.. 00a0 04 3b 7c c2 b8 84 7e 63 1f 96 f9 ed b5 86 72 1d .;|...~c......r. 00b0 de e8 ff e7 e4 79 0f 9a 03 e6 a8 d3 52 ba 3f b7 .....y......R.?. 00c0 e9 ab a4 e4 7f 5c 07 10 13 56 5f d5 d7 d3 e4 8d .....\...V_..... 00d0 a4 8f fc fc 67 66 83 36 81 2e 5f fc 04 6b 19 8e ....gf.6.._..k.. 00e0 d8 41 7b cb c8 af 0e 89 56 44 fb aa d5 d2 57 60 .A{.....VD....W` 00f0 43 1f f3 b7 c5 38 c1 7c 22 80 db 7b f8 78 c4 d7 C....8.|"..{.x.. 0100 d8 15 46 8b f7 a3 92 f1 83 3e 58 1e 18 db 1a 9f ..F......>X..... 0110 52 b5 c5 c8 0c bf 11 40 d3 f1 da 00 7a 78 f3 8d R......@....zx.. 0120 76 b2 a2 8f d3 9d fb 20 f5 e4 58 2b 0a db 56 f9 v...... ..X+..V. 0130 30 4c ce 6c 12 a7 7a b4 17 3c 58 68 88 1c 00 3d 0L.l..z.. 0040 08 12 00 00 00 3c 28 d4 11 d7 35 ce 05 d7 62 a3 .....<(...5...b. 0050 c6 4f 40 00 38 7d 13 70 b9 fa 69 28 8c d7 7f 83 .O@.8}.p..i(.... 0060 2c 21 72 17 bc 2c ,!r.., Frame 10 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 23, 2007 15:31:18.197744000 Time delta from previous packet: 4.175847000 seconds Time since reference or first frame: 10.519527000 seconds Frame Number: 10 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb98 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.127 (165.227.249.127) Encapsulating Security Payload SPI: 0xbf2f67e7 Sequence: 1 Data (92 bytes) 0000 00 19 e1 68 8e 01 00 0c 29 ab 06 ab 08 00 45 00 ...h....).....E. 0010 00 78 00 01 00 00 80 32 fb 98 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 7f bf 2f 67 e7 00 00 00 01 d6 10 16 a2 73 fa .../g.........s. 0030 5c f7 3d 96 09 28 b8 d4 59 67 55 22 68 e1 d2 be \.=..(..YgU"h... 0040 e3 98 36 6a 47 82 5f 40 c5 09 9e 5e 07 e6 a2 40 ..6jG._@...^...@ 0050 25 e8 1a 1b d5 6e b4 cf 81 06 ef e0 93 b4 1b 81 %....n.......... 0060 ba fe cf 6e e3 02 78 da 8e 27 b9 a1 d4 35 7a c7 ...n..x..'...5z. 0070 62 00 c2 e0 25 f6 a9 bc a5 1b 63 ac b2 30 8c 49 b...%.....c..0.I 0080 c3 60 3b 37 ae 9b .`;7.. Frame 11 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 23, 2007 15:31:18.201773000 Time delta from previous packet: 0.004029000 seconds Time since reference or first frame: 10.523556000 seconds Frame Number: 11 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.127 (165.227.249.127), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x5033 (20531) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 29 Protocol: ESP (0x32) Header checksum: 0x0e67 [correct] Good: True Bad : False Source: 165.227.249.127 (165.227.249.127) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x3e1da1b9 Sequence: 1 Data (92 bytes) 0000 00 0c 29 ab 06 ab 00 19 e1 68 8e 01 08 00 45 00 ..)......h....E. 0010 00 78 50 33 00 00 1d 32 0e 67 a5 e3 f9 7f a5 e3 .xP3...2.g...... 0020 f9 73 3e 1d a1 b9 00 00 00 01 1e 0d 9c 10 49 4d .s>...........IM 0030 97 19 7b c7 4f be b6 6f 7b 92 d3 cf a4 f8 76 53 ..{.O..o{.....vS 0040 78 3e 42 99 57 d9 8e 75 64 dc 26 76 d4 06 37 36 x>B.W..ud.&v..76 0050 88 7b b6 e8 72 7a 25 a2 3d 99 6c fc a8 40 08 f1 .{..rz%.=.l..@.. 0060 27 a2 74 71 2f a6 25 eb ae 34 78 9a 25 a7 68 6e '.tq/.%..4x.%.hn 0070 ad d9 d6 4c ce d1 3a bb 0c 6e 11 18 e3 26 bb 9b ...L..:..n...&.. 0080 4b 8c 31 1d 71 7e K.1.q~ Frame 12 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 23, 2007 15:31:19.210414000 Time delta from previous packet: 1.008641000 seconds Time since reference or first frame: 11.532197000 seconds Frame Number: 12 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb97 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.127 (165.227.249.127) Encapsulating Security Payload SPI: 0xbf2f67e7 Sequence: 2 Data (92 bytes) 0000 00 19 e1 68 8e 01 00 0c 29 ab 06 ab 08 00 45 00 ...h....).....E. 0010 00 78 00 02 00 00 80 32 fb 97 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 7f bf 2f 67 e7 00 00 00 02 b9 a1 d4 35 7a c7 .../g........5z. 0030 62 00 c2 e0 25 f6 a9 bc a5 1b 75 21 5f c9 28 2a b...%.....u!_.(* 0040 6d 03 dc 8a 91 d6 b2 08 98 45 2f 91 ff 74 44 3c m........E/..tD< 0050 b6 4a da 83 f4 3b 48 df c4 08 2b 5d d3 62 ba b5 .J...;H...+].b.. 0060 c2 1c 1f 48 5a a6 da 23 3c 83 c9 0c 50 ff 70 23 ...HZ..#<...P.p# 0070 32 fb 9e f7 3e 9d fe 58 d1 b7 94 5e 4f f8 91 3f 2...>..X...^O..? 0080 f3 93 1f a9 27 ad ....'. Frame 13 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 23, 2007 15:31:19.219612000 Time delta from previous packet: 0.009198000 seconds Time since reference or first frame: 11.541395000 seconds Frame Number: 13 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.127 (165.227.249.127), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x5034 (20532) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 29 Protocol: ESP (0x32) Header checksum: 0x0e66 [correct] Good: True Bad : False Source: 165.227.249.127 (165.227.249.127) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x3e1da1b9 Sequence: 2 Data (92 bytes) 0000 00 0c 29 ab 06 ab 00 19 e1 68 8e 01 08 00 45 00 ..)......h....E. 0010 00 78 50 34 00 00 1d 32 0e 66 a5 e3 f9 7f a5 e3 .xP4...2.f...... 0020 f9 73 3e 1d a1 b9 00 00 00 02 78 9a 25 a7 68 6e .s>.......x.%.hn 0030 ad d9 d6 4c ce d1 3a bb 0c 6e a3 71 0e 5d 41 c1 ...L..:..n.q.]A. 0040 c5 4d 3d ee a9 a3 93 14 cd f6 da e5 42 2d 50 ab .M=.........B-P. 0050 c8 45 4f 40 f6 a8 98 c8 42 e8 bf de d7 eb 67 8f .EO@....B.....g. 0060 a4 c7 7c 52 93 e8 52 f2 a7 f6 90 8b aa 1b 20 72 ..|R..R....... r 0070 d4 f6 f5 3c 41 77 53 06 be 33 79 68 38 27 6e c3 ...