Frame 1 (170 bytes on wire, 170 bytes captured) Arrival Time: Aug 13, 2004 11:34:09.916498000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 170 bytes Capture Length: 170 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0xea12831b (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0090 (144) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfb00 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x6a35 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x490BBA048BEF1347 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 e0 13 00 2c 4a 00 0c 29 00 82 53 08 00 45 00 ....,J..)..S..E. 0010 00 98 00 90 00 00 80 11 fb 00 a5 e3 f9 73 a5 e3 .............s.. 0020 f9 89 01 f4 01 f4 00 84 6a 35 49 0b ba 04 8b ef ........j5I..... 0030 13 47 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .G.............. 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ea 12 83 1b ...B{..... Frame 2 (150 bytes on wire, 150 bytes captured) Arrival Time: Aug 13, 2004 11:34:09.922145000 Time delta from previous packet: 0.005647000 seconds Time since reference or first frame: 0.005647000 seconds Frame Number: 2 Packet Length: 150 bytes Capture Length: 150 bytes Ethernet II, Src: 00:e0:13:00:2c:4a, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Type: IP (0x0800) Frame check sequence: 0x99933f3d (correct) Internet Protocol, Src Addr: 165.227.249.137 (165.227.249.137), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba4 (correct) Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0xb042 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x490BBA048BEF1347 Responder cookie: 0xD4BCF4BC26E381E7 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 0000 00 0c 29 00 82 53 00 e0 13 00 2c 4a 08 00 45 00 ..)..S....,J..E. 0010 00 84 00 00 40 00 40 11 fb a4 a5 e3 f9 89 a5 e3 ....@.@......... 0020 f9 73 01 f4 01 f4 00 70 b0 42 49 0b ba 04 8b ef .s.....p.BI..... 0030 13 47 d4 bc f4 bc 26 e3 81 e7 01 10 02 00 00 00 .G....&......... 0040 00 00 00 00 00 68 0d 00 00 38 00 00 00 01 00 00 .....h...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 00 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 99 93 3f 3d ....?= Frame 3 (350 bytes on wire, 350 bytes captured) Arrival Time: Aug 13, 2004 11:34:12.072409000 Time delta from previous packet: 2.150264000 seconds Time since reference or first frame: 2.155911000 seconds Frame Number: 3 Packet Length: 350 bytes Capture Length: 350 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0x18808a83 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x0091 (145) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa4b (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xa7e4 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x490BBA048BEF1347 Responder cookie: 0xD4BCF4BC26E381E7 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Private USE (130) Length: 24 Nonce Data Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: Vendor ID (13) Length: 24 Payload Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E5... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 e0 13 00 2c 4a 00 0c 29 00 82 53 08 00 45 00 ....,J..)..S..E. 0010 01 4c 00 91 00 00 80 11 fa 4b a5 e3 f9 73 a5 e3 .L.......K...s.. 0020 f9 89 01 f4 01 f4 01 38 a7 e4 49 0b ba 04 8b ef .......8..I..... 0030 13 47 d4 bc f4 bc 26 e3 81 e7 04 10 02 00 00 00 .G....&......... 0040 00 00 00 00 01 30 0a 00 00 84 f7 a1 7e 1c 55 2d .....0......~.U- 0050 cc a3 56 75 c1 41 f9 59 fb 10 48 4a 4f e0 c1 37 ..Vu.A.Y..HJO..7 0060 43 a2 4a 27 28 4d 74 01 0a c8 eb f2 a6 ff 7b ee C.J'(Mt.......{. 0070 b1 46 bf a2 5e f0 84 37 84 26 fc 45 ce 68 52 5d .F..^..7.&.E.hR] 0080 cb 11 19 83 5a 1b 00 cd 23 b2 35 75 ea 99 eb db ....Z...#.5u.... 0090 b0 0d e8 59 cc eb b4 e4 f7 17 d1 b5 06 d1 40 66 ...Y..........@f 00a0 f9 01 16 93 29 1e 0c 18 7e 45 57 5e 41 79 eb 82 ....)...~EW^Ay.. 00b0 66 14 2c 69 84 18 8b 48 c8 f2 ae 7b 46 1e 1a 05 f.,i...H...{F... 00c0 01 ad 34 f2 c3 91 c4 fb d2 b6 82 00 00 18 7d 59 ..4...........}Y 00d0 64 e9 5c d0 e3 22 a5 0c da bc ea a2 22 0e 4b 80 d.\.."......".K. 00e0 28 ad 82 00 00 18 52 0f 56 49 e2 f4 81 ed b5 b4 (.....R.VI...... 00f0 8b 3c 98 56 d1 2a 42 d9 3a 1e 0d 00 00 18 03 aa .<.V.*B.:....... 0100 2a a3 5e 5b e9 ea bd 46 02 9c 2d 0d 26 a3 71 02 *.^[...F..-.&.q. 0110 90 06 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 18 80 8a 83 ....&......... Frame 4 (274 bytes on wire, 274 bytes captured) Arrival Time: Aug 13, 2004 11:34:12.089414000 Time delta from previous packet: 0.017005000 seconds Time since reference or first frame: 2.172916000 seconds Frame Number: 4 Packet Length: 274 bytes Capture Length: 274 bytes Ethernet II, Src: 00:e0:13:00:2c:4a, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Type: IP (0x0800) Frame check sequence: 0xf9dc9920 (correct) Internet Protocol, Src Addr: 165.227.249.137 (165.227.249.137), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb28 (correct) Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x4d02 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x490BBA048BEF1347 Responder cookie: 0xD4BCF4BC26E381E7 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Private USE (130) Length: 20 Nonce Data Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: NONE (0) Length: 24 Payload 0000 00 0c 29 00 82 53 00 e0 13 00 2c 4a 08 00 45 00 ..)..S....,J..E. 0010 01 00 00 00 40 00 40 11 fb 28 a5 e3 f9 89 a5 e3 ....@.@..(...... 0020 f9 73 01 f4 01 f4 00 ec 4d 02 49 0b ba 04 8b ef .s......M.I..... 0030 13 47 d4 bc f4 bc 26 e3 81 e7 04 10 02 00 00 00 .G....&......... 0040 00 00 00 00 00 e4 0a 00 00 84 a5 c5 8d 71 67 d3 .............qg. 0050 21 10 cf 4a 30 65 4f b3 db 20 18 e3 db 5f 86 4a !..J0eO.. ..._.J 0060 4d bd c8 fb 52 e9 09 cd 55 42 e6 da be 83 fb 59 M...R...UB.....Y 0070 85 cb e1 2a 81 b7 c1 c4 0b 2c b6 9c 94 59 1d ba ...*.....,...Y.. 0080 2b 40 3a 81 ac c4 8d 91 3e a2 9b b5 2a ca 37 a5 +@:.....>...*.7. 0090 84 68 f9 ea af 6f ad 11 4a 87 1a bf 3f 33 cc 42 .h...o..J...?3.B 00a0 a0 d2 7f 2a 63 73 e3 13 03 aa dd cd 02 68 64 ce ...*cs.......hd. 00b0 54 92 d6 f5 fb 42 3b 1e 6d 0f 30 f5 a8 ad 43 ea T....B;.m.0...C. 00c0 59 aa eb ef 47 c8 1d 7d ae 86 82 00 00 14 c4 d0 Y...G..}........ 00d0 7e 09 2f 68 fb 81 a9 0d 1f d5 ed a2 d8 2f 82 00 ~./h........./.. 00e0 00 18 18 4d 12 54 71 58 e1 1c 69 3a 31 7e f1 94 ...M.TqX..i:1~.. 00f0 39 63 7c 9f 4d 24 00 00 00 18 52 0f 56 49 e2 f4 9c|.M$....R.VI.. 0100 81 ed b5 b4 8b 3c 98 56 d1 2a 42 d9 3a 1e f9 dc .....<.V.*B.:... 0110 99 20 . Frame 5 (138 bytes on wire, 138 bytes captured) Arrival Time: Aug 13, 2004 11:34:13.155532000 Time delta from previous packet: 1.066118000 seconds Time since reference or first frame: 3.239034000 seconds Frame Number: 5 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0x0a9ee214 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0092 (146) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfb1e (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x5822 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x490BBA048BEF1347 Responder cookie: 0xD4BCF4BC26E381E7 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 e0 13 00 2c 4a 00 0c 29 00 82 53 08 00 45 00 ....,J..)..S..E. 0010 00 78 00 92 00 00 80 11 fb 1e a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 89 01 f4 01 f4 00 64 58 22 49 0b ba 04 8b ef .......dX"I..... 0030 13 47 d4 bc f4 bc 26 e3 81 e7 05 10 02 01 00 00 .G....&......... 0040 00 00 00 00 00 5c 99 54 04 23 5d 4b 1a fd d4 80 .....\.T.#]K.... 0050 ee 18 3c 2e 1f a8 3b 6c c6 ba ff 52 61 55 6c eb ..<...;l...RaUl. 0060 ef 5f 6e a9 08 88 20 a5 a3 64 66 e0 af ce eb 55 ._n... ..df....U 0070 55 60 74 d1 36 7f db 6d e2 82 07 6e 89 5e 7d 8b U`t.6..m...n.^}. 0080 a9 08 b5 26 ec aa 0a 9e e2 14 ...&...... Frame 6 (86 bytes on wire, 86 bytes captured) Arrival Time: Aug 13, 2004 11:34:13.167179000 Time delta from previous packet: 0.011647000 seconds Time since reference or first frame: 3.250681000 seconds Frame Number: 6 Packet Length: 86 bytes Capture Length: 86 bytes Ethernet II, Src: 00:e0:13:00:2c:4a, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Type: IP (0x0800) Frame check sequence: 0x37cc825d (correct) Internet Protocol, Src Addr: 165.227.249.137 (165.227.249.137), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 68 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbe4 (correct) Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 48 Checksum: 0x96ff (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x490BBA048BEF1347 Responder cookie: 0xD4BCF4BC26E381E7 Next payload: Notification (11) Version: 1.0 Exchange type: Informational (5) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 40 Notification payload Next payload: NONE (0) Length: 12 Domain of Interpretation: IPSEC (1) Protocol ID: ISAKMP (1) SPI size: 0 Message type: INVALID-ID-INFORMATION (18) 0000 00 0c 29 00 82 53 00 e0 13 00 2c 4a 08 00 45 00 ..)..S....,J..E. 0010 00 44 00 00 40 00 40 11 fb e4 a5 e3 f9 89 a5 e3 .D..@.@......... 0020 f9 73 01 f4 01 f4 00 30 96 ff 49 0b ba 04 8b ef .s.....0..I..... 0030 13 47 d4 bc f4 bc 26 e3 81 e7 0b 10 05 00 00 00 .G....&......... 0040 00 00 00 00 00 28 00 00 00 0c 00 00 00 01 01 00 .....(.......... 0050 00 12 37 cc 82 5d ..7..] Frame 7 (170 bytes on wire, 170 bytes captured) Arrival Time: Aug 13, 2004 11:34:15.124763000 Time delta from previous packet: 1.957584000 seconds Time since reference or first frame: 5.208265000 seconds Frame Number: 7 Packet Length: 170 bytes Capture Length: 170 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0xfaa54324 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0096 (150) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfafa (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x729d (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x8F73400F2248A813 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 e0 13 00 2c 4a 00 0c 29 00 82 53 08 00 45 00 ....,J..)..S..E. 0010 00 98 00 96 00 00 80 11 fa fa a5 e3 f9 73 a5 e3 .............s.. 0020 f9 89 01 f4 01 f4 00 84 72 9d 8f 73 40 0f 22 48 ........r..s@."H 0030 a8 13 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f fa a5 43 24 ...B{...C$ Frame 8 (150 bytes on wire, 150 bytes captured) Arrival Time: Aug 13, 2004 11:34:15.130195000 Time delta from previous packet: 0.005432000 seconds Time since reference or first frame: 5.213697000 seconds Frame Number: 8 Packet Length: 150 bytes Capture Length: 150 bytes Ethernet II, Src: 00:e0:13:00:2c:4a, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Type: IP (0x0800) Frame check sequence: 0xa308c9a7 (correct) Internet Protocol, Src Addr: 165.227.249.137 (165.227.249.137), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba4 (correct) Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0x76b1 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x8F73400F2248A813 Responder cookie: 0xF42D458CBD8FBCF3 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 0000 00 0c 29 00 82 53 00 e0 13 00 2c 4a 08 00 45 00 ..)..S....,J..E. 0010 00 84 00 00 40 00 40 11 fb a4 a5 e3 f9 89 a5 e3 ....@.@......... 0020 f9 73 01 f4 01 f4 00 70 76 b1 8f 73 40 0f 22 48 .s.....pv..s@."H 0030 a8 13 f4 2d 45 8c bd 8f bc f3 01 10 02 00 00 00 ...-E........... 0040 00 00 00 00 00 68 0d 00 00 38 00 00 00 01 00 00 .....h...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 00 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc a3 08 c9 a7 ...... Frame 9 (350 bytes on wire, 350 bytes captured) Arrival Time: Aug 13, 2004 11:34:16.868337000 Time delta from previous packet: 1.738142000 seconds Time since reference or first frame: 6.951839000 seconds Frame Number: 9 Packet Length: 350 bytes Capture Length: 350 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0x69324d69 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x0097 (151) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa45 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0x5221 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x8F73400F2248A813 Responder cookie: 0xF42D458CBD8FBCF3 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Private USE (130) Length: 24 Nonce Data Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: Vendor ID (13) Length: 24 Payload Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E5... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 e0 13 00 2c 4a 00 0c 29 00 82 53 08 00 45 00 ....,J..)..S..E. 0010 01 4c 00 97 00 00 80 11 fa 45 a5 e3 f9 73 a5 e3 .L.......E...s.. 0020 f9 89 01 f4 01 f4 01 38 52 21 8f 73 40 0f 22 48 .......8R!.s@."H 0030 a8 13 f4 2d 45 8c bd 8f bc f3 04 10 02 00 00 00 ...-E........... 0040 00 00 00 00 01 30 0a 00 00 84 71 2b aa 18 34 0f .....0....q+..4. 0050 af ff 90 33 36 a3 f6 6f c2 86 af 42 07 eb ca 43 ...36..o...B...C 0060 22 05 e7 e6 c5 3c e8 28 a9 89 1c a1 68 d6 26 58 "....<.(....h.&X 0070 65 22 2f 1e d9 11 93 77 46 f8 a4 ab e0 22 a7 89 e"/....wF....".. 0080 46 11 78 1d b1 7b 49 5b 38 51 81 a8 4f fd 59 c8 F.x..{I[8Q..O.Y. 0090 91 3c f9 92 38 a7 9f 11 46 40 f6 63 20 b2 4f 5c .<..8...F@.c .O\ 00a0 7d 17 b6 86 bd c6 1c fd fa 30 d5 1f ca 7f ba b9 }........0...... 00b0 1a 29 26 af a6 e2 7b 0d 86 77 98 0d 3a 19 6b 1c .)&...{..w..:.k. 00c0 71 ac 47 99 cc 4d 22 52 e2 df 82 00 00 18 07 e8 q.G..M"R........ 00d0 b0 0b 0a e6 19 86 2e ed 47 fa 61 af 3f 46 57 e1 ........G.a.?FW. 00e0 e8 62 82 00 00 18 fb 9e ed 85 f6 79 f6 f0 97 a3 .b.........y.... 00f0 44 23 a1 48 bb 60 8e 20 24 70 0d 00 00 18 b3 ec D#.H.`. $p...... 0100 5b 0a fb fc 40 6f ab 46 59 5d d4 be 01 ad 74 be [...@o.FY]....t. 0110 ce 44 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .D...0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 69 32 4d 69 ....&.....i2Mi Frame 10 (64 bytes on wire, 64 bytes captured) Arrival Time: Aug 13, 2004 11:34:16.868563000 Time delta from previous packet: 0.000226000 seconds Time since reference or first frame: 6.952065000 seconds Frame Number: 10 Packet Length: 64 bytes Capture Length: 64 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Trailer: 00000000000000000000000000000000... Frame check sequence: 0x3f715b0b (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 29 Identification: 0x0098 (152) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfb73 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 9 Checksum: 0xbe2e (correct) Internet Security Association and Key Management Protocol [Malformed Packet: ISAKMP] 0000 00 e0 13 00 2c 4a 00 0c 29 00 82 53 08 00 45 00 ....,J..)..S..E. 0010 00 1d 00 98 00 00 80 11 fb 73 a5 e3 f9 73 a5 e3 .........s...s.. 0020 f9 89 01 f4 01 f4 00 09 be 2e ff 00 00 00 00 00 ................ 0030 00 00 00 00 00 00 00 00 00 00 00 00 3f 71 5b 0b ............?q[. Frame 11 (274 bytes on wire, 274 bytes captured) Arrival Time: Aug 13, 2004 11:34:16.885146000 Time delta from previous packet: 0.016583000 seconds Time since reference or first frame: 6.968648000 seconds Frame Number: 11 Packet Length: 274 bytes Capture Length: 274 bytes Ethernet II, Src: 00:e0:13:00:2c:4a, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Type: IP (0x0800) Frame check sequence: 0x0a4e0b27 (correct) Internet Protocol, Src Addr: 165.227.249.137 (165.227.249.137), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb28 (correct) Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x5ab4 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x8F73400F2248A813 Responder cookie: 0xF42D458CBD8FBCF3 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Private USE (130) Length: 20 Nonce Data Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: NONE (0) Length: 24 Payload 0000 00 0c 29 00 82 53 00 e0 13 00 2c 4a 08 00 45 00 ..)..S....,J..E. 0010 01 00 00 00 40 00 40 11 fb 28 a5 e3 f9 89 a5 e3 ....@.@..(...... 0020 f9 73 01 f4 01 f4 00 ec 5a b4 8f 73 40 0f 22 48 .s......Z..s@."H 0030 a8 13 f4 2d 45 8c bd 8f bc f3 04 10 02 00 00 00 ...-E........... 0040 00 00 00 00 00 e4 0a 00 00 84 98 b2 79 ee 61 3f ............y.a? 0050 d7 57 aa 0e 94 d5 fa 02 9f 86 5e 39 f6 f7 b9 e6 .W........^9.... 0060 ce dc 76 e2 b6 a0 9d be 20 b4 3d 3e 02 0b ab e1 ..v..... .=>.... 0070 50 84 08 78 76 50 85 75 3e 50 59 55 2a b5 19 90 P..xvP.u>PYU*... 0080 d4 f5 d6 8c c4 12 ca 24 d5 31 2e a9 c6 21 2e ec .......$.1...!.. 0090 42 d6 54 57 20 55 55 f1 9d 4f 86 f4 a4 a3 22 01 B.TW UU..O....". 00a0 12 5b 80 94 42 2b fc 09 0e 3e cb 9e 17 9d 02 ac .[..B+...>...... 00b0 ae 2a 2b 86 fd 3f b0 2c 97 63 50 9f cf 96 fd 95 .*+..?.,.cP..... 00c0 0a 1a a8 49 b4 84 21 66 cf 12 82 00 00 14 b2 8e ...I..!f........ 00d0 53 d3 c1 6a e0 59 6b fd 01 ca a3 00 8b 83 82 00 S..j.Yk......... 00e0 00 18 b3 ec 5b 0a fb fc 40 6f ab 46 59 5d d4 be ....[...@o.FY].. 00f0 01 ad 74 be ce 44 00 00 00 18 fb 9e ed 85 f6 79 ..t..D.........y 0100 f6 f0 97 a3 44 23 a1 48 bb 60 8e 20 24 70 0a 4e ....D#.H.`. $p.N 0110 0b 27 .' Frame 12 (122 bytes on wire, 122 bytes captured) Arrival Time: Aug 13, 2004 11:34:17.927796000 Time delta from previous packet: 1.042650000 seconds Time since reference or first frame: 8.011298000 seconds Frame Number: 12 Packet Length: 122 bytes Capture Length: 122 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0x8fefac83 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0099 (153) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfb27 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x113f (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x8F73400F2248A813 Responder cookie: 0xF42D458CBD8FBCF3 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 e0 13 00 2c 4a 00 0c 29 00 82 53 08 00 45 00 ....,J..)..S..E. 0010 00 68 00 99 00 00 80 11 fb 27 a5 e3 f9 73 a5 e3 .h.......'...s.. 0020 f9 89 01 f4 01 f4 00 54 11 3f 8f 73 40 0f 22 48 .......T.?.s@."H 0030 a8 13 f4 2d 45 8c bd 8f bc f3 05 10 02 01 00 00 ...-E........... 0040 00 00 00 00 00 4c 9a f2 85 98 b3 6f 45 7c 6e b6 .....L.....oE|n. 0050 81 5f 3c 11 1c 6d b6 35 86 e2 d8 53 91 e9 0b d7 ._<..m.5...S.... 0060 fb 15 49 c1 2b ef 62 a1 5c ef 98 f1 7a 37 9a 74 ..I.+.b.\...z7.t 0070 ab 1c 85 22 32 75 8f ef ac 83 ..."2u.... Frame 13 (122 bytes on wire, 122 bytes captured) Arrival Time: Aug 13, 2004 11:34:17.930152000 Time delta from previous packet: 0.002356000 seconds Time since reference or first frame: 8.013654000 seconds Frame Number: 13 Packet Length: 122 bytes Capture Length: 122 bytes Ethernet II, Src: 00:e0:13:00:2c:4a, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Type: IP (0x0800) Frame check sequence: 0xdd42170a (correct) Internet Protocol, Src Addr: 165.227.249.137 (165.227.249.137), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc0 (correct) Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xdbc9 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x8F73400F2248A813 Responder cookie: 0xF42D458CBD8FBCF3 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 00 82 53 00 e0 13 00 2c 4a 08 00 45 00 ..)..S....,J..E. 0010 00 68 00 00 40 00 40 11 fb c0 a5 e3 f9 89 a5 e3 .h..@.@......... 0020 f9 73 01 f4 01 f4 00 54 db c9 8f 73 40 0f 22 48 .s.....T...s@."H 0030 a8 13 f4 2d 45 8c bd 8f bc f3 05 10 02 01 00 00 ...-E........... 0040 00 00 00 00 00 4c 73 f5 d5 a3 54 54 df fd 12 71 .....Ls...TT...q 0050 ff 5b e5 a9 28 9a a0 8d 0a 66 f2 25 75 aa 60 8f .[..(....f.%u.`. 0060 73 22 c5 e0 96 a4 c5 3d 73 90 d6 e0 90 f9 53 b9 s".....=s.....S. 0070 99 8a 19 e0 02 92 dd 42 17 0a .......B.. Frame 14 (346 bytes on wire, 346 bytes captured) Arrival Time: Aug 13, 2004 11:34:20.185120000 Time delta from previous packet: 2.254968000 seconds Time since reference or first frame: 10.268622000 seconds Frame Number: 14 Packet Length: 346 bytes Capture Length: 346 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0x84fa413c (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x009b (155) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa45 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x05df (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x8F73400F2248A813 Responder cookie: 0xF42D458CBD8FBCF3 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x2DA7050E Length: 300 Encrypted payload (272 bytes) 0000 00 e0 13 00 2c 4a 00 0c 29 00 82 53 08 00 45 00 ....,J..)..S..E. 0010 01 48 00 9b 00 00 80 11 fa 45 a5 e3 f9 73 a5 e3 .H.......E...s.. 0020 f9 89 01 f4 01 f4 01 34 05 df 8f 73 40 0f 22 48 .......4...s@."H 0030 a8 13 f4 2d 45 8c bd 8f bc f3 08 10 20 01 2d a7 ...-E....... .-. 0040 05 0e 00 00 01 2c ae 7d fd 14 cf 83 1d 21 88 70 .....,.}.....!.p 0050 86 d5 fb 49 41 94 5e f6 b4 40 fb 8e b7 e0 62 6f ...IA.^..@....bo 0060 4b 6e a8 ed 2e be 95 6c ed 77 04 0a ce c1 1e d1 Kn.....l.w...... 0070 1c e6 62 10 af b3 27 3b 0a 65 3b 08 8d 84 ae 78 ..b...';.e;....x 0080 6f b8 d2 16 9e 2d e6 1c ba 0c 03 e0 f5 61 ba 69 o....-.......a.i 0090 74 ed 15 af d3 58 55 75 d2 ae a2 39 7e 88 f6 92 t....XUu...9~... 00a0 e0 3c 6a e4 65 a1 b4 9e 70 a9 56 a7 5b 07 40 cb ....*.7. 0090 84 68 f9 ea af 6f ad 11 4a 87 1a bf 3f 33 cc 42 .h...o..J...?3.B 00a0 a0 d2 7f 2a 63 73 e3 13 03 aa dd cd 02 68 64 ce ...*cs.......hd. 00b0 54 92 d6 f5 fb 42 3b 1e 6d 0f 30 f5 a8 ad 43 ea T....B;.m.0...C. 00c0 59 aa eb ef 47 c8 1d 7d ae 86 82 00 00 14 c4 d0 Y...G..}........ 00d0 7e 09 2f 68 fb 81 a9 0d 1f d5 ed a2 d8 2f 82 00 ~./h........./.. 00e0 00 18 18 4d 12 54 71 58 e1 1c 69 3a 31 7e f1 94 ...M.TqX..i:1~.. 00f0 39 63 7c 9f 4d 24 00 00 00 18 52 0f 56 49 e2 f4 9c|.M$....R.VI.. 0100 81 ed b5 b4 8b 3c 98 56 d1 2a 42 d9 3a 1e f9 dc .....<.V.*B.:... 0110 99 20 . Frame 18 (138 bytes on wire, 138 bytes captured) Arrival Time: Aug 13, 2004 11:34:25.105997000 Time delta from previous packet: 2.768097000 seconds Time since reference or first frame: 15.189499000 seconds Frame Number: 18 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0x0204f91c (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb8e (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) Encapsulating Security Payload SPI: 0xa7781950 Sequence: 1 Data (92 bytes) 0000 00 e0 13 00 2c 4a 00 0c 29 00 82 53 08 00 45 00 ....,J..)..S..E. 0010 00 78 00 01 00 00 80 32 fb 8e a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 89 a7 78 19 50 00 00 00 01 0c e8 49 62 ff 75 ...x.P......Ib.u 0030 49 af 6d fb 34 62 84 05 7e 96 ac 64 72 72 a2 f7 I.m.4b..~..drr.. 0040 e3 80 86 b0 69 99 e1 68 a6 fa b3 70 15 a2 54 57 ....i..h...p..TW 0050 24 5f bb 91 69 2f da 33 29 c2 12 fc 67 7d eb 89 $_..i/.3)...g}.. 0060 18 09 e1 52 10 7a aa 6d e8 52 e3 13 51 af 24 bf ...R.z.m.R..Q.$. 0070 5e 1e 21 61 99 41 28 f2 27 f3 a0 d8 81 e7 4a 39 ^.!a.A(.'.....J9 0080 09 c4 29 5e 31 22 02 04 f9 1c ..)^1".... Frame 19 (138 bytes on wire, 138 bytes captured) Arrival Time: Aug 13, 2004 11:34:25.108667000 Time delta from previous packet: 0.002670000 seconds Time since reference or first frame: 15.192169000 seconds Frame Number: 19 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:e0:13:00:2c:4a, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Type: IP (0x0800) Frame check sequence: 0xf32ac1ba (correct) Internet Protocol, Src Addr: 165.227.249.137 (165.227.249.137), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0fff (4095) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x2b91 (correct) Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0xeaf6a6be Sequence: 1 Data (92 bytes) 0000 00 0c 29 00 82 53 00 e0 13 00 2c 4a 08 00 45 00 ..)..S....,J..E. 0010 00 78 0f ff 00 00 40 32 2b 91 a5 e3 f9 89 a5 e3 .x....@2+....... 0020 f9 73 ea f6 a6 be 00 00 00 01 a7 53 cf f9 a2 0f .s.........S.... 0030 65 f5 a1 d2 29 61 34 69 2c 65 24 67 f6 3e dd 39 e...)a4i,e$g.>.9 0040 93 5a d6 fb a9 61 46 be ef de f8 c4 76 6d 20 10 .Z...aF.....vm . 0050 b4 b0 ac d3 1b 36 4c 46 f6 1f 82 45 12 32 f6 6f .....6LF...E.2.o 0060 fa 93 b9 82 94 5e 8d fa 56 7b ef 1f 64 f0 b8 ae .....^..V{..d... 0070 91 cc 43 0f b4 64 5c f4 80 79 97 2d 73 39 a0 a2 ..C..d\..y.-s9.. 0080 d3 c4 85 ea d7 71 f3 2a c1 ba .....q.*.. Frame 20 (138 bytes on wire, 138 bytes captured) Arrival Time: Aug 13, 2004 11:34:27.149163000 Time delta from previous packet: 2.040496000 seconds Time since reference or first frame: 17.232665000 seconds Frame Number: 20 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0x36c47752 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb8d (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) Encapsulating Security Payload SPI: 0xa7781950 Sequence: 2 Data (92 bytes) 0000 00 e0 13 00 2c 4a 00 0c 29 00 82 53 08 00 45 00 ....,J..)..S..E. 0010 00 78 00 02 00 00 80 32 fb 8d a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 89 a7 78 19 50 00 00 00 02 e3 13 51 af 24 bf ...x.P......Q.$. 0030 5e 1e 21 61 99 41 28 f2 27 f3 84 b3 2e 29 28 95 ^.!a.A(.'....)(. 0040 3c 68 a5 d0 d1 71 bd 7b e8 9d 82 bf fb c5 69 5b i...K. 0050 52 6c 0b 60 88 11 09 6b 92 f3 2c c6 cc 3c ec 8d Rl.`...k..,..<.. 0060 45 aa c0 31 51 ec a7 41 27 44 3c 38 54 2e d1 d5 E..1Q..A'D<8T... 0070 00 ac b7 a4 6d 16 b0 06 eb a3 89 dc 41 c6 51 1e ....m.......A.Q. 0080 03 ae 94 e5 85 32 3a 7e df 84 .....2:~.. Frame 24 (138 bytes on wire, 138 bytes captured) Arrival Time: Aug 13, 2004 11:34:29.155194000 Time delta from previous packet: 0.998049000 seconds Time since reference or first frame: 19.238696000 seconds Frame Number: 24 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0xdeb29784 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0004 (4) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb8b (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) Encapsulating Security Payload SPI: 0xa7781950 Sequence: 4 Data (92 bytes) 0000 00 e0 13 00 2c 4a 00 0c 29 00 82 53 08 00 45 00 ....,J..)..S..E. 0010 00 78 00 04 00 00 80 32 fb 8b a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 89 a7 78 19 50 00 00 00 04 a8 ad 4e b3 a8 98 ...x.P......N... 0030 32 f0 5a b9 5d 41 40 69 f3 43 02 e8 44 a4 d1 32 2.Z.]A@i.C..D..2 0040 ab d4 17 6c e7 13 fb 1d 6e 7a cb 5c dd 71 a7 65 ...l....nz.\.q.e 0050 c7 76 c9 57 a6 79 b5 b6 d8 82 8a ee c8 1b 5d 13 .v.W.y........]. 0060 91 dc dd 6a 65 1e c8 f3 6a da 50 00 1f 6a ce 95 ...je...j.P..j.. 0070 e0 86 af 85 7a eb 26 65 44 42 f7 9d 23 b5 f2 01 ....z.&eDB..#... 0080 25 31 a8 df 51 2f de b2 97 84 %1..Q/.... Frame 25 (138 bytes on wire, 138 bytes captured) Arrival Time: Aug 13, 2004 11:34:29.157761000 Time delta from previous packet: 0.002567000 seconds Time since reference or first frame: 19.241263000 seconds Frame Number: 25 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:e0:13:00:2c:4a, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Type: IP (0x0800) Frame check sequence: 0x26def802 (correct) Internet Protocol, Src Addr: 165.227.249.137 (165.227.249.137), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x1002 (4098) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x2b8e (correct) Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0xeaf6a6be Sequence: 4 Data (92 bytes) 0000 00 0c 29 00 82 53 00 e0 13 00 2c 4a 08 00 45 00 ..)..S....,J..E. 0010 00 78 10 02 00 00 40 32 2b 8e a5 e3 f9 89 a5 e3 .x....@2+....... 0020 f9 73 ea f6 a6 be 00 00 00 04 3c 38 54 2e d1 d5 .s........<8T... 0030 00 ac b7 a4 6d 16 b0 06 eb a3 af 32 66 0d 8c 97 ....m......2f... 0040 d3 ea 38 da 71 90 c8 fc d3 2a f4 0c 97 b2 70 3a ..8.q....*....p: 0050 77 53 62 bf 39 83 c8 05 63 be 36 d3 7e 54 b3 b8 wSb.9...c.6.~T.. 0060 8a ad 13 38 78 3f cc 8b 20 18 59 5e 58 cf ce 5e ...8x?.. .Y^X..^ 0070 70 be 1b d9 5e 39 af d8 9d 3e 26 e7 99 ea 25 ba p...^9...>&...%. 0080 b4 6d 17 56 83 b4 26 de f8 02 .m.V..&... Frame 26 (138 bytes on wire, 138 bytes captured) Arrival Time: Aug 13, 2004 11:34:30.163018000 Time delta from previous packet: 1.005257000 seconds Time since reference or first frame: 20.246520000 seconds Frame Number: 26 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0x87a37261 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0005 (5) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb8a (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) Encapsulating Security Payload SPI: 0xa7781950 Sequence: 5 Data (92 bytes) 0000 00 e0 13 00 2c 4a 00 0c 29 00 82 53 08 00 45 00 ....,J..)..S..E. 0010 00 78 00 05 00 00 80 32 fb 8a a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 89 a7 78 19 50 00 00 00 05 50 00 1f 6a ce 95 ...x.P....P..j.. 0030 e0 86 af 85 7a eb 26 65 44 42 c9 42 fa 2b 90 15 ....z.&eDB.B.+.. 0040 50 4f 4c b8 d8 b1 55 f6 33 d5 7b e1 69 81 0b 8f POL...U.3.{.i... 0050 2e 82 29 f5 24 6f 9e 4a 3d d4 76 45 21 84 b7 3e ..).$o.J=.vE!..> 0060 c7 42 ed 15 7f dd 28 9f a6 ad 2a 93 63 4b 82 4e .B....(...*.cK.N 0070 47 57 f6 0a d0 ca 43 2e 8a d3 58 70 3b 7f 7f 2f GW....C...Xp;../ 0080 72 91 9a 26 72 39 87 a3 72 61 r..&r9..ra Frame 27 (138 bytes on wire, 138 bytes captured) Arrival Time: Aug 13, 2004 11:34:30.164066000 Time delta from previous packet: 0.001048000 seconds Time since reference or first frame: 20.247568000 seconds Frame Number: 27 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:e0:13:00:2c:4a, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Type: IP (0x0800) Frame check sequence: 0x87b82dae (correct) Internet Protocol, Src Addr: 165.227.249.137 (165.227.249.137), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x1003 (4099) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x2b8d (correct) Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0xeaf6a6be Sequence: 5 Data (92 bytes) 0000 00 0c 29 00 82 53 00 e0 13 00 2c 4a 08 00 45 00 ..)..S....,J..E. 0010 00 78 10 03 00 00 40 32 2b 8d a5 e3 f9 89 a5 e3 .x....@2+....... 0020 f9 73 ea f6 a6 be 00 00 00 05 59 5e 58 cf ce 5e .s........Y^X..^ 0030 70 be 1b d9 5e 39 af d8 9d 3e f2 f3 a0 ef cd 8d p...^9...>...... 0040 72 86 0c ea 0e ae 59 86 68 7b d2 ec 11 f8 34 96 r.....Y.h{....4. 0050 a8 26 f8 e2 ef af 9e b6 eb 04 4c 83 93 c7 b2 08 .&........L..... 0060 af bb f1 4b b4 e0 e0 b8 fa 39 57 de dc 0b f1 94 ...K.....9W..... 0070 69 58 03 1f b0 8e ef 05 e9 a1 5e e3 a4 82 0d 8b iX........^..... 0080 fa 03 68 f8 cc bc 87 b8 2d ae ..h.....-.