Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Feb 25, 2010 15:19:30.703073000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x01c1 (449) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9d6 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x1f08 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 00 98 01 c1 00 00 80 11 f9 d6 a5 e3 f9 73 a5 e3 .............s.. 0020 f9 82 01 f4 01 f4 00 84 1f 08 56 b2 07 ce 1b 99 ..........V..... 0030 73 61 00 00 00 00 00 00 00 00 01 10 02 00 00 00 sa.............. 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (166 bytes on wire, 166 bytes captured) Arrival Time: Feb 25, 2010 15:19:30.703087000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 0.000014000 seconds] Frame Number: 2 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x01c1 (449) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9d6 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x1f08 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 00 98 01 c1 00 00 80 11 f9 d6 a5 e3 f9 73 a5 e3 .............s.. 0020 f9 82 01 f4 01 f4 00 84 1f 08 56 b2 07 ce 1b 99 ..........V..... 0030 73 61 00 00 00 00 00 00 00 00 01 10 02 00 00 00 sa.............. 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 3 (266 bytes on wire, 266 bytes captured) Arrival Time: Feb 25, 2010 15:19:30.704322000 [Time delta from previous captured frame: 0.001235000 seconds] [Time delta from previous displayed frame: 0.001235000 seconds] [Time since reference or first frame: 0.001249000 seconds] Frame Number: 3 Frame Length: 266 bytes Capture Length: 266 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb33 [correct] [Good: True] [Bad : False] Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 232 Checksum: 0x845c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 224 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: 2376801BEBEC247E330ADFF247AF1C4D Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 2376801BEBEC247E330ADFF247AF1C4D Vendor ID: 4042AC0201642AA275939AF757365C68 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 4042AC0201642AA275939AF757365C68 Vendor ID: 645AF885467F08A68619C60E77BDB605 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 645AF885467F08A68619C60E77BDB605 Vendor ID: BAEB239037E17787D730EED9D95D48AA Next payload: Vendor ID (13) Payload length: 20 Vendor ID: BAEB239037E17787D730EED9D95D48AA Vendor ID: C573B056D7FACA36C2FBA28374127CBF Next payload: Vendor ID (13) Payload length: 20 Vendor ID: C573B056D7FACA36C2FBA28374127CBF Vendor ID: 431CFC9292A0595D7592FEBEA586AD19 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 431CFC9292A0595D7592FEBEA586AD19 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 6d a9 a5 00 0c 29 64 f8 4a 08 00 45 00 ..)m....)d.J..E. 0010 00 fc 00 00 40 00 40 11 fb 33 a5 e3 f9 82 a5 e3 ....@.@..3...... 0020 f9 73 01 f4 01 f4 00 e8 84 5c 56 b2 07 ce 1b 99 .s.......\V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 01 10 02 00 00 00 sa..RG.......... 0040 00 00 00 00 00 e0 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 23 76 80 1b eb ec 24 7e 33 0a df f2 47 af ..#v....$~3...G. 0090 1c 4d 0d 00 00 14 40 42 ac 02 01 64 2a a2 75 93 .M....@B...d*.u. 00a0 9a f7 57 36 5c 68 0d 00 00 14 64 5a f8 85 46 7f ..W6\h....dZ..F. 00b0 08 a6 86 19 c6 0e 77 bd b6 05 0d 00 00 14 ba eb ......w......... 00c0 23 90 37 e1 77 87 d7 30 ee d9 d9 5d 48 aa 0d 00 #.7.w..0...]H... 00d0 00 14 c5 73 b0 56 d7 fa ca 36 c2 fb a2 83 74 12 ...s.V...6....t. 00e0 7c bf 0d 00 00 14 43 1c fc 92 92 a0 59 5d 75 92 |.....C.....Y]u. 00f0 fe be a5 86 ad 19 00 00 00 14 af ca d7 13 68 a1 ..............h. 0100 f1 c9 6b 86 96 fc 77 57 01 00 ..k...wW.. Frame 4 (266 bytes on wire, 266 bytes captured) Arrival Time: Feb 25, 2010 15:19:30.704333000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 0.001260000 seconds] Frame Number: 4 Frame Length: 266 bytes Capture Length: 266 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb33 [correct] [Good: True] [Bad : False] Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 232 Checksum: 0x845c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 224 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: 2376801BEBEC247E330ADFF247AF1C4D Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 2376801BEBEC247E330ADFF247AF1C4D Vendor ID: 4042AC0201642AA275939AF757365C68 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 4042AC0201642AA275939AF757365C68 Vendor ID: 645AF885467F08A68619C60E77BDB605 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 645AF885467F08A68619C60E77BDB605 Vendor ID: BAEB239037E17787D730EED9D95D48AA Next payload: Vendor ID (13) Payload length: 20 Vendor ID: BAEB239037E17787D730EED9D95D48AA Vendor ID: C573B056D7FACA36C2FBA28374127CBF Next payload: Vendor ID (13) Payload length: 20 Vendor ID: C573B056D7FACA36C2FBA28374127CBF Vendor ID: 431CFC9292A0595D7592FEBEA586AD19 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 431CFC9292A0595D7592FEBEA586AD19 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 6d a9 a5 00 0c 29 64 f8 4a 08 00 45 00 ..)m....)d.J..E. 0010 00 fc 00 00 40 00 40 11 fb 33 a5 e3 f9 82 a5 e3 ....@.@..3...... 0020 f9 73 01 f4 01 f4 00 e8 84 5c 56 b2 07 ce 1b 99 .s.......\V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 01 10 02 00 00 00 sa..RG.......... 0040 00 00 00 00 00 e0 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 23 76 80 1b eb ec 24 7e 33 0a df f2 47 af ..#v....$~3...G. 0090 1c 4d 0d 00 00 14 40 42 ac 02 01 64 2a a2 75 93 .M....@B...d*.u. 00a0 9a f7 57 36 5c 68 0d 00 00 14 64 5a f8 85 46 7f ..W6\h....dZ..F. 00b0 08 a6 86 19 c6 0e 77 bd b6 05 0d 00 00 14 ba eb ......w......... 00c0 23 90 37 e1 77 87 d7 30 ee d9 d9 5d 48 aa 0d 00 #.7.w..0...]H... 00d0 00 14 c5 73 b0 56 d7 fa ca 36 c2 fb a2 83 74 12 ...s.V...6....t. 00e0 7c bf 0d 00 00 14 43 1c fc 92 92 a0 59 5d 75 92 |.....C.....Y]u. 00f0 fe be a5 86 ad 19 00 00 00 14 af ca d7 13 68 a1 ..............h. 0100 f1 c9 6b 86 96 fc 77 57 01 00 ..k...wW.. Frame 5 (266 bytes on wire, 266 bytes captured) Arrival Time: Feb 25, 2010 15:19:31.219761000 [Time delta from previous captured frame: 0.515428000 seconds] [Time delta from previous displayed frame: 0.515428000 seconds] [Time since reference or first frame: 0.516688000 seconds] Frame Number: 5 Frame Length: 266 bytes Capture Length: 266 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb33 [correct] [Good: True] [Bad : False] Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 232 Checksum: 0x845c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 224 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: 2376801BEBEC247E330ADFF247AF1C4D Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 2376801BEBEC247E330ADFF247AF1C4D Vendor ID: 4042AC0201642AA275939AF757365C68 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 4042AC0201642AA275939AF757365C68 Vendor ID: 645AF885467F08A68619C60E77BDB605 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 645AF885467F08A68619C60E77BDB605 Vendor ID: BAEB239037E17787D730EED9D95D48AA Next payload: Vendor ID (13) Payload length: 20 Vendor ID: BAEB239037E17787D730EED9D95D48AA Vendor ID: C573B056D7FACA36C2FBA28374127CBF Next payload: Vendor ID (13) Payload length: 20 Vendor ID: C573B056D7FACA36C2FBA28374127CBF Vendor ID: 431CFC9292A0595D7592FEBEA586AD19 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 431CFC9292A0595D7592FEBEA586AD19 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 6d a9 a5 00 0c 29 64 f8 4a 08 00 45 00 ..)m....)d.J..E. 0010 00 fc 00 00 40 00 40 11 fb 33 a5 e3 f9 82 a5 e3 ....@.@..3...... 0020 f9 73 01 f4 01 f4 00 e8 84 5c 56 b2 07 ce 1b 99 .s.......\V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 01 10 02 00 00 00 sa..RG.......... 0040 00 00 00 00 00 e0 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 23 76 80 1b eb ec 24 7e 33 0a df f2 47 af ..#v....$~3...G. 0090 1c 4d 0d 00 00 14 40 42 ac 02 01 64 2a a2 75 93 .M....@B...d*.u. 00a0 9a f7 57 36 5c 68 0d 00 00 14 64 5a f8 85 46 7f ..W6\h....dZ..F. 00b0 08 a6 86 19 c6 0e 77 bd b6 05 0d 00 00 14 ba eb ......w......... 00c0 23 90 37 e1 77 87 d7 30 ee d9 d9 5d 48 aa 0d 00 #.7.w..0...]H... 00d0 00 14 c5 73 b0 56 d7 fa ca 36 c2 fb a2 83 74 12 ...s.V...6....t. 00e0 7c bf 0d 00 00 14 43 1c fc 92 92 a0 59 5d 75 92 |.....C.....Y]u. 00f0 fe be a5 86 ad 19 00 00 00 14 af ca d7 13 68 a1 ..............h. 0100 f1 c9 6b 86 96 fc 77 57 01 00 ..k...wW.. Frame 6 (266 bytes on wire, 266 bytes captured) Arrival Time: Feb 25, 2010 15:19:31.219775000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 0.516702000 seconds] Frame Number: 6 Frame Length: 266 bytes Capture Length: 266 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb33 [correct] [Good: True] [Bad : False] Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 232 Checksum: 0x845c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 224 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: 2376801BEBEC247E330ADFF247AF1C4D Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 2376801BEBEC247E330ADFF247AF1C4D Vendor ID: 4042AC0201642AA275939AF757365C68 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 4042AC0201642AA275939AF757365C68 Vendor ID: 645AF885467F08A68619C60E77BDB605 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 645AF885467F08A68619C60E77BDB605 Vendor ID: BAEB239037E17787D730EED9D95D48AA Next payload: Vendor ID (13) Payload length: 20 Vendor ID: BAEB239037E17787D730EED9D95D48AA Vendor ID: C573B056D7FACA36C2FBA28374127CBF Next payload: Vendor ID (13) Payload length: 20 Vendor ID: C573B056D7FACA36C2FBA28374127CBF Vendor ID: 431CFC9292A0595D7592FEBEA586AD19 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 431CFC9292A0595D7592FEBEA586AD19 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 6d a9 a5 00 0c 29 64 f8 4a 08 00 45 00 ..)m....)d.J..E. 0010 00 fc 00 00 40 00 40 11 fb 33 a5 e3 f9 82 a5 e3 ....@.@..3...... 0020 f9 73 01 f4 01 f4 00 e8 84 5c 56 b2 07 ce 1b 99 .s.......\V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 01 10 02 00 00 00 sa..RG.......... 0040 00 00 00 00 00 e0 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 23 76 80 1b eb ec 24 7e 33 0a df f2 47 af ..#v....$~3...G. 0090 1c 4d 0d 00 00 14 40 42 ac 02 01 64 2a a2 75 93 .M....@B...d*.u. 00a0 9a f7 57 36 5c 68 0d 00 00 14 64 5a f8 85 46 7f ..W6\h....dZ..F. 00b0 08 a6 86 19 c6 0e 77 bd b6 05 0d 00 00 14 ba eb ......w......... 00c0 23 90 37 e1 77 87 d7 30 ee d9 d9 5d 48 aa 0d 00 #.7.w..0...]H... 00d0 00 14 c5 73 b0 56 d7 fa ca 36 c2 fb a2 83 74 12 ...s.V...6....t. 00e0 7c bf 0d 00 00 14 43 1c fc 92 92 a0 59 5d 75 92 |.....C.....Y]u. 00f0 fe be a5 86 ad 19 00 00 00 14 af ca d7 13 68 a1 ..............h. 0100 f1 c9 6b 86 96 fc 77 57 01 00 ..k...wW.. Frame 7 (266 bytes on wire, 266 bytes captured) Arrival Time: Feb 25, 2010 15:19:32.229186000 [Time delta from previous captured frame: 1.009411000 seconds] [Time delta from previous displayed frame: 1.009411000 seconds] [Time since reference or first frame: 1.526113000 seconds] Frame Number: 7 Frame Length: 266 bytes Capture Length: 266 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb33 [correct] [Good: True] [Bad : False] Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 232 Checksum: 0x845c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 224 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: 2376801BEBEC247E330ADFF247AF1C4D Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 2376801BEBEC247E330ADFF247AF1C4D Vendor ID: 4042AC0201642AA275939AF757365C68 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 4042AC0201642AA275939AF757365C68 Vendor ID: 645AF885467F08A68619C60E77BDB605 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 645AF885467F08A68619C60E77BDB605 Vendor ID: BAEB239037E17787D730EED9D95D48AA Next payload: Vendor ID (13) Payload length: 20 Vendor ID: BAEB239037E17787D730EED9D95D48AA Vendor ID: C573B056D7FACA36C2FBA28374127CBF Next payload: Vendor ID (13) Payload length: 20 Vendor ID: C573B056D7FACA36C2FBA28374127CBF Vendor ID: 431CFC9292A0595D7592FEBEA586AD19 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 431CFC9292A0595D7592FEBEA586AD19 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 6d a9 a5 00 0c 29 64 f8 4a 08 00 45 00 ..)m....)d.J..E. 0010 00 fc 00 00 40 00 40 11 fb 33 a5 e3 f9 82 a5 e3 ....@.@..3...... 0020 f9 73 01 f4 01 f4 00 e8 84 5c 56 b2 07 ce 1b 99 .s.......\V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 01 10 02 00 00 00 sa..RG.......... 0040 00 00 00 00 00 e0 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 23 76 80 1b eb ec 24 7e 33 0a df f2 47 af ..#v....$~3...G. 0090 1c 4d 0d 00 00 14 40 42 ac 02 01 64 2a a2 75 93 .M....@B...d*.u. 00a0 9a f7 57 36 5c 68 0d 00 00 14 64 5a f8 85 46 7f ..W6\h....dZ..F. 00b0 08 a6 86 19 c6 0e 77 bd b6 05 0d 00 00 14 ba eb ......w......... 00c0 23 90 37 e1 77 87 d7 30 ee d9 d9 5d 48 aa 0d 00 #.7.w..0...]H... 00d0 00 14 c5 73 b0 56 d7 fa ca 36 c2 fb a2 83 74 12 ...s.V...6....t. 00e0 7c bf 0d 00 00 14 43 1c fc 92 92 a0 59 5d 75 92 |.....C.....Y]u. 00f0 fe be a5 86 ad 19 00 00 00 14 af ca d7 13 68 a1 ..............h. 0100 f1 c9 6b 86 96 fc 77 57 01 00 ..k...wW.. Frame 8 (266 bytes on wire, 266 bytes captured) Arrival Time: Feb 25, 2010 15:19:32.229202000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 1.526129000 seconds] Frame Number: 8 Frame Length: 266 bytes Capture Length: 266 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb33 [correct] [Good: True] [Bad : False] Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 232 Checksum: 0x845c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 224 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: 2376801BEBEC247E330ADFF247AF1C4D Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 2376801BEBEC247E330ADFF247AF1C4D Vendor ID: 4042AC0201642AA275939AF757365C68 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 4042AC0201642AA275939AF757365C68 Vendor ID: 645AF885467F08A68619C60E77BDB605 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 645AF885467F08A68619C60E77BDB605 Vendor ID: BAEB239037E17787D730EED9D95D48AA Next payload: Vendor ID (13) Payload length: 20 Vendor ID: BAEB239037E17787D730EED9D95D48AA Vendor ID: C573B056D7FACA36C2FBA28374127CBF Next payload: Vendor ID (13) Payload length: 20 Vendor ID: C573B056D7FACA36C2FBA28374127CBF Vendor ID: 431CFC9292A0595D7592FEBEA586AD19 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 431CFC9292A0595D7592FEBEA586AD19 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 6d a9 a5 00 0c 29 64 f8 4a 08 00 45 00 ..)m....)d.J..E. 0010 00 fc 00 00 40 00 40 11 fb 33 a5 e3 f9 82 a5 e3 ....@.@..3...... 0020 f9 73 01 f4 01 f4 00 e8 84 5c 56 b2 07 ce 1b 99 .s.......\V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 01 10 02 00 00 00 sa..RG.......... 0040 00 00 00 00 00 e0 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 23 76 80 1b eb ec 24 7e 33 0a df f2 47 af ..#v....$~3...G. 0090 1c 4d 0d 00 00 14 40 42 ac 02 01 64 2a a2 75 93 .M....@B...d*.u. 00a0 9a f7 57 36 5c 68 0d 00 00 14 64 5a f8 85 46 7f ..W6\h....dZ..F. 00b0 08 a6 86 19 c6 0e 77 bd b6 05 0d 00 00 14 ba eb ......w......... 00c0 23 90 37 e1 77 87 d7 30 ee d9 d9 5d 48 aa 0d 00 #.7.w..0...]H... 00d0 00 14 c5 73 b0 56 d7 fa ca 36 c2 fb a2 83 74 12 ...s.V...6....t. 00e0 7c bf 0d 00 00 14 43 1c fc 92 92 a0 59 5d 75 92 |.....C.....Y]u. 00f0 fe be a5 86 ad 19 00 00 00 14 af ca d7 13 68 a1 ..............h. 0100 f1 c9 6b 86 96 fc 77 57 01 00 ..k...wW.. Frame 9 (298 bytes on wire, 298 bytes captured) Arrival Time: Feb 25, 2010 15:19:32.517924000 [Time delta from previous captured frame: 0.288722000 seconds] [Time delta from previous displayed frame: 0.288722000 seconds] [Time since reference or first frame: 1.814851000 seconds] Frame Number: 9 Frame Length: 298 bytes Capture Length: 298 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x01c4 (452) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf94f [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xbd00 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 01 1c 01 c4 00 00 80 11 f9 4f a5 e3 f9 73 a5 e3 .........O...s.. 0020 f9 82 01 f4 01 f4 01 08 bd 00 56 b2 07 ce 1b 99 ..........V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 04 10 02 00 00 00 sa..RG.......... 0040 00 00 00 00 01 00 0a 00 00 84 2a 25 9b 88 a6 49 ..........*%...I 0050 42 ac 01 cd 27 eb d1 ae 79 1e 3e 1a b8 17 44 d1 B...'...y.>...D. 0060 70 84 49 a3 10 cb 3f 9c c1 11 9d f2 9b f9 40 de p.I...?.......@. 0070 5b b1 0b b3 b7 85 6c c9 d4 c2 0d 44 74 32 b4 15 [.....l....Dt2.. 0080 9b e4 a9 8f d1 fa 6b 52 de 58 41 93 34 5d 73 48 ......kR.XA.4]sH 0090 24 71 4e ba 6b 08 2d ee 19 df 77 b0 2f e5 aa 82 $qN.k.-...w./... 00a0 e6 48 02 d6 e7 eb e4 bb 8d 89 5e c5 43 48 af 56 .H........^.CH.V 00b0 d2 d4 a7 36 a0 68 2e c4 81 4d 32 a0 59 7e c6 da ...6.h...M2.Y~.. 00c0 85 f7 5c 6e 87 ac 7a 21 fe 38 0d 00 00 18 32 0d ..\n..z!.8....2. 00d0 79 5c ed 9c 91 51 5c 4a 67 60 80 b7 b6 bb 5c 79 y\...Q\Jg`....\y 00e0 0f a4 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 10 (298 bytes on wire, 298 bytes captured) Arrival Time: Feb 25, 2010 15:19:32.517940000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 1.814867000 seconds] Frame Number: 10 Frame Length: 298 bytes Capture Length: 298 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x01c4 (452) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf94f [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xbd00 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 01 1c 01 c4 00 00 80 11 f9 4f a5 e3 f9 73 a5 e3 .........O...s.. 0020 f9 82 01 f4 01 f4 01 08 bd 00 56 b2 07 ce 1b 99 ..........V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 04 10 02 00 00 00 sa..RG.......... 0040 00 00 00 00 01 00 0a 00 00 84 2a 25 9b 88 a6 49 ..........*%...I 0050 42 ac 01 cd 27 eb d1 ae 79 1e 3e 1a b8 17 44 d1 B...'...y.>...D. 0060 70 84 49 a3 10 cb 3f 9c c1 11 9d f2 9b f9 40 de p.I...?.......@. 0070 5b b1 0b b3 b7 85 6c c9 d4 c2 0d 44 74 32 b4 15 [.....l....Dt2.. 0080 9b e4 a9 8f d1 fa 6b 52 de 58 41 93 34 5d 73 48 ......kR.XA.4]sH 0090 24 71 4e ba 6b 08 2d ee 19 df 77 b0 2f e5 aa 82 $qN.k.-...w./... 00a0 e6 48 02 d6 e7 eb e4 bb 8d 89 5e c5 43 48 af 56 .H........^.CH.V 00b0 d2 d4 a7 36 a0 68 2e c4 81 4d 32 a0 59 7e c6 da ...6.h...M2.Y~.. 00c0 85 f7 5c 6e 87 ac 7a 21 fe 38 0d 00 00 18 32 0d ..\n..z!.8....2. 00d0 79 5c ed 9c 91 51 5c 4a 67 60 80 b7 b6 bb 5c 79 y\...Q\Jg`....\y 00e0 0f a4 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 11 (298 bytes on wire, 298 bytes captured) Arrival Time: Feb 25, 2010 15:19:32.520278000 [Time delta from previous captured frame: 0.002338000 seconds] [Time delta from previous displayed frame: 0.002338000 seconds] [Time since reference or first frame: 1.817205000 seconds] Frame Number: 11 Frame Length: 298 bytes Capture Length: 298 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x01c7 (455) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf94c [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xbd00 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 01 1c 01 c7 00 00 80 11 f9 4c a5 e3 f9 73 a5 e3 .........L...s.. 0020 f9 82 01 f4 01 f4 01 08 bd 00 56 b2 07 ce 1b 99 ..........V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 04 10 02 00 00 00 sa..RG.......... 0040 00 00 00 00 01 00 0a 00 00 84 2a 25 9b 88 a6 49 ..........*%...I 0050 42 ac 01 cd 27 eb d1 ae 79 1e 3e 1a b8 17 44 d1 B...'...y.>...D. 0060 70 84 49 a3 10 cb 3f 9c c1 11 9d f2 9b f9 40 de p.I...?.......@. 0070 5b b1 0b b3 b7 85 6c c9 d4 c2 0d 44 74 32 b4 15 [.....l....Dt2.. 0080 9b e4 a9 8f d1 fa 6b 52 de 58 41 93 34 5d 73 48 ......kR.XA.4]sH 0090 24 71 4e ba 6b 08 2d ee 19 df 77 b0 2f e5 aa 82 $qN.k.-...w./... 00a0 e6 48 02 d6 e7 eb e4 bb 8d 89 5e c5 43 48 af 56 .H........^.CH.V 00b0 d2 d4 a7 36 a0 68 2e c4 81 4d 32 a0 59 7e c6 da ...6.h...M2.Y~.. 00c0 85 f7 5c 6e 87 ac 7a 21 fe 38 0d 00 00 18 32 0d ..\n..z!.8....2. 00d0 79 5c ed 9c 91 51 5c 4a 67 60 80 b7 b6 bb 5c 79 y\...Q\Jg`....\y 00e0 0f a4 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 12 (298 bytes on wire, 298 bytes captured) Arrival Time: Feb 25, 2010 15:19:32.520288000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 1.817215000 seconds] Frame Number: 12 Frame Length: 298 bytes Capture Length: 298 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x01c7 (455) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf94c [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xbd00 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 01 1c 01 c7 00 00 80 11 f9 4c a5 e3 f9 73 a5 e3 .........L...s.. 0020 f9 82 01 f4 01 f4 01 08 bd 00 56 b2 07 ce 1b 99 ..........V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 04 10 02 00 00 00 sa..RG.......... 0040 00 00 00 00 01 00 0a 00 00 84 2a 25 9b 88 a6 49 ..........*%...I 0050 42 ac 01 cd 27 eb d1 ae 79 1e 3e 1a b8 17 44 d1 B...'...y.>...D. 0060 70 84 49 a3 10 cb 3f 9c c1 11 9d f2 9b f9 40 de p.I...?.......@. 0070 5b b1 0b b3 b7 85 6c c9 d4 c2 0d 44 74 32 b4 15 [.....l....Dt2.. 0080 9b e4 a9 8f d1 fa 6b 52 de 58 41 93 34 5d 73 48 ......kR.XA.4]sH 0090 24 71 4e ba 6b 08 2d ee 19 df 77 b0 2f e5 aa 82 $qN.k.-...w./... 00a0 e6 48 02 d6 e7 eb e4 bb 8d 89 5e c5 43 48 af 56 .H........^.CH.V 00b0 d2 d4 a7 36 a0 68 2e c4 81 4d 32 a0 59 7e c6 da ...6.h...M2.Y~.. 00c0 85 f7 5c 6e 87 ac 7a 21 fe 38 0d 00 00 18 32 0d ..\n..z!.8....2. 00d0 79 5c ed 9c 91 51 5c 4a 67 60 80 b7 b6 bb 5c 79 y\...Q\Jg`....\y 00e0 0f a4 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 13 (298 bytes on wire, 298 bytes captured) Arrival Time: Feb 25, 2010 15:19:32.521119000 [Time delta from previous captured frame: 0.000831000 seconds] [Time delta from previous displayed frame: 0.000831000 seconds] [Time since reference or first frame: 1.818046000 seconds] Frame Number: 13 Frame Length: 298 bytes Capture Length: 298 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x01ca (458) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf949 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xbd00 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 01 1c 01 ca 00 00 80 11 f9 49 a5 e3 f9 73 a5 e3 .........I...s.. 0020 f9 82 01 f4 01 f4 01 08 bd 00 56 b2 07 ce 1b 99 ..........V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 04 10 02 00 00 00 sa..RG.......... 0040 00 00 00 00 01 00 0a 00 00 84 2a 25 9b 88 a6 49 ..........*%...I 0050 42 ac 01 cd 27 eb d1 ae 79 1e 3e 1a b8 17 44 d1 B...'...y.>...D. 0060 70 84 49 a3 10 cb 3f 9c c1 11 9d f2 9b f9 40 de p.I...?.......@. 0070 5b b1 0b b3 b7 85 6c c9 d4 c2 0d 44 74 32 b4 15 [.....l....Dt2.. 0080 9b e4 a9 8f d1 fa 6b 52 de 58 41 93 34 5d 73 48 ......kR.XA.4]sH 0090 24 71 4e ba 6b 08 2d ee 19 df 77 b0 2f e5 aa 82 $qN.k.-...w./... 00a0 e6 48 02 d6 e7 eb e4 bb 8d 89 5e c5 43 48 af 56 .H........^.CH.V 00b0 d2 d4 a7 36 a0 68 2e c4 81 4d 32 a0 59 7e c6 da ...6.h...M2.Y~.. 00c0 85 f7 5c 6e 87 ac 7a 21 fe 38 0d 00 00 18 32 0d ..\n..z!.8....2. 00d0 79 5c ed 9c 91 51 5c 4a 67 60 80 b7 b6 bb 5c 79 y\...Q\Jg`....\y 00e0 0f a4 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 14 (298 bytes on wire, 298 bytes captured) Arrival Time: Feb 25, 2010 15:19:32.521129000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 1.818056000 seconds] Frame Number: 14 Frame Length: 298 bytes Capture Length: 298 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x01ca (458) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf949 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xbd00 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 01 1c 01 ca 00 00 80 11 f9 49 a5 e3 f9 73 a5 e3 .........I...s.. 0020 f9 82 01 f4 01 f4 01 08 bd 00 56 b2 07 ce 1b 99 ..........V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 04 10 02 00 00 00 sa..RG.......... 0040 00 00 00 00 01 00 0a 00 00 84 2a 25 9b 88 a6 49 ..........*%...I 0050 42 ac 01 cd 27 eb d1 ae 79 1e 3e 1a b8 17 44 d1 B...'...y.>...D. 0060 70 84 49 a3 10 cb 3f 9c c1 11 9d f2 9b f9 40 de p.I...?.......@. 0070 5b b1 0b b3 b7 85 6c c9 d4 c2 0d 44 74 32 b4 15 [.....l....Dt2.. 0080 9b e4 a9 8f d1 fa 6b 52 de 58 41 93 34 5d 73 48 ......kR.XA.4]sH 0090 24 71 4e ba 6b 08 2d ee 19 df 77 b0 2f e5 aa 82 $qN.k.-...w./... 00a0 e6 48 02 d6 e7 eb e4 bb 8d 89 5e c5 43 48 af 56 .H........^.CH.V 00b0 d2 d4 a7 36 a0 68 2e c4 81 4d 32 a0 59 7e c6 da ...6.h...M2.Y~.. 00c0 85 f7 5c 6e 87 ac 7a 21 fe 38 0d 00 00 18 32 0d ..\n..z!.8....2. 00d0 79 5c ed 9c 91 51 5c 4a 67 60 80 b7 b6 bb 5c 79 y\...Q\Jg`....\y 00e0 0f a4 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 15 (222 bytes on wire, 222 bytes captured) Arrival Time: Feb 25, 2010 15:19:32.526606000 [Time delta from previous captured frame: 0.005477000 seconds] [Time delta from previous displayed frame: 0.005477000 seconds] [Time since reference or first frame: 1.823533000 seconds] Frame Number: 15 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb5f [correct] [Good: True] [Bad : False] Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x81d0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 0c 29 6d a9 a5 00 0c 29 64 f8 4a 08 00 45 00 ..)m....)d.J..E. 0010 00 d0 00 00 40 00 40 11 fb 5f a5 e3 f9 82 a5 e3 ....@.@.._...... 0020 f9 73 01 f4 01 f4 00 bc 81 d0 56 b2 07 ce 1b 99 .s........V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 04 10 02 00 00 00 sa..RG.......... 0040 00 00 00 00 00 b4 0a 00 00 84 a8 a3 45 53 50 0c ............ESP. 0050 a5 9b e7 ab c2 d6 db 82 23 e3 33 00 ab ef 99 e6 ........#.3..... 0060 f1 72 95 a6 09 00 30 64 10 d0 4d 36 7f 6d f1 1f .r....0d..M6.m.. 0070 ea 97 ea 41 f6 56 14 1c 6b 47 32 57 66 f7 b6 ba ...A.V..kG2Wf... 0080 90 6c 8c 4a 17 c0 ee 45 21 b3 10 b3 1a 4d 2e 03 .l.J...E!....M.. 0090 10 be 25 1f 72 33 e9 13 41 17 9e 9c a0 66 02 16 ..%.r3..A....f.. 00a0 40 f4 31 e5 16 e6 d3 77 62 50 f3 39 61 8e be d0 @.1....wbP.9a... 00b0 47 c8 a3 bb 39 ad 50 cb 3d aa de 51 ba b4 94 7c G...9.P.=..Q...| 00c0 11 b3 0e d5 f4 41 b3 32 ca 31 00 00 00 14 ae 78 .....A.2.1.....x 00d0 9e af d3 c4 dc 05 0c c7 07 51 3a 04 d0 66 .........Q:..f Frame 16 (222 bytes on wire, 222 bytes captured) Arrival Time: Feb 25, 2010 15:19:32.526620000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 1.823547000 seconds] Frame Number: 16 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb5f [correct] [Good: True] [Bad : False] Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x81d0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 0c 29 6d a9 a5 00 0c 29 64 f8 4a 08 00 45 00 ..)m....)d.J..E. 0010 00 d0 00 00 40 00 40 11 fb 5f a5 e3 f9 82 a5 e3 ....@.@.._...... 0020 f9 73 01 f4 01 f4 00 bc 81 d0 56 b2 07 ce 1b 99 .s........V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 04 10 02 00 00 00 sa..RG.......... 0040 00 00 00 00 00 b4 0a 00 00 84 a8 a3 45 53 50 0c ............ESP. 0050 a5 9b e7 ab c2 d6 db 82 23 e3 33 00 ab ef 99 e6 ........#.3..... 0060 f1 72 95 a6 09 00 30 64 10 d0 4d 36 7f 6d f1 1f .r....0d..M6.m.. 0070 ea 97 ea 41 f6 56 14 1c 6b 47 32 57 66 f7 b6 ba ...A.V..kG2Wf... 0080 90 6c 8c 4a 17 c0 ee 45 21 b3 10 b3 1a 4d 2e 03 .l.J...E!....M.. 0090 10 be 25 1f 72 33 e9 13 41 17 9e 9c a0 66 02 16 ..%.r3..A....f.. 00a0 40 f4 31 e5 16 e6 d3 77 62 50 f3 39 61 8e be d0 @.1....wbP.9a... 00b0 47 c8 a3 bb 39 ad 50 cb 3d aa de 51 ba b4 94 7c G...9.P.=..Q...| 00c0 11 b3 0e d5 f4 41 b3 32 ca 31 00 00 00 14 ae 78 .....A.2.1.....x 00d0 9e af d3 c4 dc 05 0c c7 07 51 3a 04 d0 66 .........Q:..f Frame 17 (222 bytes on wire, 222 bytes captured) Arrival Time: Feb 25, 2010 15:19:33.029681000 [Time delta from previous captured frame: 0.503061000 seconds] [Time delta from previous displayed frame: 0.503061000 seconds] [Time since reference or first frame: 2.326608000 seconds] Frame Number: 17 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb5f [correct] [Good: True] [Bad : False] Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x81d0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 0c 29 6d a9 a5 00 0c 29 64 f8 4a 08 00 45 00 ..)m....)d.J..E. 0010 00 d0 00 00 40 00 40 11 fb 5f a5 e3 f9 82 a5 e3 ....@.@.._...... 0020 f9 73 01 f4 01 f4 00 bc 81 d0 56 b2 07 ce 1b 99 .s........V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 04 10 02 00 00 00 sa..RG.......... 0040 00 00 00 00 00 b4 0a 00 00 84 a8 a3 45 53 50 0c ............ESP. 0050 a5 9b e7 ab c2 d6 db 82 23 e3 33 00 ab ef 99 e6 ........#.3..... 0060 f1 72 95 a6 09 00 30 64 10 d0 4d 36 7f 6d f1 1f .r....0d..M6.m.. 0070 ea 97 ea 41 f6 56 14 1c 6b 47 32 57 66 f7 b6 ba ...A.V..kG2Wf... 0080 90 6c 8c 4a 17 c0 ee 45 21 b3 10 b3 1a 4d 2e 03 .l.J...E!....M.. 0090 10 be 25 1f 72 33 e9 13 41 17 9e 9c a0 66 02 16 ..%.r3..A....f.. 00a0 40 f4 31 e5 16 e6 d3 77 62 50 f3 39 61 8e be d0 @.1....wbP.9a... 00b0 47 c8 a3 bb 39 ad 50 cb 3d aa de 51 ba b4 94 7c G...9.P.=..Q...| 00c0 11 b3 0e d5 f4 41 b3 32 ca 31 00 00 00 14 ae 78 .....A.2.1.....x 00d0 9e af d3 c4 dc 05 0c c7 07 51 3a 04 d0 66 .........Q:..f Frame 18 (222 bytes on wire, 222 bytes captured) Arrival Time: Feb 25, 2010 15:19:33.029699000 [Time delta from previous captured frame: 0.000018000 seconds] [Time delta from previous displayed frame: 0.000018000 seconds] [Time since reference or first frame: 2.326626000 seconds] Frame Number: 18 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb5f [correct] [Good: True] [Bad : False] Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x81d0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 0c 29 6d a9 a5 00 0c 29 64 f8 4a 08 00 45 00 ..)m....)d.J..E. 0010 00 d0 00 00 40 00 40 11 fb 5f a5 e3 f9 82 a5 e3 ....@.@.._...... 0020 f9 73 01 f4 01 f4 00 bc 81 d0 56 b2 07 ce 1b 99 .s........V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 04 10 02 00 00 00 sa..RG.......... 0040 00 00 00 00 00 b4 0a 00 00 84 a8 a3 45 53 50 0c ............ESP. 0050 a5 9b e7 ab c2 d6 db 82 23 e3 33 00 ab ef 99 e6 ........#.3..... 0060 f1 72 95 a6 09 00 30 64 10 d0 4d 36 7f 6d f1 1f .r....0d..M6.m.. 0070 ea 97 ea 41 f6 56 14 1c 6b 47 32 57 66 f7 b6 ba ...A.V..kG2Wf... 0080 90 6c 8c 4a 17 c0 ee 45 21 b3 10 b3 1a 4d 2e 03 .l.J...E!....M.. 0090 10 be 25 1f 72 33 e9 13 41 17 9e 9c a0 66 02 16 ..%.r3..A....f.. 00a0 40 f4 31 e5 16 e6 d3 77 62 50 f3 39 61 8e be d0 @.1....wbP.9a... 00b0 47 c8 a3 bb 39 ad 50 cb 3d aa de 51 ba b4 94 7c G...9.P.=..Q...| 00c0 11 b3 0e d5 f4 41 b3 32 ca 31 00 00 00 14 ae 78 .....A.2.1.....x 00d0 9e af d3 c4 dc 05 0c c7 07 51 3a 04 d0 66 .........Q:..f Frame 19 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 25, 2010 15:19:33.503421000 [Time delta from previous captured frame: 0.473722000 seconds] [Time delta from previous displayed frame: 0.473722000 seconds] [Time since reference or first frame: 2.800348000 seconds] Frame Number: 19 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x01ce (462) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9e9 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x44f2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 00 78 01 ce 00 00 80 11 f9 e9 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 82 01 f4 01 f4 00 64 44 f2 56 b2 07 ce 1b 99 .......dD.V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 05 10 02 01 00 00 sa..RG.......... 0040 00 00 00 00 00 5c ff 36 85 5f ae 0e 43 c9 48 f0 .....\.6._..C.H. 0050 75 79 84 37 8b ac f1 49 cc 8a 55 3b 15 ae f2 8c uy.7...I..U;.... 0060 50 74 b8 ac 81 24 35 95 cb 13 0d 5c db ba b1 1d Pt...$5....\.... 0070 d0 ae 45 84 31 09 0e 00 91 b5 01 ed b5 67 a7 74 ..E.1........g.t 0080 72 75 d4 2f 78 b7 ru./x. Frame 20 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 25, 2010 15:19:33.503437000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 2.800364000 seconds] Frame Number: 20 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x01ce (462) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9e9 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x44f2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 00 78 01 ce 00 00 80 11 f9 e9 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 82 01 f4 01 f4 00 64 44 f2 56 b2 07 ce 1b 99 .......dD.V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 05 10 02 01 00 00 sa..RG.......... 0040 00 00 00 00 00 5c ff 36 85 5f ae 0e 43 c9 48 f0 .....\.6._..C.H. 0050 75 79 84 37 8b ac f1 49 cc 8a 55 3b 15 ae f2 8c uy.7...I..U;.... 0060 50 74 b8 ac 81 24 35 95 cb 13 0d 5c db ba b1 1d Pt...$5....\.... 0070 d0 ae 45 84 31 09 0e 00 91 b5 01 ed b5 67 a7 74 ..E.1........g.t 0080 72 75 d4 2f 78 b7 ru./x. Frame 21 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 25, 2010 15:19:33.503714000 [Time delta from previous captured frame: 0.000277000 seconds] [Time delta from previous displayed frame: 0.000277000 seconds] [Time since reference or first frame: 2.800641000 seconds] Frame Number: 21 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x01d0 (464) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9e7 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x44f2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 00 78 01 d0 00 00 80 11 f9 e7 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 82 01 f4 01 f4 00 64 44 f2 56 b2 07 ce 1b 99 .......dD.V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 05 10 02 01 00 00 sa..RG.......... 0040 00 00 00 00 00 5c ff 36 85 5f ae 0e 43 c9 48 f0 .....\.6._..C.H. 0050 75 79 84 37 8b ac f1 49 cc 8a 55 3b 15 ae f2 8c uy.7...I..U;.... 0060 50 74 b8 ac 81 24 35 95 cb 13 0d 5c db ba b1 1d Pt...$5....\.... 0070 d0 ae 45 84 31 09 0e 00 91 b5 01 ed b5 67 a7 74 ..E.1........g.t 0080 72 75 d4 2f 78 b7 ru./x. Frame 22 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 25, 2010 15:19:33.503725000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 2.800652000 seconds] Frame Number: 22 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x01d0 (464) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9e7 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x44f2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 00 78 01 d0 00 00 80 11 f9 e7 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 82 01 f4 01 f4 00 64 44 f2 56 b2 07 ce 1b 99 .......dD.V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 05 10 02 01 00 00 sa..RG.......... 0040 00 00 00 00 00 5c ff 36 85 5f ae 0e 43 c9 48 f0 .....\.6._..C.H. 0050 75 79 84 37 8b ac f1 49 cc 8a 55 3b 15 ae f2 8c uy.7...I..U;.... 0060 50 74 b8 ac 81 24 35 95 cb 13 0d 5c db ba b1 1d Pt...$5....\.... 0070 d0 ae 45 84 31 09 0e 00 91 b5 01 ed b5 67 a7 74 ..E.1........g.t 0080 72 75 d4 2f 78 b7 ru./x. Frame 23 (118 bytes on wire, 118 bytes captured) Arrival Time: Feb 25, 2010 15:19:33.504941000 [Time delta from previous captured frame: 0.001216000 seconds] [Time delta from previous displayed frame: 0.001216000 seconds] [Time since reference or first frame: 2.801868000 seconds] Frame Number: 23 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc7 [correct] [Good: True] [Bad : False] Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x6b37 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 6d a9 a5 00 0c 29 64 f8 4a 08 00 45 00 ..)m....)d.J..E. 0010 00 68 00 00 40 00 40 11 fb c7 a5 e3 f9 82 a5 e3 .h..@.@......... 0020 f9 73 01 f4 01 f4 00 54 6b 37 56 b2 07 ce 1b 99 .s.....Tk7V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 05 10 02 01 00 00 sa..RG.......... 0040 00 00 00 00 00 4c 76 f1 4e 2a 45 ca bd 59 22 09 .....Lv.N*E..Y". 0050 f1 ff de 2b 52 37 1d 68 22 e0 fe e6 ad 5a d1 b7 ...+R7.h"....Z.. 0060 a1 dd cf 3a 8c db c2 87 e8 b3 d7 bc 69 39 bf e6 ...:........i9.. 0070 60 22 69 bf 25 51 `"i.%Q Frame 24 (118 bytes on wire, 118 bytes captured) Arrival Time: Feb 25, 2010 15:19:33.504955000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 2.801882000 seconds] Frame Number: 24 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc7 [correct] [Good: True] [Bad : False] Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x6b37 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 6d a9 a5 00 0c 29 64 f8 4a 08 00 45 00 ..)m....)d.J..E. 0010 00 68 00 00 40 00 40 11 fb c7 a5 e3 f9 82 a5 e3 .h..@.@......... 0020 f9 73 01 f4 01 f4 00 54 6b 37 56 b2 07 ce 1b 99 .s.....Tk7V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 05 10 02 01 00 00 sa..RG.......... 0040 00 00 00 00 00 4c 76 f1 4e 2a 45 ca bd 59 22 09 .....Lv.N*E..Y". 0050 f1 ff de 2b 52 37 1d 68 22 e0 fe e6 ad 5a d1 b7 ...+R7.h"....Z.. 0060 a1 dd cf 3a 8c db c2 87 e8 b3 d7 bc 69 39 bf e6 ...:........i9.. 0070 60 22 69 bf 25 51 `"i.%Q Frame 25 (342 bytes on wire, 342 bytes captured) Arrival Time: Feb 25, 2010 15:19:35.531824000 [Time delta from previous captured frame: 2.026869000 seconds] [Time delta from previous displayed frame: 2.026869000 seconds] [Time since reference or first frame: 4.828751000 seconds] Frame Number: 25 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x01da (474) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf90d [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x5691 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x25d306aa Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 01 48 01 da 00 00 80 11 f9 0d a5 e3 f9 73 a5 e3 .H...........s.. 0020 f9 82 01 f4 01 f4 01 34 56 91 56 b2 07 ce 1b 99 .......4V.V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 08 10 20 01 25 d3 sa..RG...... .%. 0040 06 aa 00 00 01 2c ec dd 8c c8 ec 26 99 55 61 8a .....,.....&.Ua. 0050 53 2a 89 cf 81 c7 46 03 fb b7 fe 2d b3 cf 33 e1 S*....F....-..3. 0060 3b f0 27 4e 2b 74 ef ec ca dc dc 95 6c 0d bf 04 ;.'N+t......l... 0070 75 13 97 04 5f fb 95 ff 17 b6 d6 27 e5 b3 3a 43 u..._......'..:C 0080 af fc 72 e1 8f 05 47 38 18 c9 26 46 85 83 89 9b ..r...G8..&F.... 0090 e0 05 17 b3 6d 73 fc 02 fc 95 9c a4 0c 68 92 22 ....ms.......h." 00a0 39 a2 3f 67 d0 df e7 59 f2 98 53 3a 3c 89 44 16 9.?g...Y..S:<.D. 00b0 e3 3f b9 da b3 3a 6f f1 26 6b 9a d0 64 63 3c 98 .?...:o.&k..dc<. 00c0 3e be 0f cd c0 ac 23 05 05 e6 17 8a cb 05 c3 70 >.....#........p 00d0 25 e7 9f 4c c2 aa 63 52 ae ae 5f 7f 5f 40 a1 d1 %..L..cR.._._@.. 00e0 cc c9 8d 48 f5 bb 6f eb fd 2c 74 b9 98 41 28 0e ...H..o..,t..A(. 00f0 76 b1 19 93 02 ee 8e af 10 4b 5c d1 8a e3 28 84 v........K\...(. 0100 b4 e8 50 da 24 ca 5c f4 6b 5e cd 7c 8f d8 e2 2a ..P.$.\.k^.|...* 0110 cb e8 a4 0b f9 89 04 8f 77 f9 bf b1 0c 93 ab 5d ........w......] 0120 7a 87 7e 26 46 b2 c3 12 f8 ca 90 f8 f8 e7 67 03 z.~&F.........g. 0130 83 b6 db 17 dc 67 64 bb 22 18 be ee fa da b2 be .....gd."....... 0140 8e c0 6b a7 9f 10 8c dc fe 6c 3f d6 4e d9 cc de ..k......l?.N... 0150 4c 19 96 de cb 3c L....< Frame 26 (342 bytes on wire, 342 bytes captured) Arrival Time: Feb 25, 2010 15:19:35.531842000 [Time delta from previous captured frame: 0.000018000 seconds] [Time delta from previous displayed frame: 0.000018000 seconds] [Time since reference or first frame: 4.828769000 seconds] Frame Number: 26 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x01da (474) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf90d [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x5691 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x25d306aa Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 01 48 01 da 00 00 80 11 f9 0d a5 e3 f9 73 a5 e3 .H...........s.. 0020 f9 82 01 f4 01 f4 01 34 56 91 56 b2 07 ce 1b 99 .......4V.V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 08 10 20 01 25 d3 sa..RG...... .%. 0040 06 aa 00 00 01 2c ec dd 8c c8 ec 26 99 55 61 8a .....,.....&.Ua. 0050 53 2a 89 cf 81 c7 46 03 fb b7 fe 2d b3 cf 33 e1 S*....F....-..3. 0060 3b f0 27 4e 2b 74 ef ec ca dc dc 95 6c 0d bf 04 ;.'N+t......l... 0070 75 13 97 04 5f fb 95 ff 17 b6 d6 27 e5 b3 3a 43 u..._......'..:C 0080 af fc 72 e1 8f 05 47 38 18 c9 26 46 85 83 89 9b ..r...G8..&F.... 0090 e0 05 17 b3 6d 73 fc 02 fc 95 9c a4 0c 68 92 22 ....ms.......h." 00a0 39 a2 3f 67 d0 df e7 59 f2 98 53 3a 3c 89 44 16 9.?g...Y..S:<.D. 00b0 e3 3f b9 da b3 3a 6f f1 26 6b 9a d0 64 63 3c 98 .?...:o.&k..dc<. 00c0 3e be 0f cd c0 ac 23 05 05 e6 17 8a cb 05 c3 70 >.....#........p 00d0 25 e7 9f 4c c2 aa 63 52 ae ae 5f 7f 5f 40 a1 d1 %..L..cR.._._@.. 00e0 cc c9 8d 48 f5 bb 6f eb fd 2c 74 b9 98 41 28 0e ...H..o..,t..A(. 00f0 76 b1 19 93 02 ee 8e af 10 4b 5c d1 8a e3 28 84 v........K\...(. 0100 b4 e8 50 da 24 ca 5c f4 6b 5e cd 7c 8f d8 e2 2a ..P.$.\.k^.|...* 0110 cb e8 a4 0b f9 89 04 8f 77 f9 bf b1 0c 93 ab 5d ........w......] 0120 7a 87 7e 26 46 b2 c3 12 f8 ca 90 f8 f8 e7 67 03 z.~&F.........g. 0130 83 b6 db 17 dc 67 64 bb 22 18 be ee fa da b2 be .....gd."....... 0140 8e c0 6b a7 9f 10 8c dc fe 6c 3f d6 4e d9 cc de ..k......l?.N... 0150 4c 19 96 de cb 3c L....< Frame 27 (342 bytes on wire, 342 bytes captured) Arrival Time: Feb 25, 2010 15:19:35.534511000 [Time delta from previous captured frame: 0.002669000 seconds] [Time delta from previous displayed frame: 0.002669000 seconds] [Time since reference or first frame: 4.831438000 seconds] Frame Number: 27 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfae7 [correct] [Good: True] [Bad : False] Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x166a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x25d306aa Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 6d a9 a5 00 0c 29 64 f8 4a 08 00 45 00 ..)m....)d.J..E. 0010 01 48 00 00 40 00 40 11 fa e7 a5 e3 f9 82 a5 e3 .H..@.@......... 0020 f9 73 01 f4 01 f4 01 34 16 6a 56 b2 07 ce 1b 99 .s.....4.jV..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 08 10 20 01 25 d3 sa..RG...... .%. 0040 06 aa 00 00 01 2c ee b8 89 59 57 49 7a f4 d3 ab .....,...YWIz... 0050 ca b5 a1 ae 43 70 eb 8b 5c 39 a9 c0 2a ca e0 3d ....Cp..\9..*..= 0060 08 2f e8 c2 cf 64 03 ec 34 37 ea 1b a6 d6 66 1c ./...d..47....f. 0070 d1 b4 74 3a fa 23 c2 af 85 da 04 69 4f 5f d2 1e ..t:.#.....iO_.. 0080 f0 02 84 11 00 4b 2b 4b 6a 44 24 8d 72 49 8a a1 .....K+KjD$.rI.. 0090 16 af be a3 49 4e ae f9 68 bc 7a 19 90 8b 78 c1 ....IN..h.z...x. 00a0 c9 5c a4 a9 e4 79 8a e6 85 e5 85 f4 a1 77 c0 8a .\...y.......w.. 00b0 c1 c8 e3 7e 1d 07 28 60 fb 7d e4 59 df 32 d4 3c ...~..(`.}.Y.2.< 00c0 ce 49 1f f4 05 f3 8d 4e ed 96 02 5e 26 21 9e f4 .I.....N...^&!.. 00d0 5d 1f e6 42 55 56 88 fe f4 d5 d4 7a f6 93 43 4b ]..BUV.....z..CK 00e0 e1 fc ea 7b d9 7f f1 2a 4e 3e fc 57 aa 91 80 66 ...{...*N>.W...f 00f0 33 ad a3 f2 d1 7d c2 97 fe 96 21 d3 aa d1 bf 86 3....}....!..... 0100 17 e0 c7 a9 75 e0 66 f9 84 ce d9 c5 49 f8 d8 ab ....u.f.....I... 0110 6b 4e 18 af ab 0b 77 9c 8a dc 14 2b 73 63 51 77 kN....w....+scQw 0120 43 c8 1b ee 24 ba e8 c3 85 3e 19 e1 c9 5c b3 95 C...$....>...\.. 0130 64 d4 80 49 4f 3d fb 49 fb ea 93 af 18 d4 92 11 d..IO=.I........ 0140 a9 6b c5 d1 89 e3 7c 98 fe f3 24 9f bf 20 41 57 .k....|...$.. AW 0150 ee ca ff ef 2f 67 ..../g Frame 28 (342 bytes on wire, 342 bytes captured) Arrival Time: Feb 25, 2010 15:19:35.534520000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 4.831447000 seconds] Frame Number: 28 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfae7 [correct] [Good: True] [Bad : False] Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x166a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x25d306aa Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 6d a9 a5 00 0c 29 64 f8 4a 08 00 45 00 ..)m....)d.J..E. 0010 01 48 00 00 40 00 40 11 fa e7 a5 e3 f9 82 a5 e3 .H..@.@......... 0020 f9 73 01 f4 01 f4 01 34 16 6a 56 b2 07 ce 1b 99 .s.....4.jV..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 08 10 20 01 25 d3 sa..RG...... .%. 0040 06 aa 00 00 01 2c ee b8 89 59 57 49 7a f4 d3 ab .....,...YWIz... 0050 ca b5 a1 ae 43 70 eb 8b 5c 39 a9 c0 2a ca e0 3d ....Cp..\9..*..= 0060 08 2f e8 c2 cf 64 03 ec 34 37 ea 1b a6 d6 66 1c ./...d..47....f. 0070 d1 b4 74 3a fa 23 c2 af 85 da 04 69 4f 5f d2 1e ..t:.#.....iO_.. 0080 f0 02 84 11 00 4b 2b 4b 6a 44 24 8d 72 49 8a a1 .....K+KjD$.rI.. 0090 16 af be a3 49 4e ae f9 68 bc 7a 19 90 8b 78 c1 ....IN..h.z...x. 00a0 c9 5c a4 a9 e4 79 8a e6 85 e5 85 f4 a1 77 c0 8a .\...y.......w.. 00b0 c1 c8 e3 7e 1d 07 28 60 fb 7d e4 59 df 32 d4 3c ...~..(`.}.Y.2.< 00c0 ce 49 1f f4 05 f3 8d 4e ed 96 02 5e 26 21 9e f4 .I.....N...^&!.. 00d0 5d 1f e6 42 55 56 88 fe f4 d5 d4 7a f6 93 43 4b ]..BUV.....z..CK 00e0 e1 fc ea 7b d9 7f f1 2a 4e 3e fc 57 aa 91 80 66 ...{...*N>.W...f 00f0 33 ad a3 f2 d1 7d c2 97 fe 96 21 d3 aa d1 bf 86 3....}....!..... 0100 17 e0 c7 a9 75 e0 66 f9 84 ce d9 c5 49 f8 d8 ab ....u.f.....I... 0110 6b 4e 18 af ab 0b 77 9c 8a dc 14 2b 73 63 51 77 kN....w....+scQw 0120 43 c8 1b ee 24 ba e8 c3 85 3e 19 e1 c9 5c b3 95 C...$....>...\.. 0130 64 d4 80 49 4f 3d fb 49 fb ea 93 af 18 d4 92 11 d..IO=.I........ 0140 a9 6b c5 d1 89 e3 7c 98 fe f3 24 9f bf 20 41 57 .k....|...$.. AW 0150 ee ca ff ef 2f 67 ..../g Frame 29 (102 bytes on wire, 102 bytes captured) Arrival Time: Feb 25, 2010 15:19:35.536577000 [Time delta from previous captured frame: 0.002057000 seconds] [Time delta from previous displayed frame: 0.002057000 seconds] [Time since reference or first frame: 4.833504000 seconds] Frame Number: 29 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x01de (478) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9f9 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x9df7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x25d306aa Length: 60 Encrypted payload (32 bytes) 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 00 58 01 de 00 00 80 11 f9 f9 a5 e3 f9 73 a5 e3 .X...........s.. 0020 f9 82 01 f4 01 f4 00 44 9d f7 56 b2 07 ce 1b 99 .......D..V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 08 10 20 01 25 d3 sa..RG...... .%. 0040 06 aa 00 00 00 3c ee 04 43 af 8b 64 d5 bf e8 fb .....<..C..d.... 0050 44 c9 6d 7a 41 00 8e 1d 6b 86 ec 6f 52 ff 84 9d D.mzA...k..oR... 0060 4a 5b 94 8e d8 6c J[...l Frame 30 (102 bytes on wire, 102 bytes captured) Arrival Time: Feb 25, 2010 15:19:35.536590000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 4.833517000 seconds] Frame Number: 30 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x01de (478) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9f9 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x9df7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 56B207CE1B997361 Responder cookie: 1AA85247C1D4C99F Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x25d306aa Length: 60 Encrypted payload (32 bytes) 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 00 58 01 de 00 00 80 11 f9 f9 a5 e3 f9 73 a5 e3 .X...........s.. 0020 f9 82 01 f4 01 f4 00 44 9d f7 56 b2 07 ce 1b 99 .......D..V..... 0030 73 61 1a a8 52 47 c1 d4 c9 9f 08 10 20 01 25 d3 sa..RG...... .%. 0040 06 aa 00 00 00 3c ee 04 43 af 8b 64 d5 bf e8 fb .....<..C..d.... 0050 44 c9 6d 7a 41 00 8e 1d 6b 86 ec 6f 52 ff 84 9d D.mzA...k..oR... 0060 4a 5b 94 8e d8 6c J[...l Frame 31 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 25, 2010 15:19:44.671361000 [Time delta from previous captured frame: 9.134771000 seconds] [Time delta from previous displayed frame: 9.134771000 seconds] [Time since reference or first frame: 13.968288000 seconds] Frame Number: 31 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb95 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) Encapsulating Security Payload ESP SPI: 0xff606704 ESP Sequence: 1 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 00 78 00 01 00 00 80 32 fb 95 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 82 ff 60 67 04 00 00 00 01 9e 85 45 c5 64 30 ...`g.......E.d0 0030 2a 32 20 95 d3 b4 87 a7 db c4 f7 97 b1 cc dd f2 *2 ............. 0040 5b 96 27 21 4d e1 1b f2 4c 01 27 0c 04 92 e7 96 [.'!M...L.'..... 0050 67 3e bf d4 c4 b9 44 b5 55 36 16 7e 08 37 97 77 g>....D.U6.~.7.w 0060 b3 ef 34 4b 20 6f 1f 66 9f 55 88 79 4a 01 b1 91 ..4K o.f.U.yJ... 0070 63 3b 79 ee 60 fe e4 22 59 f4 d0 c9 85 e6 f5 c6 c;y.`.."Y....... 0080 cf c3 f0 a9 77 9c ....w. Frame 32 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 25, 2010 15:19:44.671379000 [Time delta from previous captured frame: 0.000018000 seconds] [Time delta from previous displayed frame: 0.000018000 seconds] [Time since reference or first frame: 13.968306000 seconds] Frame Number: 32 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Destination: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb95 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.130 (165.227.249.130) Encapsulating Security Payload ESP SPI: 0xff606704 ESP Sequence: 1 0000 00 0c 29 64 f8 4a 00 0c 29 6d a9 a5 08 00 45 00 ..)d.J..)m....E. 0010 00 78 00 01 00 00 80 32 fb 95 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 82 ff 60 67 04 00 00 00 01 9e 85 45 c5 64 30 ...`g.......E.d0 0030 2a 32 20 95 d3 b4 87 a7 db c4 f7 97 b1 cc dd f2 *2 ............. 0040 5b 96 27 21 4d e1 1b f2 4c 01 27 0c 04 92 e7 96 [.'!M...L.'..... 0050 67 3e bf d4 c4 b9 44 b5 55 36 16 7e 08 37 97 77 g>....D.U6.~.7.w 0060 b3 ef 34 4b 20 6f 1f 66 9f 55 88 79 4a 01 b1 91 ..4K o.f.U.yJ... 0070 63 3b 79 ee 60 fe e4 22 59 f4 d0 c9 85 e6 f5 c6 c;y.`.."Y....... 0080 cf c3 f0 a9 77 9c ....w. Frame 33 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 25, 2010 15:19:44.675704000 [Time delta from previous captured frame: 0.004325000 seconds] [Time delta from previous displayed frame: 0.004325000 seconds] [Time since reference or first frame: 13.972631000 seconds] Frame Number: 33 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0020 (32) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b76 [correct] [Good: True] [Bad : False] Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0x9b589590 ESP Sequence: 1 0000 00 0c 29 6d a9 a5 00 0c 29 64 f8 4a 08 00 45 00 ..)m....)d.J..E. 0010 00 78 00 20 00 00 f0 32 8b 76 a5 e3 f9 82 a5 e3 .x. ...2.v...... 0020 f9 73 9b 58 95 90 00 00 00 01 b7 21 0e 02 81 b5 .s.X.......!.... 0030 60 95 3c 8b 53 30 99 62 93 43 72 70 3b c2 5b 06 `.<.S0.b.Crp;.[. 0040 bb ca 26 24 9c bd 47 b9 54 b9 08 67 3f 8f 88 d6 ..&$..G.T..g?... 0050 ba f1 22 ff 03 ca f0 ad 87 30 ce 79 7e b0 f6 7b .."......0.y~..{ 0060 93 c3 45 6c 1f db 97 0b 41 2f 36 18 bc 3d 0d 0c ..El....A/6..=.. 0070 74 05 1b 1d 42 3c 8d 6d 0b f0 73 2a 34 90 19 39 t...B<.m..s*4..9 0080 a9 bf 3d b7 04 0d ..=... Frame 34 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 25, 2010 15:19:44.675719000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 13.972646000 seconds] Frame Number: 34 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) Address: 00:0c:29:64:f8:4a (00:0c:29:64:f8:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0020 (32) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b76 [correct] [Good: True] [Bad : False] Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0x9b589590 ESP Sequence: 1 0000 00 0c 29 6d a9 a5 00 0c 29 64 f8 4a 08 00 45 00 ..)m....)d.J..E. 0010 00 78 00 20 00 00 f0 32 8b 76 a5 e3 f9 82 a5 e3 .x. ...2.v...... 0020 f9 73 9b 58 95 90 00 00 00 01 b7 21 0e 02 81 b5 .s.X.......!.... 0030 60 95 3c 8b 53 30 99 62 93 43 72 70 3b c2 5b 06 `.<.S0.b.Crp;.[. 0040 bb ca 26 24 9c bd 47 b9 54 b9 08 67 3f 8f 88 d6 ..&$..G.T..g?... 0050 ba f1 22 ff 03 ca f0 ad 87 30 ce 79 7e b0 f6 7b .."......0.y~..{ 0060 93 c3 45 6c 1f db 97 0b 41 2f 36 18 bc 3d 0d 0c ..El....A/6..=.. 0070 74 05 1b 1d 42 3c 8d 6d 0b f0 73 2a 34 90 19 39 t...B<.m..s*4..9 0080 a9 bf 3d b7 04 0d ..=...