Frame 1 (170 bytes on wire, 170 bytes captured) Arrival Time: Jun 5, 2006 12:18:41.377599000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 170 bytes Capture Length: 170 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc), Dst: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Type: IP (0x0800) Frame check sequence: 0xf047d1b0 [correct] Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0a07 (2567) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf18d [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.133 (165.227.249.133) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0xed41 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4571435785B110C4 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 0c 41 90 f1 c1 00 0c 29 1d cf fc 08 00 45 00 ..A.....).....E. 0010 00 98 0a 07 00 00 80 11 f1 8d a5 e3 f9 73 a5 e3 .............s.. 0020 f9 85 01 f4 01 f4 00 84 ed 41 45 71 43 57 85 b1 .........AEqCW.. 0030 10 c4 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f f0 47 d1 b0 ...B{..G.. Frame 2 (130 bytes on wire, 130 bytes captured) Arrival Time: Jun 5, 2006 12:18:41.379789000 Time delta from previous packet: 0.002190000 seconds Time since reference or first frame: 0.002190000 seconds Frame Number: 2 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1), Dst: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Destination: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Source: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Type: IP (0x0800) Frame check sequence: 0x58886058 [correct] Internet Protocol, Src: 165.227.249.133 (165.227.249.133), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbbc [correct] Good: True Bad : False Source: 165.227.249.133 (165.227.249.133) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0x21b8 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4571435785B110C4 Responder cookie: 0x6F6A03B0D6DB9CE0 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 84 Security Association payload Next payload: NONE (0) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) 0000 00 0c 29 1d cf fc 00 0c 41 90 f1 c1 08 00 45 00 ..).....A.....E. 0010 00 70 00 00 40 00 40 11 fb bc a5 e3 f9 85 a5 e3 .p..@.@......... 0020 f9 73 01 f4 01 f4 00 5c 21 b8 45 71 43 57 85 b1 .s.....\!.EqCW.. 0030 10 c4 6f 6a 03 b0 d6 db 9c e0 01 10 02 00 00 00 ..oj............ 0040 00 00 00 00 00 54 00 00 00 38 00 00 00 01 00 00 .....T...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 58 88 ..............X. 0080 60 58 `X Frame 3 (302 bytes on wire, 302 bytes captured) Arrival Time: Jun 5, 2006 12:18:42.403914000 Time delta from previous packet: 1.024125000 seconds Time since reference or first frame: 1.026315000 seconds Frame Number: 3 Packet Length: 302 bytes Capture Length: 302 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc), Dst: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Type: IP (0x0800) Frame check sequence: 0x3f97c66e [correct] Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x0a08 (2568) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf108 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.133 (165.227.249.133) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xaa59 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4571435785B110C4 Responder cookie: 0x6F6A03B0D6DB9CE0 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 41 90 f1 c1 00 0c 29 1d cf fc 08 00 45 00 ..A.....).....E. 0010 01 1c 0a 08 00 00 80 11 f1 08 a5 e3 f9 73 a5 e3 .............s.. 0020 f9 85 01 f4 01 f4 01 08 aa 59 45 71 43 57 85 b1 .........YEqCW.. 0030 10 c4 6f 6a 03 b0 d6 db 9c e0 04 10 02 00 00 00 ..oj............ 0040 00 00 00 00 01 00 0a 00 00 84 c5 db d6 5a 5e 58 .............Z^X 0050 a4 3c c2 58 41 c0 73 71 a6 b6 59 50 ea 92 dc 07 .<.XA.sq..YP.... 0060 d8 61 3c 01 5f 26 6e b2 96 d7 83 8b 2d 3d d5 1b .a<._&n.....-=.. 0070 2d 34 28 6c d8 ab 47 a9 72 d4 0a c6 cd ed 03 89 -4(l..G.r....... 0080 6a 45 8c 5c ab 50 fe c8 e0 fe 15 2f 88 08 c8 44 jE.\.P...../...D 0090 b1 67 c2 da b9 fe 6d 26 a7 1d 30 26 f6 6a ee 94 .g....m&..0&.j.. 00a0 6b fc db e2 fa e4 10 53 57 f7 d0 24 49 d1 29 a6 k......SW..$I.). 00b0 c2 33 59 16 18 16 c8 fd ce e4 84 3d 48 5c 2a 5c .3Y........=H\*\ 00c0 16 8e 34 1a d8 c1 7f 18 f4 14 0d 00 00 18 90 df ..4............. 00d0 05 41 cb 66 91 a2 17 c3 4f 30 84 ac 13 c3 c1 78 .A.f....O0.....x 00e0 3a 4f 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 :O...0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 3f 97 c6 6e ....&.....?..n Frame 4 (226 bytes on wire, 226 bytes captured) Arrival Time: Jun 5, 2006 12:18:42.523704000 Time delta from previous packet: 0.119790000 seconds Time since reference or first frame: 1.146105000 seconds Frame Number: 4 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1), Dst: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Destination: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Source: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Type: IP (0x0800) Frame check sequence: 0x80152113 [correct] Internet Protocol, Src: 165.227.249.133 (165.227.249.133), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb5c [correct] Good: True Bad : False Source: 165.227.249.133 (165.227.249.133) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x0e30 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4571435785B110C4 Responder cookie: 0x6F6A03B0D6DB9CE0 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 1d cf fc 00 0c 41 90 f1 c1 08 00 45 00 ..).....A.....E. 0010 00 d0 00 00 40 00 40 11 fb 5c a5 e3 f9 85 a5 e3 ....@.@..\...... 0020 f9 73 01 f4 01 f4 00 bc 0e 30 45 71 43 57 85 b1 .s.......0EqCW.. 0030 10 c4 6f 6a 03 b0 d6 db 9c e0 04 10 02 00 00 00 ..oj............ 0040 00 00 00 00 00 b4 0a 00 00 84 a6 70 97 38 c0 75 ...........p.8.u 0050 b6 1b 32 e8 d8 a7 90 de 89 a9 29 b0 1a d9 e6 64 ..2.......)....d 0060 e1 aa f4 20 40 40 cc 1a 0d 80 a4 43 70 d2 e3 1a ... @@.....Cp... 0070 06 01 69 92 bc 3c a7 20 7e ce 70 bf 16 66 cf 9e ..i..<. ~.p..f.. 0080 83 0d 7d 09 5c 38 cc d6 32 62 c8 1d 9f f1 fd 1c ..}.\8..2b...... 0090 42 39 fa d0 86 f6 0e 93 a5 53 43 f3 af 8b 92 05 B9.......SC..... 00a0 56 fb 5e aa a8 6c 25 da 18 07 18 f7 0c 24 1a 00 V.^..l%......$.. 00b0 f6 39 52 7e 27 5f 72 e8 2b 15 15 2f be d8 75 b4 .9R~'_r.+../..u. 00c0 62 fc 0d c4 7d f4 6b 64 9a 61 00 00 00 14 a7 61 b...}.kd.a.....a 00d0 ca cd 00 7c b1 8d 58 8f 4e 8e c7 ef 87 cd 80 15 ...|..X.N....... 00e0 21 13 !. Frame 5 (138 bytes on wire, 138 bytes captured) Arrival Time: Jun 5, 2006 12:18:43.048613000 Time delta from previous packet: 0.524909000 seconds Time since reference or first frame: 1.671014000 seconds Frame Number: 5 Packet Length: 138 bytes Capture Length: 138 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc), Dst: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Type: IP (0x0800) Frame check sequence: 0x53805a16 [correct] Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0a0a (2570) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf1aa [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.133 (165.227.249.133) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xc937 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4571435785B110C4 Responder cookie: 0x6F6A03B0D6DB9CE0 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 41 90 f1 c1 00 0c 29 1d cf fc 08 00 45 00 ..A.....).....E. 0010 00 78 0a 0a 00 00 80 11 f1 aa a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 85 01 f4 01 f4 00 64 c9 37 45 71 43 57 85 b1 .......d.7EqCW.. 0030 10 c4 6f 6a 03 b0 d6 db 9c e0 05 10 02 01 00 00 ..oj............ 0040 00 00 00 00 00 5c 17 53 e0 f5 3c b8 c9 a9 66 03 .....\.S..<...f. 0050 7c e1 b9 85 63 39 7a 03 e5 02 25 fd e0 e8 5f ae |...c9z...%..._. 0060 08 aa 2c ad 90 91 7f 59 00 08 45 ec 57 b0 9a 76 ..,....Y..E.W..v 0070 62 1f 45 96 89 57 af 04 38 9d ef 27 a7 51 21 9b b.E..W..8..'.Q!. 0080 84 93 e2 43 6c e1 53 80 5a 16 ...Cl.S.Z. Frame 6 (122 bytes on wire, 122 bytes captured) Arrival Time: Jun 5, 2006 12:18:43.057724000 Time delta from previous packet: 0.009111000 seconds Time since reference or first frame: 1.680125000 seconds Frame Number: 6 Packet Length: 122 bytes Capture Length: 122 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1), Dst: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Destination: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Source: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Type: IP (0x0800) Frame check sequence: 0x4de208ef [correct] Internet Protocol, Src: 165.227.249.133 (165.227.249.133), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc4 [correct] Good: True Bad : False Source: 165.227.249.133 (165.227.249.133) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xdfaf [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4571435785B110C4 Responder cookie: 0x6F6A03B0D6DB9CE0 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 1d cf fc 00 0c 41 90 f1 c1 08 00 45 00 ..).....A.....E. 0010 00 68 00 00 40 00 40 11 fb c4 a5 e3 f9 85 a5 e3 .h..@.@......... 0020 f9 73 01 f4 01 f4 00 54 df af 45 71 43 57 85 b1 .s.....T..EqCW.. 0030 10 c4 6f 6a 03 b0 d6 db 9c e0 05 10 02 01 00 00 ..oj............ 0040 00 00 00 00 00 4c 74 f1 1a 5f 0f ec 0c d0 68 85 .....Lt.._....h. 0050 93 ff d1 d9 3f d6 de 5f 3d 33 72 ab 1a 25 cb e9 ....?.._=3r..%.. 0060 38 ec 58 63 a7 01 4d 2d c2 e4 16 9b 0c 87 c5 b6 8.Xc..M-........ 0070 97 9e fc c2 db 4e 4d e2 08 ef .....NM... Frame 7 (346 bytes on wire, 346 bytes captured) Arrival Time: Jun 5, 2006 12:18:44.075771000 Time delta from previous packet: 1.018047000 seconds Time since reference or first frame: 2.698172000 seconds Frame Number: 7 Packet Length: 346 bytes Capture Length: 346 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc), Dst: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Type: IP (0x0800) Frame check sequence: 0x4fa342f8 [correct] Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0a0c (2572) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf0d8 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.133 (165.227.249.133) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x99f4 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4571435785B110C4 Responder cookie: 0x6F6A03B0D6DB9CE0 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x7F8CCC7E Length: 300 Encrypted payload (272 bytes) 0000 00 0c 41 90 f1 c1 00 0c 29 1d cf fc 08 00 45 00 ..A.....).....E. 0010 01 48 0a 0c 00 00 80 11 f0 d8 a5 e3 f9 73 a5 e3 .H...........s.. 0020 f9 85 01 f4 01 f4 01 34 99 f4 45 71 43 57 85 b1 .......4..EqCW.. 0030 10 c4 6f 6a 03 b0 d6 db 9c e0 08 10 20 01 7f 8c ..oj........ ... 0040 cc 7e 00 00 01 2c 1d e0 c5 cc d8 1a 12 ad 58 c1 .~...,........X. 0050 c1 d5 e6 17 a5 bc 90 d3 2c 57 b0 2c 61 2c d7 dd ........,W.,a,.. 0060 d0 39 a5 68 d1 e2 7b ff f7 de 33 94 01 16 5a f6 .9.h..{...3...Z. 0070 97 db c8 7e cc 62 35 23 76 03 de cf 48 a1 e1 ee ...~.b5#v...H... 0080 cb 3a b4 58 e9 30 d7 80 53 6e b2 2d 8e a0 0a 92 .:.X.0..Sn.-.... 0090 b8 35 cc 32 7b a1 59 64 28 0e 1b bf 56 ff 5a 92 .5.2{.Yd(...V.Z. 00a0 5c 95 8d 9f 82 1b bd 7a 44 95 06 b3 31 5f 99 c2 \......zD...1_.. 00b0 59 d6 26 76 c2 39 a5 3e 90 1c 1f 2a 22 e8 66 8d Y.&v.9.>...*".f. 00c0 4e 34 32 88 e6 80 18 ff 8a 8f 4d 26 7a 92 bd a8 N42.......M&z... 00d0 4a e5 21 a6 f0 06 dc 47 fe d6 d8 03 1d 47 46 da J.!....G.....GF. 00e0 e8 5a 0c 8a 83 ff 88 6e 7d f1 01 df 0b ae 86 4f .Z.....n}......O 00f0 19 54 7e ed b8 c8 1f 3d 0c a3 de 21 b9 25 b1 a3 .T~....=...!.%.. 0100 ad 82 e3 2c 72 5f e3 3a 32 3c 94 c9 61 e4 65 95 ...,r_.:2<..a.e. 0110 18 fa 6f 26 d7 5f 4f 0a 39 82 e7 af 60 5d e9 56 ..o&._O.9...`].V 0120 7a 09 03 c4 73 46 ca 0f e2 c9 aa 07 89 16 16 6f z...sF.........o 0130 b4 8f 01 a1 9c b0 fa 28 2e b4 b2 38 6f f4 03 e5 .......(...8o... 0140 80 32 42 38 b5 e4 22 d2 d4 25 c2 9e 84 93 a7 c9 .2B8.."..%...... 0150 54 99 0f 29 18 e3 4f a3 42 f8 T..)..O.B. Frame 8 (346 bytes on wire, 346 bytes captured) Arrival Time: Jun 5, 2006 12:18:44.195357000 Time delta from previous packet: 0.119586000 seconds Time since reference or first frame: 2.817758000 seconds Frame Number: 8 Packet Length: 346 bytes Capture Length: 346 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1), Dst: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Destination: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Source: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Type: IP (0x0800) Frame check sequence: 0x4aca9120 [correct] Internet Protocol, Src: 165.227.249.133 (165.227.249.133), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfae4 [correct] Good: True Bad : False Source: 165.227.249.133 (165.227.249.133) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x81fd [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4571435785B110C4 Responder cookie: 0x6F6A03B0D6DB9CE0 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x7F8CCC7E Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 1d cf fc 00 0c 41 90 f1 c1 08 00 45 00 ..).....A.....E. 0010 01 48 00 00 40 00 40 11 fa e4 a5 e3 f9 85 a5 e3 .H..@.@......... 0020 f9 73 01 f4 01 f4 01 34 81 fd 45 71 43 57 85 b1 .s.....4..EqCW.. 0030 10 c4 6f 6a 03 b0 d6 db 9c e0 08 10 20 01 7f 8c ..oj........ ... 0040 cc 7e 00 00 01 2c 8e ed fa 2a 2a 65 39 c7 eb da .~...,...**e9... 0050 2b 64 be 63 aa 2f bd 98 ec 07 42 75 d0 56 39 da +d.c./....Bu.V9. 0060 c6 5d a2 3a 87 40 86 77 27 ef c1 b5 a4 90 50 9c .].:.@.w'.....P. 0070 65 ea 96 70 6d e5 ee 0c 87 52 f3 fd 2a 9c ca 79 e..pm....R..*..y 0080 b5 b4 e5 c8 41 11 e0 54 5c d3 ee a4 ad 51 70 00 ....A..T\....Qp. 0090 1f 78 d1 c7 ae 1e 12 b3 14 a3 cc f3 8f 42 a9 44 .x...........B.D 00a0 24 a0 ec da e1 50 d1 31 d5 f2 fd 25 06 0d 85 49 $....P.1...%...I 00b0 62 99 69 79 38 32 f6 14 e5 75 fe 9d 87 36 ec 67 b.iy82...u...6.g 00c0 93 cd 34 86 b1 fa 79 a0 38 3f 53 26 d3 aa c1 7e ..4...y.8?S&...~ 00d0 9c 12 4e 1d 64 f2 23 aa 19 06 97 ec 52 b2 f0 25 ..N.d.#.....R..% 00e0 9f df a8 7d 02 bd 04 1a 78 3c 5f 8c 54 83 77 32 ...}....x<_.T.w2 00f0 cf ee 8b 99 2a 32 a6 19 4f 91 08 cc 28 de e6 ae ....*2..O...(... 0100 78 d1 0d 12 95 f5 1d 30 00 57 59 06 e2 af a1 37 x......0.WY....7 0110 19 75 56 99 3e fc 96 96 9f dd 92 e9 a9 37 78 08 .uV.>........7x. 0120 51 0b 3c aa fa f7 23 9d 05 18 f9 92 eb 1c f5 59 Q.<...#........Y 0130 79 04 c4 52 fe b7 50 20 f8 56 c1 09 72 3c 24 94 y..R..P .V..r<$. 0140 61 d8 72 2c 47 a8 30 c2 ab 0a 1e 71 23 b5 a5 9b a.r,G.0....q#... 0150 72 5f 28 49 42 c7 4a ca 91 20 r_(IB.J.. Frame 9 (106 bytes on wire, 106 bytes captured) Arrival Time: Jun 5, 2006 12:18:44.235760000 Time delta from previous packet: 0.040403000 seconds Time since reference or first frame: 2.858161000 seconds Frame Number: 9 Packet Length: 106 bytes Capture Length: 106 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc), Dst: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Type: IP (0x0800) Frame check sequence: 0xcbb812d9 [correct] Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0a0d (2573) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf1c7 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.133 (165.227.249.133) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x00d1 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4571435785B110C4 Responder cookie: 0x6F6A03B0D6DB9CE0 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x7F8CCC7E Length: 60 Encrypted payload (32 bytes) 0000 00 0c 41 90 f1 c1 00 0c 29 1d cf fc 08 00 45 00 ..A.....).....E. 0010 00 58 0a 0d 00 00 80 11 f1 c7 a5 e3 f9 73 a5 e3 .X...........s.. 0020 f9 85 01 f4 01 f4 00 44 00 d1 45 71 43 57 85 b1 .......D..EqCW.. 0030 10 c4 6f 6a 03 b0 d6 db 9c e0 08 10 20 01 7f 8c ..oj........ ... 0040 cc 7e 00 00 00 3c a9 d2 92 4b 70 bc a0 71 85 bd .~...<...Kp..q.. 0050 31 75 a0 3f e5 b0 86 d3 aa 85 7d c8 a3 a8 32 af 1u.?......}...2. 0060 19 8c 24 49 f3 c0 cb b8 12 d9 ..$I...... Frame 10 (138 bytes on wire, 138 bytes captured) Arrival Time: Jun 5, 2006 12:18:45.840698000 Time delta from previous packet: 1.604938000 seconds Time since reference or first frame: 4.463099000 seconds Frame Number: 10 Packet Length: 138 bytes Capture Length: 138 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc), Dst: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Type: IP (0x0800) Frame check sequence: 0x9971c293 [correct] Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb92 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.133 (165.227.249.133) Encapsulating Security Payload SPI: 0x57e4b7f5 Sequence: 1 Data (92 bytes) 0000 00 0c 41 90 f1 c1 00 0c 29 1d cf fc 08 00 45 00 ..A.....).....E. 0010 00 78 00 01 00 00 80 32 fb 92 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 85 57 e4 b7 f5 00 00 00 01 74 5e 2e 6f b2 b8 ..W.......t^.o.. 0030 d8 b1 95 2c 64 3f 7b a5 b3 95 a3 27 9b 20 b8 ca ...,d?{....'. .. 0040 e2 c3 ee 9b d0 b3 0f e1 ce 0e c9 9e 92 bd a9 91 ................ 0050 c6 98 c4 89 e0 e3 31 c7 b9 8d d7 fe 6e aa 86 46 ......1.....n..F 0060 60 d5 75 0d c6 79 be 5c a3 9e f8 16 00 a0 aa 8b `.u..y.\........ 0070 68 c8 27 08 11 70 31 4f cd 7a 00 ad 20 e1 4c a3 h.'..p1O.z.. .L. 0080 1a f3 c6 56 b1 c1 99 71 c2 93 ...V...q.. Frame 11 (138 bytes on wire, 138 bytes captured) Arrival Time: Jun 5, 2006 12:18:45.842713000 Time delta from previous packet: 0.002015000 seconds Time since reference or first frame: 4.465114000 seconds Frame Number: 11 Packet Length: 138 bytes Capture Length: 138 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1), Dst: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Destination: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Source: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Type: IP (0x0800) Frame check sequence: 0x038e6ba6 [correct] Internet Protocol, Src: 165.227.249.133 (165.227.249.133), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x03cc (972) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x37c8 [correct] Good: True Bad : False Source: 165.227.249.133 (165.227.249.133) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x54dce1ac Sequence: 1 Data (92 bytes) 0000 00 0c 29 1d cf fc 00 0c 41 90 f1 c1 08 00 45 00 ..).....A.....E. 0010 00 78 03 cc 00 00 40 32 37 c8 a5 e3 f9 85 a5 e3 .x....@27....... 0020 f9 73 54 dc e1 ac 00 00 00 01 19 1a 1b 1c 1d 1e .sT............. 0030 1f 20 21 22 23 24 25 26 27 28 44 09 e7 00 0d de . !"#$%&'(D..... 0040 d2 39 67 ff dd d3 fe 28 61 de 86 63 5d aa 25 b7 .9g....(a..c].%. 0050 8c 7a 4e 76 ca 43 4e 50 bd f7 5c d7 76 e3 14 ae .zNv.CNP..\.v... 0060 b6 49 35 ca 7b 12 11 df ad c9 b2 90 04 d6 46 2a .I5.{.........F* 0070 84 92 25 b4 cb 67 3d 09 4e 6c 29 20 bd 8e f3 51 ..%..g=.Nl) ...Q 0080 4a f9 aa ea 7d 0c 03 8e 6b a6 J...}...k. Frame 12 (138 bytes on wire, 138 bytes captured) Arrival Time: Jun 5, 2006 12:18:46.272763000 Time delta from previous packet: 0.430050000 seconds Time since reference or first frame: 4.895164000 seconds Frame Number: 12 Packet Length: 138 bytes Capture Length: 138 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc), Dst: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Type: IP (0x0800) Frame check sequence: 0x55f19597 [correct] Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb91 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.133 (165.227.249.133) Encapsulating Security Payload SPI: 0x57e4b7f5 Sequence: 2 Data (92 bytes) 0000 00 0c 41 90 f1 c1 00 0c 29 1d cf fc 08 00 45 00 ..A.....).....E. 0010 00 78 00 02 00 00 80 32 fb 91 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 85 57 e4 b7 f5 00 00 00 02 f8 16 00 a0 aa 8b ..W............. 0030 68 c8 27 08 11 70 31 4f cd 7a f1 98 28 12 75 c4 h.'..p1O.z..(.u. 0040 a5 4b cb a4 7e 66 b6 c6 f8 62 e6 30 09 a3 19 7f .K..~f...b.0.... 0050 ac b6 8d d0 e1 82 af dc a0 25 51 09 07 5c 2a 14 .........%Q..\*. 0060 7a 18 68 fa 7f 86 af 6f 47 73 bb 93 5b 59 38 75 z.h....oGs..[Y8u 0070 76 13 fb 45 65 5e 83 2a e1 56 9a 97 54 11 83 f7 v..Ee^.*.V..T... 0080 ad 54 e2 79 9a f1 55 f1 95 97 .T.y..U... Frame 13 (138 bytes on wire, 138 bytes captured) Arrival Time: Jun 5, 2006 12:18:46.273564000 Time delta from previous packet: 0.000801000 seconds Time since reference or first frame: 4.895965000 seconds Frame Number: 13 Packet Length: 138 bytes Capture Length: 138 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1), Dst: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Destination: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Source: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Type: IP (0x0800) Frame check sequence: 0xa79dc927 [correct] Internet Protocol, Src: 165.227.249.133 (165.227.249.133), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x03cd (973) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x37c7 [correct] Good: True Bad : False Source: 165.227.249.133 (165.227.249.133) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x54dce1ac Sequence: 2 Data (92 bytes) 0000 00 0c 29 1d cf fc 00 0c 41 90 f1 c1 08 00 45 00 ..).....A.....E. 0010 00 78 03 cd 00 00 40 32 37 c7 a5 e3 f9 85 a5 e3 .x....@27....... 0020 f9 73 54 dc e1 ac 00 00 00 02 44 45 46 47 48 49 .sT.......DEFGHI 0030 4a 4b 4c 4d 4e 4f 50 51 52 53 89 97 36 8e fb a7 JKLMNOPQRS..6... 0040 7f 75 69 1b 3a 2a d1 48 ce 72 fd 1d 04 52 d6 ff .ui.:*.H.r...R.. 0050 33 0b ef da 37 aa bd ed 63 de 61 54 ee fd 79 55 3...7...c.aT..yU 0060 bd b2 89 cb ac 7c 68 c0 99 94 24 0f e6 c0 72 07 .....|h...$...r. 0070 5d 9d 95 5b 0b fe ac 0e 9d 9d e5 46 bd 2f 41 44 ]..[.......F./AD 0080 a7 44 4b 8c 1c ec a7 9d c9 27 .DK......'