Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Jan 8, 2010 17:44:21.987620000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x01c5 (453) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9ce [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x6283 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D5E894FF0D0E3205 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 1e 2a d4 74 d9 00 0c 29 6d a9 a5 08 00 45 00 ..*.t...)m....E. 0010 00 98 01 c5 00 00 80 11 f9 ce a5 e3 f9 73 a5 e3 .............s.. 0020 f9 86 01 f4 01 f4 00 84 62 83 d5 e8 94 ff 0d 0e ........b....... 0030 32 05 00 00 00 00 00 00 00 00 01 10 02 00 00 00 2............... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (166 bytes on wire, 166 bytes captured) Arrival Time: Jan 8, 2010 17:44:21.987636000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 0.000016000 seconds] Frame Number: 2 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x01c5 (453) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9ce [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x6283 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D5E894FF0D0E3205 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 1e 2a d4 74 d9 00 0c 29 6d a9 a5 08 00 45 00 ..*.t...)m....E. 0010 00 98 01 c5 00 00 80 11 f9 ce a5 e3 f9 73 a5 e3 .............s.. 0020 f9 86 01 f4 01 f4 00 84 62 83 d5 e8 94 ff 0d 0e ........b....... 0030 32 05 00 00 00 00 00 00 00 00 01 10 02 00 00 00 2............... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 3 (166 bytes on wire, 166 bytes captured) Arrival Time: Jan 8, 2010 17:44:22.027725000 [Time delta from previous captured frame: 0.040089000 seconds] [Time delta from previous displayed frame: 0.040089000 seconds] [Time since reference or first frame: 0.040105000 seconds] Frame Number: 3 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb93 [correct] [Good: True] [Bad : False] Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0xbdcf [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D5E894FF0D0E3205 Responder cookie: 0A658BA1F0F4953A Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 6d a9 a5 00 1e 2a d4 74 d9 08 00 45 00 ..)m....*.t...E. 0010 00 98 00 00 40 00 40 11 fb 93 a5 e3 f9 86 a5 e3 ....@.@......... 0020 f9 73 01 f4 01 f4 00 84 bd cf d5 e8 94 ff 0d 0e .s.............. 0030 32 05 0a 65 8b a1 f0 f4 95 3a 01 10 02 00 00 00 2..e.....:...... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 3b 90 31 dc e4 fc f8 8b 48 9a 92 39 63 dd ..;.1.....H..9c. 0090 0c 49 00 00 00 14 70 03 cb c1 09 7d be 9c 26 00 .I....p....}..&. 00a0 ba 69 83 bc 8b 35 .i...5 Frame 4 (298 bytes on wire, 298 bytes captured) Arrival Time: Jan 8, 2010 17:44:24.229685000 [Time delta from previous captured frame: 2.201960000 seconds] [Time delta from previous displayed frame: 2.201960000 seconds] [Time since reference or first frame: 2.242065000 seconds] Frame Number: 4 Frame Length: 298 bytes Capture Length: 298 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x01c8 (456) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf947 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xf5d4 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D5E894FF0D0E3205 Responder cookie: 0A658BA1F0F4953A Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 1e 2a d4 74 d9 00 0c 29 6d a9 a5 08 00 45 00 ..*.t...)m....E. 0010 01 1c 01 c8 00 00 80 11 f9 47 a5 e3 f9 73 a5 e3 .........G...s.. 0020 f9 86 01 f4 01 f4 01 08 f5 d4 d5 e8 94 ff 0d 0e ................ 0030 32 05 0a 65 8b a1 f0 f4 95 3a 04 10 02 00 00 00 2..e.....:...... 0040 00 00 00 00 01 00 0a 00 00 84 9a 99 71 39 5e e6 ............q9^. 0050 f3 31 6d d0 a9 ea 7e 77 a5 bb 64 e5 26 42 e3 0d .1m...~w..d.&B.. 0060 a4 97 98 a4 46 3a 5a a2 d9 75 0f 05 20 50 3f fa ....F:Z..u.. P?. 0070 a4 ef 0b e6 8c d9 a1 d6 e3 c9 3f bb c3 76 c0 4c ..........?..v.L 0080 44 60 23 b1 eb 9e 22 fe e1 fd 3f 66 cf 51 c6 2d D`#..."...?f.Q.- 0090 f1 84 99 3d f7 ea 0e 53 c4 0f af 91 91 8f d2 f5 ...=...S........ 00a0 58 c5 91 e8 60 17 df 96 04 56 83 82 73 8a e5 3e X...`....V..s..> 00b0 64 7b d7 93 86 6a f9 4f 61 33 a1 81 63 80 a8 fa d{...j.Oa3..c... 00c0 2d e8 e5 6b 91 c3 c0 fe 08 1a 0d 00 00 18 82 8c -..k............ 00d0 e8 65 e9 b8 20 4c c3 73 34 7b a4 89 9f 9d b2 23 .e.. L.s4{.....# 00e0 16 41 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .A...0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 5 (298 bytes on wire, 298 bytes captured) Arrival Time: Jan 8, 2010 17:44:24.229706000 [Time delta from previous captured frame: 0.000021000 seconds] [Time delta from previous displayed frame: 0.000021000 seconds] [Time since reference or first frame: 2.242086000 seconds] Frame Number: 5 Frame Length: 298 bytes Capture Length: 298 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x01c8 (456) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf947 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xf5d4 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D5E894FF0D0E3205 Responder cookie: 0A658BA1F0F4953A Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 1e 2a d4 74 d9 00 0c 29 6d a9 a5 08 00 45 00 ..*.t...)m....E. 0010 01 1c 01 c8 00 00 80 11 f9 47 a5 e3 f9 73 a5 e3 .........G...s.. 0020 f9 86 01 f4 01 f4 01 08 f5 d4 d5 e8 94 ff 0d 0e ................ 0030 32 05 0a 65 8b a1 f0 f4 95 3a 04 10 02 00 00 00 2..e.....:...... 0040 00 00 00 00 01 00 0a 00 00 84 9a 99 71 39 5e e6 ............q9^. 0050 f3 31 6d d0 a9 ea 7e 77 a5 bb 64 e5 26 42 e3 0d .1m...~w..d.&B.. 0060 a4 97 98 a4 46 3a 5a a2 d9 75 0f 05 20 50 3f fa ....F:Z..u.. P?. 0070 a4 ef 0b e6 8c d9 a1 d6 e3 c9 3f bb c3 76 c0 4c ..........?..v.L 0080 44 60 23 b1 eb 9e 22 fe e1 fd 3f 66 cf 51 c6 2d D`#..."...?f.Q.- 0090 f1 84 99 3d f7 ea 0e 53 c4 0f af 91 91 8f d2 f5 ...=...S........ 00a0 58 c5 91 e8 60 17 df 96 04 56 83 82 73 8a e5 3e X...`....V..s..> 00b0 64 7b d7 93 86 6a f9 4f 61 33 a1 81 63 80 a8 fa d{...j.Oa3..c... 00c0 2d e8 e5 6b 91 c3 c0 fe 08 1a 0d 00 00 18 82 8c -..k............ 00d0 e8 65 e9 b8 20 4c c3 73 34 7b a4 89 9f 9d b2 23 .e.. L.s4{.....# 00e0 16 41 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .A...0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 6 (242 bytes on wire, 242 bytes captured) Arrival Time: Jan 8, 2010 17:44:24.327518000 [Time delta from previous captured frame: 0.097812000 seconds] [Time delta from previous displayed frame: 0.097812000 seconds] [Time since reference or first frame: 2.339898000 seconds] Frame Number: 6 Frame Length: 242 bytes Capture Length: 242 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb47 [correct] [Good: True] [Bad : False] Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0x60d4 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D5E894FF0D0E3205 Responder cookie: 0A658BA1F0F4953A Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 20 Nonce Data Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 6d a9 a5 00 1e 2a d4 74 d9 08 00 45 00 ..)m....*.t...E. 0010 00 e4 00 00 40 00 40 11 fb 47 a5 e3 f9 86 a5 e3 ....@.@..G...... 0020 f9 73 01 f4 01 f4 00 d0 60 d4 d5 e8 94 ff 0d 0e .s......`....... 0030 32 05 0a 65 8b a1 f0 f4 95 3a 04 10 02 00 00 00 2..e.....:...... 0040 00 00 00 00 00 c8 0a 00 00 84 54 52 a3 eb a8 3c ..........TR...< 0050 07 3d b7 82 3b 15 8f 68 d1 b7 46 a4 b8 cb de 10 .=..;..h..F..... 0060 7e 01 b9 86 b6 44 08 86 07 93 2d d3 13 7e 40 a8 ~....D....-..~@. 0070 0d 2a 34 38 e4 20 91 9e 91 5b b0 ac 0f bd e6 a3 .*48. ...[...... 0080 d3 42 df fa 4d 77 fc 71 cf 2c a4 36 d9 d5 77 e9 .B..Mw.q.,.6..w. 0090 31 21 71 44 68 ea b3 ad 16 8e c0 e1 f1 98 94 bc 1!qDh........... 00a0 5c 27 08 b8 73 e1 e4 23 13 7f 3e 1f 2f d6 86 db \'..s..#..>./... 00b0 40 40 2a 5a b1 2a b8 25 64 58 0a 24 0b 35 70 a1 @@*Z.*.%dX.$.5p. 00c0 1c 93 9d 50 19 17 7f a5 a4 ab 0d 00 00 14 e4 fb ...P............ 00d0 67 70 e5 9e 6c ed 1e 4b 87 66 a8 d9 f3 34 00 00 gp..l..K.f...4.. 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 8, 2010 17:44:25.249299000 [Time delta from previous captured frame: 0.921781000 seconds] [Time delta from previous displayed frame: 0.921781000 seconds] [Time since reference or first frame: 3.261679000 seconds] Frame Number: 7 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x01cc (460) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9e7 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x30c2 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D5E894FF0D0E3205 Responder cookie: 0A658BA1F0F4953A Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 1e 2a d4 74 d9 00 0c 29 6d a9 a5 08 00 45 00 ..*.t...)m....E. 0010 00 78 01 cc 00 00 80 11 f9 e7 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 86 01 f4 01 f4 00 64 30 c2 d5 e8 94 ff 0d 0e .......d0....... 0030 32 05 0a 65 8b a1 f0 f4 95 3a 05 10 02 01 00 00 2..e.....:...... 0040 00 00 00 00 00 5c 54 61 a4 a5 e7 70 e2 f2 36 cc .....\Ta...p..6. 0050 f8 9d 6a 2b 6e cc ef 83 0c 07 32 70 e0 fd 72 a3 ..j+n.....2p..r. 0060 9b a1 f8 ea f7 ab 35 65 50 c6 3a 17 75 1a 1f 8a ......5eP.:.u... 0070 f8 de 55 4f 8b 12 f3 4d 49 48 22 e5 5e f3 fd 23 ..UO...MIH".^..# 0080 b5 51 b6 bc 8e b0 .Q.... Frame 8 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 8, 2010 17:44:25.249318000 [Time delta from previous captured frame: 0.000019000 seconds] [Time delta from previous displayed frame: 0.000019000 seconds] [Time since reference or first frame: 3.261698000 seconds] Frame Number: 8 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x01cc (460) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9e7 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x30c2 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D5E894FF0D0E3205 Responder cookie: 0A658BA1F0F4953A Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 1e 2a d4 74 d9 00 0c 29 6d a9 a5 08 00 45 00 ..*.t...)m....E. 0010 00 78 01 cc 00 00 80 11 f9 e7 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 86 01 f4 01 f4 00 64 30 c2 d5 e8 94 ff 0d 0e .......d0....... 0030 32 05 0a 65 8b a1 f0 f4 95 3a 05 10 02 01 00 00 2..e.....:...... 0040 00 00 00 00 00 5c 54 61 a4 a5 e7 70 e2 f2 36 cc .....\Ta...p..6. 0050 f8 9d 6a 2b 6e cc ef 83 0c 07 32 70 e0 fd 72 a3 ..j+n.....2p..r. 0060 9b a1 f8 ea f7 ab 35 65 50 c6 3a 17 75 1a 1f 8a ......5eP.:.u... 0070 f8 de 55 4f 8b 12 f3 4d 49 48 22 e5 5e f3 fd 23 ..UO...MIH".^..# 0080 b5 51 b6 bc 8e b0 .Q.... Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: Jan 8, 2010 17:44:25.275693000 [Time delta from previous captured frame: 0.026375000 seconds] [Time delta from previous displayed frame: 0.026375000 seconds] [Time since reference or first frame: 3.288073000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc3 [correct] [Good: True] [Bad : False] Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x06bc [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D5E894FF0D0E3205 Responder cookie: 0A658BA1F0F4953A Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 6d a9 a5 00 1e 2a d4 74 d9 08 00 45 00 ..)m....*.t...E. 0010 00 68 00 00 40 00 40 11 fb c3 a5 e3 f9 86 a5 e3 .h..@.@......... 0020 f9 73 01 f4 01 f4 00 54 06 bc d5 e8 94 ff 0d 0e .s.....T........ 0030 32 05 0a 65 8b a1 f0 f4 95 3a 05 10 02 01 00 00 2..e.....:...... 0040 00 00 00 00 00 4c 93 2e 01 41 9a b4 3f 14 7c 3f .....L...A..?.|? 0050 6e b7 69 e8 2b 85 c7 b3 19 db c9 ff c9 bf f3 04 n.i.+........... 0060 f8 e3 af be 3a d9 b8 3d 27 e2 8c 73 a7 7f 8f c3 ....:..='..s.... 0070 5a 42 be 0a f1 c1 ZB.... Frame 10 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 8, 2010 17:44:25.288508000 [Time delta from previous captured frame: 0.012815000 seconds] [Time delta from previous displayed frame: 0.012815000 seconds] [Time since reference or first frame: 3.300888000 seconds] Frame Number: 10 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb3 [correct] [Good: True] [Bad : False] Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xe545 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D5E894FF0D0E3205 Responder cookie: 0A658BA1F0F4953A Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x9deba874 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 6d a9 a5 00 1e 2a d4 74 d9 08 00 45 00 ..)m....*.t...E. 0010 00 78 00 00 40 00 40 11 fb b3 a5 e3 f9 86 a5 e3 .x..@.@......... 0020 f9 73 01 f4 01 f4 00 64 e5 45 d5 e8 94 ff 0d 0e .s.....d.E...... 0030 32 05 0a 65 8b a1 f0 f4 95 3a 08 10 05 01 9d eb 2..e.....:...... 0040 a8 74 00 00 00 5c f8 93 42 ce 8d 0a 87 15 c7 fa .t...\..B....... 0050 1d 46 a5 96 2d 9b e2 e0 3b 94 56 e2 8f ed 85 10 .F..-...;.V..... 0060 41 e2 43 2c 24 e3 2f cc ec b7 2f 3a 1d f9 41 85 A.C,$./.../:..A. 0070 5e 03 8c 73 e4 70 99 20 09 78 d6 e8 df dc 0d f9 ^..s.p. .x...... 0080 25 2b 5b 22 1f 32 %+[".2 Frame 11 (342 bytes on wire, 342 bytes captured) Arrival Time: Jan 8, 2010 17:44:27.466063000 [Time delta from previous captured frame: 2.177555000 seconds] [Time delta from previous displayed frame: 2.177555000 seconds] [Time since reference or first frame: 5.478443000 seconds] Frame Number: 11 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x01d5 (469) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf90e [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xb249 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D5E894FF0D0E3205 Responder cookie: 0A658BA1F0F4953A Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x09c3040f Length: 300 Encrypted payload (272 bytes) 0000 00 1e 2a d4 74 d9 00 0c 29 6d a9 a5 08 00 45 00 ..*.t...)m....E. 0010 01 48 01 d5 00 00 80 11 f9 0e a5 e3 f9 73 a5 e3 .H...........s.. 0020 f9 86 01 f4 01 f4 01 34 b2 49 d5 e8 94 ff 0d 0e .......4.I...... 0030 32 05 0a 65 8b a1 f0 f4 95 3a 08 10 20 01 09 c3 2..e.....:.. ... 0040 04 0f 00 00 01 2c f7 2b 6e 72 c4 ad 33 f1 f0 50 .....,.+nr..3..P 0050 3a 47 ab 68 96 de 75 22 46 92 74 31 16 68 3d 70 :G.h..u"F.t1.h=p 0060 6b 37 c3 5f a6 3d 45 c0 a8 bd 05 b6 88 7e 7a 32 k7._.=E......~z2 0070 b0 fa 85 e3 da 4d 5d bd f6 13 55 01 ef ac 83 fd .....M]...U..... 0080 2a ec a9 c9 c0 b3 89 10 8e 84 f8 f2 fc 74 dc 3a *............t.: 0090 72 83 ff 80 55 b9 6b e0 18 0a d8 dd 5c bc d4 e8 r...U.k.....\... 00a0 0c 92 d5 23 b7 7f 59 ef 7a 68 e4 d2 65 aa b0 d9 ...#..Y.zh..e... 00b0 ef db 2d 35 2d 44 64 a5 29 d9 9b e1 a0 0c 94 78 ..-5-Dd.)......x 00c0 35 25 57 7f 9d ac cb ee 0f 29 84 dc 8f 43 c4 cd 5%W......)...C.. 00d0 6c 44 0e 2a 23 1d 71 ee d4 06 95 c2 c5 b2 44 97 lD.*#.q.......D. 00e0 25 6e d3 50 94 ba 54 ef 5e 73 4f c8 09 0d 09 89 %n.P..T.^sO..... 00f0 3e c1 95 3e 10 bb 1d e4 89 10 1f 86 01 01 05 58 >..>...........X 0100 06 64 d4 73 1c c3 92 b1 53 02 98 66 f3 a6 2d c3 .d.s....S..f..-. 0110 39 d8 b4 df 34 4f fb ef e7 8e 62 65 ef ad 06 28 9...4O....be...( 0120 00 31 d4 ab 52 b5 2a 1f 1d 71 e5 e0 0b f1 72 50 .1..R.*..q....rP 0130 59 75 ad e6 b3 1b 4b cf ba d3 85 1f b4 bd f4 44 Yu....K........D 0140 37 25 0c df 1d 03 c1 7c 85 25 90 f9 e7 58 fe de 7%.....|.%...X.. 0150 27 bd 3e c3 e7 bb '.>... Frame 12 (342 bytes on wire, 342 bytes captured) Arrival Time: Jan 8, 2010 17:44:27.466082000 [Time delta from previous captured frame: 0.000019000 seconds] [Time delta from previous displayed frame: 0.000019000 seconds] [Time since reference or first frame: 5.478462000 seconds] Frame Number: 12 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x01d5 (469) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf90e [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xb249 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D5E894FF0D0E3205 Responder cookie: 0A658BA1F0F4953A Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x09c3040f Length: 300 Encrypted payload (272 bytes) 0000 00 1e 2a d4 74 d9 00 0c 29 6d a9 a5 08 00 45 00 ..*.t...)m....E. 0010 01 48 01 d5 00 00 80 11 f9 0e a5 e3 f9 73 a5 e3 .H...........s.. 0020 f9 86 01 f4 01 f4 01 34 b2 49 d5 e8 94 ff 0d 0e .......4.I...... 0030 32 05 0a 65 8b a1 f0 f4 95 3a 08 10 20 01 09 c3 2..e.....:.. ... 0040 04 0f 00 00 01 2c f7 2b 6e 72 c4 ad 33 f1 f0 50 .....,.+nr..3..P 0050 3a 47 ab 68 96 de 75 22 46 92 74 31 16 68 3d 70 :G.h..u"F.t1.h=p 0060 6b 37 c3 5f a6 3d 45 c0 a8 bd 05 b6 88 7e 7a 32 k7._.=E......~z2 0070 b0 fa 85 e3 da 4d 5d bd f6 13 55 01 ef ac 83 fd .....M]...U..... 0080 2a ec a9 c9 c0 b3 89 10 8e 84 f8 f2 fc 74 dc 3a *............t.: 0090 72 83 ff 80 55 b9 6b e0 18 0a d8 dd 5c bc d4 e8 r...U.k.....\... 00a0 0c 92 d5 23 b7 7f 59 ef 7a 68 e4 d2 65 aa b0 d9 ...#..Y.zh..e... 00b0 ef db 2d 35 2d 44 64 a5 29 d9 9b e1 a0 0c 94 78 ..-5-Dd.)......x 00c0 35 25 57 7f 9d ac cb ee 0f 29 84 dc 8f 43 c4 cd 5%W......)...C.. 00d0 6c 44 0e 2a 23 1d 71 ee d4 06 95 c2 c5 b2 44 97 lD.*#.q.......D. 00e0 25 6e d3 50 94 ba 54 ef 5e 73 4f c8 09 0d 09 89 %n.P..T.^sO..... 00f0 3e c1 95 3e 10 bb 1d e4 89 10 1f 86 01 01 05 58 >..>...........X 0100 06 64 d4 73 1c c3 92 b1 53 02 98 66 f3 a6 2d c3 .d.s....S..f..-. 0110 39 d8 b4 df 34 4f fb ef e7 8e 62 65 ef ad 06 28 9...4O....be...( 0120 00 31 d4 ab 52 b5 2a 1f 1d 71 e5 e0 0b f1 72 50 .1..R.*..q....rP 0130 59 75 ad e6 b3 1b 4b cf ba d3 85 1f b4 bd f4 44 Yu....K........D 0140 37 25 0c df 1d 03 c1 7c 85 25 90 f9 e7 58 fe de 7%.....|.%...X.. 0150 27 bd 3e c3 e7 bb '.>... Frame 13 (342 bytes on wire, 342 bytes captured) Arrival Time: Jan 8, 2010 17:44:27.655730000 [Time delta from previous captured frame: 0.189648000 seconds] [Time delta from previous displayed frame: 0.189648000 seconds] [Time since reference or first frame: 5.668110000 seconds] Frame Number: 13 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfae3 [correct] [Good: True] [Bad : False] Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xb4c3 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D5E894FF0D0E3205 Responder cookie: 0A658BA1F0F4953A Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x09c3040f Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 6d a9 a5 00 1e 2a d4 74 d9 08 00 45 00 ..)m....*.t...E. 0010 01 48 00 00 40 00 40 11 fa e3 a5 e3 f9 86 a5 e3 .H..@.@......... 0020 f9 73 01 f4 01 f4 01 34 b4 c3 d5 e8 94 ff 0d 0e .s.....4........ 0030 32 05 0a 65 8b a1 f0 f4 95 3a 08 10 20 01 09 c3 2..e.....:.. ... 0040 04 0f 00 00 01 2c b8 ec b9 b7 af 31 0e b2 72 8e .....,.....1..r. 0050 15 00 45 81 0d 73 75 2c 19 c2 9b 18 da c9 bc 38 ..E..su,.......8 0060 2d ed bc 3b 9c 0b 86 d8 1a bf c8 60 7f 08 4d 82 -..;.......`..M. 0070 5c cd 19 82 32 a4 49 5c e6 57 5b 29 c5 bd cf d5 \...2.I\.W[).... 0080 dd ed 6c f6 1d 4f 41 d7 1f 6a 42 02 e4 1e ba 58 ..l..OA..jB....X 0090 b5 a9 b1 6f 18 d2 4c 3b 39 52 f9 fb a8 8e ab cb ...o..L;9R...... 00a0 c0 9d b1 46 4a fd ca 94 5b f8 1e 41 17 f6 e8 4a ...FJ...[..A...J 00b0 ac 7b 6e ae 69 9a d8 95 28 1a 63 5d b7 2a ed 26 .{n.i...(.c].*.& 00c0 aa aa 86 e5 9e 7f f1 4e b6 b7 5f a8 07 fe a7 57 .......N.._....W 00d0 87 0c 49 57 9d 69 06 e2 25 f3 58 28 3c aa c1 91 ..IW.i..%.X(<... 00e0 6d 42 63 cd 10 2f 60 25 d6 97 00 72 06 d2 86 e3 mBc../`%...r.... 00f0 c0 2d 2a 87 ba 2d 86 79 da 26 d8 db b9 83 cd 88 .-*..-.y.&...... 0100 55 39 d9 c4 90 ef a0 01 6b 1f cd 26 9d 1e e6 cc U9......k..&.... 0110 93 65 91 b4 0b 20 15 d8 fc 56 dd b9 93 b0 0e 6c .e... ...V.....l 0120 30 cb ce 4b ad 1b ea cc 19 88 28 ba a2 46 39 e4 0..K......(..F9. 0130 0f 11 0d 7c b4 4e 81 64 7f d8 ca bd e9 b0 51 b3 ...|.N.d......Q. 0140 7c d0 84 0d 8b 90 49 65 21 e4 37 b2 75 b7 de b3 |.....Ie!.7.u... 0150 00 52 c5 6a f0 8e .R.j.. Frame 14 (102 bytes on wire, 102 bytes captured) Arrival Time: Jan 8, 2010 17:44:27.659317000 [Time delta from previous captured frame: 0.003587000 seconds] [Time delta from previous displayed frame: 0.003587000 seconds] [Time since reference or first frame: 5.671697000 seconds] Frame Number: 14 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x01da (474) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9f9 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x667c [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D5E894FF0D0E3205 Responder cookie: 0A658BA1F0F4953A Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x09c3040f Length: 60 Encrypted payload (32 bytes) 0000 00 1e 2a d4 74 d9 00 0c 29 6d a9 a5 08 00 45 00 ..*.t...)m....E. 0010 00 58 01 da 00 00 80 11 f9 f9 a5 e3 f9 73 a5 e3 .X...........s.. 0020 f9 86 01 f4 01 f4 00 44 66 7c d5 e8 94 ff 0d 0e .......Df|...... 0030 32 05 0a 65 8b a1 f0 f4 95 3a 08 10 20 01 09 c3 2..e.....:.. ... 0040 04 0f 00 00 00 3c 1c bd 65 00 db 9b 41 d7 b6 61 .....<..e...A..a 0050 ee 63 ad 7f 12 74 ae 09 0d ca 9d d4 d7 bf e5 e8 .c...t.......... 0060 49 a3 fa 5b fa b4 I..[.. Frame 15 (102 bytes on wire, 102 bytes captured) Arrival Time: Jan 8, 2010 17:44:27.659335000 [Time delta from previous captured frame: 0.000018000 seconds] [Time delta from previous displayed frame: 0.000018000 seconds] [Time since reference or first frame: 5.671715000 seconds] Frame Number: 15 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x01da (474) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9f9 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x667c [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D5E894FF0D0E3205 Responder cookie: 0A658BA1F0F4953A Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x09c3040f Length: 60 Encrypted payload (32 bytes) 0000 00 1e 2a d4 74 d9 00 0c 29 6d a9 a5 08 00 45 00 ..*.t...)m....E. 0010 00 58 01 da 00 00 80 11 f9 f9 a5 e3 f9 73 a5 e3 .X...........s.. 0020 f9 86 01 f4 01 f4 00 44 66 7c d5 e8 94 ff 0d 0e .......Df|...... 0030 32 05 0a 65 8b a1 f0 f4 95 3a 08 10 20 01 09 c3 2..e.....:.. ... 0040 04 0f 00 00 00 3c 1c bd 65 00 db 9b 41 d7 b6 61 .....<..e...A..a 0050 ee 63 ad 7f 12 74 ae 09 0d ca 9d d4 d7 bf e5 e8 .c...t.......... 0060 49 a3 fa 5b fa b4 I..[.. Frame 16 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 8, 2010 17:44:42.883338000 [Time delta from previous captured frame: 15.224003000 seconds] [Time delta from previous displayed frame: 15.224003000 seconds] [Time since reference or first frame: 20.895718000 seconds] Frame Number: 16 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb91 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.134 (165.227.249.134) Encapsulating Security Payload ESP SPI: 0x043be73f ESP Sequence: 1 0000 00 1e 2a d4 74 d9 00 0c 29 6d a9 a5 08 00 45 00 ..*.t...)m....E. 0010 00 78 00 01 00 00 80 32 fb 91 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 86 04 3b e7 3f 00 00 00 01 15 d1 09 7c a1 83 ...;.?.......|.. 0030 4b f8 c5 e1 8d f3 0d b5 a7 21 07 19 9c 90 54 17 K........!....T. 0040 4e 16 9f 91 2e 7d 77 f3 d2 6a de 08 48 36 55 15 N....}w..j..H6U. 0050 b0 f1 4e 84 13 3c d2 f6 84 40 3c 24 9f 9a a4 a3 ..N..<...@<$.... 0060 c9 c0 bf 8d 77 e9 06 67 12 b3 a4 b7 f5 8b 62 0b ....w..g......b. 0070 c4 58 f6 e0 29 1f 67 ef 89 3b 51 f4 b7 3a 6d c3 .X..).g..;Q..:m. 0080 80 ee 1c ee b6 bd ...... Frame 17 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 8, 2010 17:44:42.883359000 [Time delta from previous captured frame: 0.000021000 seconds] [Time delta from previous displayed frame: 0.000021000 seconds] [Time since reference or first frame: 20.895739000 seconds] Frame Number: 17 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb91 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.134 (165.227.249.134) Encapsulating Security Payload ESP SPI: 0x043be73f ESP Sequence: 1 0000 00 1e 2a d4 74 d9 00 0c 29 6d a9 a5 08 00 45 00 ..*.t...)m....E. 0010 00 78 00 01 00 00 80 32 fb 91 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 86 04 3b e7 3f 00 00 00 01 15 d1 09 7c a1 83 ...;.?.......|.. 0030 4b f8 c5 e1 8d f3 0d b5 a7 21 07 19 9c 90 54 17 K........!....T. 0040 4e 16 9f 91 2e 7d 77 f3 d2 6a de 08 48 36 55 15 N....}w..j..H6U. 0050 b0 f1 4e 84 13 3c d2 f6 84 40 3c 24 9f 9a a4 a3 ..N..<...@<$.... 0060 c9 c0 bf 8d 77 e9 06 67 12 b3 a4 b7 f5 8b 62 0b ....w..g......b. 0070 c4 58 f6 e0 29 1f 67 ef 89 3b 51 f4 b7 3a 6d c3 .X..).g..;Q..:m. 0080 80 ee 1c ee b6 bd ...... Frame 18 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 8, 2010 17:44:42.886327000 [Time delta from previous captured frame: 0.002968000 seconds] [Time delta from previous displayed frame: 0.002968000 seconds] [Time since reference or first frame: 20.898707000 seconds] Frame Number: 18 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x962d (38445) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xa565 [correct] [Good: True] [Bad : False] Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0x0814e6cd ESP Sequence: 1 0000 00 0c 29 6d a9 a5 00 1e 2a d4 74 d9 08 00 45 00 ..)m....*.t...E. 0010 00 78 96 2d 00 00 40 32 a5 65 a5 e3 f9 86 a5 e3 .x.-..@2.e...... 0020 f9 73 08 14 e6 cd 00 00 00 01 a9 12 ef 5a 9d 39 .s...........Z.9 0030 d1 83 26 eb 53 50 66 2e 44 40 73 69 fc 9a f8 21 ..&.SPf.D@si...! 0040 21 66 09 cc 45 be cd fe 37 76 37 26 d1 ef e2 ba !f..E...7v7&.... 0050 29 a0 07 1a 18 8b 71 75 3b 18 89 47 74 cb fa 2c ).....qu;..Gt.., 0060 75 80 0b 77 7d 21 e2 55 b2 0e df 51 85 1b 99 85 u..w}!.U...Q.... 0070 c4 69 ed ca 12 6b ac 6a a0 53 8a 68 fb 01 9e 57 .i...k.j.S.h...W 0080 7f ea 81 83 da b8 ...... Frame 19 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 8, 2010 17:44:43.878093000 [Time delta from previous captured frame: 0.991766000 seconds] [Time delta from previous displayed frame: 0.991766000 seconds] [Time since reference or first frame: 21.890473000 seconds] Frame Number: 19 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb90 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.134 (165.227.249.134) Encapsulating Security Payload ESP SPI: 0x043be73f ESP Sequence: 2 0000 00 1e 2a d4 74 d9 00 0c 29 6d a9 a5 08 00 45 00 ..*.t...)m....E. 0010 00 78 00 02 00 00 80 32 fb 90 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 86 04 3b e7 3f 00 00 00 02 a4 b7 f5 8b 62 0b ...;.?........b. 0030 c4 58 f6 e0 29 1f 67 ef 89 3b 75 8f c4 6c ac 52 .X..).g..;u..l.R 0040 af 1e 7f 2e ef aa 6c 04 bc a6 5e c9 88 b5 3e c7 ......l...^...>. 0050 ee 52 27 79 b4 70 b0 9f 44 e9 b6 b5 83 d1 fa c0 .R'y.p..D....... 0060 7f 38 f1 ec 3a 82 16 b7 f6 90 be 81 91 c0 f4 dc .8..:........... 0070 54 b6 17 5f e6 c9 13 82 78 f2 79 7e 35 c1 c8 26 T.._....x.y~5..& 0080 47 fd d6 26 34 ee G..&4. Frame 20 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 8, 2010 17:44:43.878113000 [Time delta from previous captured frame: 0.000020000 seconds] [Time delta from previous displayed frame: 0.000020000 seconds] [Time since reference or first frame: 21.890493000 seconds] Frame Number: 20 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb90 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.134 (165.227.249.134) Encapsulating Security Payload ESP SPI: 0x043be73f ESP Sequence: 2 0000 00 1e 2a d4 74 d9 00 0c 29 6d a9 a5 08 00 45 00 ..*.t...)m....E. 0010 00 78 00 02 00 00 80 32 fb 90 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 86 04 3b e7 3f 00 00 00 02 a4 b7 f5 8b 62 0b ...;.?........b. 0030 c4 58 f6 e0 29 1f 67 ef 89 3b 75 8f c4 6c ac 52 .X..).g..;u..l.R 0040 af 1e 7f 2e ef aa 6c 04 bc a6 5e c9 88 b5 3e c7 ......l...^...>. 0050 ee 52 27 79 b4 70 b0 9f 44 e9 b6 b5 83 d1 fa c0 .R'y.p..D....... 0060 7f 38 f1 ec 3a 82 16 b7 f6 90 be 81 91 c0 f4 dc .8..:........... 0070 54 b6 17 5f e6 c9 13 82 78 f2 79 7e 35 c1 c8 26 T.._....x.y~5..& 0080 47 fd d6 26 34 ee G..&4. Frame 21 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 8, 2010 17:44:43.879383000 [Time delta from previous captured frame: 0.001270000 seconds] [Time delta from previous displayed frame: 0.001270000 seconds] [Time since reference or first frame: 21.891763000 seconds] Frame Number: 21 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x8b05 (35589) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xb08d [correct] [Good: True] [Bad : False] Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0x0814e6cd ESP Sequence: 2 0000 00 0c 29 6d a9 a5 00 1e 2a d4 74 d9 08 00 45 00 ..)m....*.t...E. 0010 00 78 8b 05 00 00 40 32 b0 8d a5 e3 f9 86 a5 e3 .x....@2........ 0020 f9 73 08 14 e6 cd 00 00 00 02 df 51 85 1b 99 85 .s.........Q.... 0030 c4 69 ed ca 12 6b ac 6a a0 53 42 ed 49 23 e1 0f .i...k.j.SB.I#.. 0040 45 b8 d0 6b 78 7e 19 f9 ef 39 88 8f 35 46 9a 19 E..kx~...9..5F.. 0050 66 f2 b2 66 01 53 a5 90 47 6a 8a ac ea 36 86 0e f..f.S..Gj...6.. 0060 1d bb 46 0e 58 f5 d8 21 4a da 7d 3d a2 b8 4b 26 ..F.X..!J.}=..K& 0070 ee 24 0d 5e 1f e6 c4 4a 6c 81 b9 82 ab 40 6a f4 .$.^...Jl....@j. 0080 2c 0f 89 95 81 7e ,....~