Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: May 27, 2009 15:39:58.542305000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x05b6 (1462) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf5d9 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0xef1b [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E62AA3C252C3F94 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 24 b2 31 e1 3d 00 0c 29 6d a9 a5 08 00 45 00 .$.1.=..)m....E. 0010 00 98 05 b6 00 00 80 11 f5 d9 a5 e3 f9 73 a5 e3 .............s.. 0020 f9 8a 01 f4 01 f4 00 84 ef 1b 0e 62 aa 3c 25 2c ...........b.<%, 0030 3f 94 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ?............... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (166 bytes on wire, 166 bytes captured) Arrival Time: May 27, 2009 15:39:58.542312000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 0.000007000 seconds] Frame Number: 2 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x05b6 (1462) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf5d9 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0xef1b [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E62AA3C252C3F94 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 24 b2 31 e1 3d 00 0c 29 6d a9 a5 08 00 45 00 .$.1.=..)m....E. 0010 00 98 05 b6 00 00 80 11 f5 d9 a5 e3 f9 73 a5 e3 .............s.. 0020 f9 8a 01 f4 01 f4 00 84 ef 1b 0e 62 aa 3c 25 2c ...........b.<%, 0030 3f 94 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ?............... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 3 (166 bytes on wire, 166 bytes captured) Arrival Time: May 27, 2009 15:39:58.707311000 [Time delta from previous captured frame: 0.164999000 seconds] [Time delta from previous displayed frame: 0.164999000 seconds] [Time since reference or first frame: 0.165006000 seconds] Frame Number: 3 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb8f [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x2fae [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E62AA3C252C3F94 Responder cookie: BD57B1FA242DA370 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 6d a9 a5 00 24 b2 31 e1 3d 08 00 45 00 ..)m...$.1.=..E. 0010 00 98 00 00 40 00 40 11 fb 8f a5 e3 f9 8a a5 e3 ....@.@......... 0020 f9 73 01 f4 01 f4 00 84 2f ae 0e 62 aa 3c 25 2c .s....../..b.<%, 0030 3f 94 bd 57 b1 fa 24 2d a3 70 01 10 02 00 00 00 ?..W..$-.p...... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 3b 90 31 dc e4 fc f8 8b 48 9a 92 39 63 dd ..;.1.....H..9c. 0090 0c 49 00 00 00 14 70 03 cb c1 09 7d be 9c 26 00 .I....p....}..&. 00a0 ba 69 83 bc 8b 35 .i...5 Frame 4 (298 bytes on wire, 298 bytes captured) Arrival Time: May 27, 2009 15:40:00.893798000 [Time delta from previous captured frame: 2.186487000 seconds] [Time delta from previous displayed frame: 2.186487000 seconds] [Time since reference or first frame: 2.351493000 seconds] Frame Number: 4 Frame Length: 298 bytes Capture Length: 298 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x05b9 (1465) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf552 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xe28a [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E62AA3C252C3F94 Responder cookie: BD57B1FA242DA370 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 24 b2 31 e1 3d 00 0c 29 6d a9 a5 08 00 45 00 .$.1.=..)m....E. 0010 01 1c 05 b9 00 00 80 11 f5 52 a5 e3 f9 73 a5 e3 .........R...s.. 0020 f9 8a 01 f4 01 f4 01 08 e2 8a 0e 62 aa 3c 25 2c ...........b.<%, 0030 3f 94 bd 57 b1 fa 24 2d a3 70 04 10 02 00 00 00 ?..W..$-.p...... 0040 00 00 00 00 01 00 0a 00 00 84 6a 62 5c b0 82 40 ..........jb\..@ 0050 0d f6 86 04 b8 08 65 fb 4e e1 a6 27 e6 fb ce 89 ......e.N..'.... 0060 52 9c 8f 7e ba a3 f5 04 35 b8 80 3f 63 cf 86 b0 R..~....5..?c... 0070 dc 86 f9 2f cd 52 88 07 5b 9a a9 22 70 15 bc 21 .../.R..[.."p..! 0080 8b 40 e1 e0 1e 59 bf 38 f4 b6 24 a5 52 8d 61 6a .@...Y.8..$.R.aj 0090 7d 94 67 6f c6 a5 87 ae 57 ec 18 77 e4 d3 ab 8e }.go....W..w.... 00a0 a5 2a e0 d5 64 3f 60 68 0e 80 e3 b0 71 ba 02 86 .*..d?`h....q... 00b0 b1 ca e6 3d b5 3b d2 b1 ac 27 68 b8 31 b5 2a d9 ...=.;...'h.1.*. 00c0 10 ff cc fb a8 b1 a6 f7 12 d0 0d 00 00 18 e0 4b ...............K 00d0 4b 84 26 b5 88 50 fc 5b 6e 88 aa b9 ae fd e0 2a K.&..P.[n......* 00e0 0c 63 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .c...0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 5 (298 bytes on wire, 298 bytes captured) Arrival Time: May 27, 2009 15:40:00.893811000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 2.351506000 seconds] Frame Number: 5 Frame Length: 298 bytes Capture Length: 298 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x05b9 (1465) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf552 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xe28a [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E62AA3C252C3F94 Responder cookie: BD57B1FA242DA370 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 24 b2 31 e1 3d 00 0c 29 6d a9 a5 08 00 45 00 .$.1.=..)m....E. 0010 01 1c 05 b9 00 00 80 11 f5 52 a5 e3 f9 73 a5 e3 .........R...s.. 0020 f9 8a 01 f4 01 f4 01 08 e2 8a 0e 62 aa 3c 25 2c ...........b.<%, 0030 3f 94 bd 57 b1 fa 24 2d a3 70 04 10 02 00 00 00 ?..W..$-.p...... 0040 00 00 00 00 01 00 0a 00 00 84 6a 62 5c b0 82 40 ..........jb\..@ 0050 0d f6 86 04 b8 08 65 fb 4e e1 a6 27 e6 fb ce 89 ......e.N..'.... 0060 52 9c 8f 7e ba a3 f5 04 35 b8 80 3f 63 cf 86 b0 R..~....5..?c... 0070 dc 86 f9 2f cd 52 88 07 5b 9a a9 22 70 15 bc 21 .../.R..[.."p..! 0080 8b 40 e1 e0 1e 59 bf 38 f4 b6 24 a5 52 8d 61 6a .@...Y.8..$.R.aj 0090 7d 94 67 6f c6 a5 87 ae 57 ec 18 77 e4 d3 ab 8e }.go....W..w.... 00a0 a5 2a e0 d5 64 3f 60 68 0e 80 e3 b0 71 ba 02 86 .*..d?`h....q... 00b0 b1 ca e6 3d b5 3b d2 b1 ac 27 68 b8 31 b5 2a d9 ...=.;...'h.1.*. 00c0 10 ff cc fb a8 b1 a6 f7 12 d0 0d 00 00 18 e0 4b ...............K 00d0 4b 84 26 b5 88 50 fc 5b 6e 88 aa b9 ae fd e0 2a K.&..P.[n......* 00e0 0c 63 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .c...0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 6 (242 bytes on wire, 242 bytes captured) Arrival Time: May 27, 2009 15:40:01.263325000 [Time delta from previous captured frame: 0.369514000 seconds] [Time delta from previous displayed frame: 0.369514000 seconds] [Time since reference or first frame: 2.721020000 seconds] Frame Number: 6 Frame Length: 242 bytes Capture Length: 242 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb43 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0xc372 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E62AA3C252C3F94 Responder cookie: BD57B1FA242DA370 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 20 Nonce Data Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 6d a9 a5 00 24 b2 31 e1 3d 08 00 45 00 ..)m...$.1.=..E. 0010 00 e4 00 00 40 00 40 11 fb 43 a5 e3 f9 8a a5 e3 ....@.@..C...... 0020 f9 73 01 f4 01 f4 00 d0 c3 72 0e 62 aa 3c 25 2c .s.......r.b.<%, 0030 3f 94 bd 57 b1 fa 24 2d a3 70 04 10 02 00 00 00 ?..W..$-.p...... 0040 00 00 00 00 00 c8 0a 00 00 84 56 0b 29 da 5e 9e ..........V.).^. 0050 8d b0 27 48 b8 86 7d 15 f2 98 a8 1c 26 0c 83 9f ..'H..}.....&... 0060 bd 94 ce 94 3f 84 76 a8 b5 b3 a6 22 45 2d c7 92 ....?.v...."E-.. 0070 79 5e 68 30 da 56 f2 fe 03 70 eb 3b e0 bc 15 ae y^h0.V...p.;.... 0080 10 68 b5 3c e0 92 90 b5 bc b5 cd 5b 56 1a 6e 94 .h.<.......[V.n. 0090 58 58 24 88 33 55 96 36 ff 9a eb da 94 4f 65 28 XX$.3U.6.....Oe( 00a0 2d ad a2 cc 8e 3a a2 f7 f4 f6 ea f4 94 77 d7 98 -....:.......w.. 00b0 f6 88 66 4b 20 a6 5d 64 53 60 f0 81 eb 13 cd 5c ..fK .]dS`.....\ 00c0 64 9f 34 df 58 7f 61 a4 da e1 0d 00 00 14 96 4b d.4.X.a........K 00d0 b5 3a 36 22 6b a2 f6 2c f4 4b 4c 4e 1d 45 00 00 .:6"k..,.KLN.E.. 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 15:40:02.243206000 [Time delta from previous captured frame: 0.979881000 seconds] [Time delta from previous displayed frame: 0.979881000 seconds] [Time since reference or first frame: 3.700901000 seconds] Frame Number: 7 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x05bd (1469) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf5f2 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xf124 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E62AA3C252C3F94 Responder cookie: BD57B1FA242DA370 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 6d a9 a5 08 00 45 00 .$.1.=..)m....E. 0010 00 78 05 bd 00 00 80 11 f5 f2 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 8a 01 f4 01 f4 00 64 f1 24 0e 62 aa 3c 25 2c .......d.$.b.<%, 0030 3f 94 bd 57 b1 fa 24 2d a3 70 05 10 02 01 00 00 ?..W..$-.p...... 0040 00 00 00 00 00 5c 7e d9 02 6f 62 fb 3f a3 42 ff .....\~..ob.?.B. 0050 da 4a 86 03 bc 0b 7e 9b ad 09 cf 7a 7c d2 57 ff .J....~....z|.W. 0060 5d 47 25 cf 94 82 5d 50 40 1e 32 27 e2 d6 0a 68 ]G%...]P@.2'...h 0070 17 f6 3d 65 b6 06 19 7e e1 68 16 50 ab d3 de 00 ..=e...~.h.P.... 0080 0a 64 25 48 71 dd .d%Hq. Frame 8 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 15:40:02.243221000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 3.700916000 seconds] Frame Number: 8 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x05bd (1469) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf5f2 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xf124 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E62AA3C252C3F94 Responder cookie: BD57B1FA242DA370 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 6d a9 a5 08 00 45 00 .$.1.=..)m....E. 0010 00 78 05 bd 00 00 80 11 f5 f2 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 8a 01 f4 01 f4 00 64 f1 24 0e 62 aa 3c 25 2c .......d.$.b.<%, 0030 3f 94 bd 57 b1 fa 24 2d a3 70 05 10 02 01 00 00 ?..W..$-.p...... 0040 00 00 00 00 00 5c 7e d9 02 6f 62 fb 3f a3 42 ff .....\~..ob.?.B. 0050 da 4a 86 03 bc 0b 7e 9b ad 09 cf 7a 7c d2 57 ff .J....~....z|.W. 0060 5d 47 25 cf 94 82 5d 50 40 1e 32 27 e2 d6 0a 68 ]G%...]P@.2'...h 0070 17 f6 3d 65 b6 06 19 7e e1 68 16 50 ab d3 de 00 ..=e...~.h.P.... 0080 0a 64 25 48 71 dd .d%Hq. Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: May 27, 2009 15:40:02.355521000 [Time delta from previous captured frame: 0.112300000 seconds] [Time delta from previous displayed frame: 0.112300000 seconds] [Time since reference or first frame: 3.813216000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbbf [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x010d [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E62AA3C252C3F94 Responder cookie: BD57B1FA242DA370 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 6d a9 a5 00 24 b2 31 e1 3d 08 00 45 00 ..)m...$.1.=..E. 0010 00 68 00 00 40 00 40 11 fb bf a5 e3 f9 8a a5 e3 .h..@.@......... 0020 f9 73 01 f4 01 f4 00 54 01 0d 0e 62 aa 3c 25 2c .s.....T...b.<%, 0030 3f 94 bd 57 b1 fa 24 2d a3 70 05 10 02 01 00 00 ?..W..$-.p...... 0040 00 00 00 00 00 4c 5a 67 39 23 2d 4d 0d 03 62 13 .....LZg9#-M..b. 0050 35 02 23 58 6d 27 2a b9 66 a2 74 a6 ad 7d 3e b4 5.#Xm'*.f.t..}>. 0060 2d 52 e6 ef df 68 cc 2a 40 6f 11 52 bb f3 26 f7 -R...h.*@o.R..&. 0070 88 85 5d c6 9d 6d ..]..m Frame 10 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 15:40:02.413686000 [Time delta from previous captured frame: 0.058165000 seconds] [Time delta from previous displayed frame: 0.058165000 seconds] [Time since reference or first frame: 3.871381000 seconds] Frame Number: 10 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbaf [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xb18a [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E62AA3C252C3F94 Responder cookie: BD57B1FA242DA370 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x9d75baf3 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 6d a9 a5 00 24 b2 31 e1 3d 08 00 45 00 ..)m...$.1.=..E. 0010 00 78 00 00 40 00 40 11 fb af a5 e3 f9 8a a5 e3 .x..@.@......... 0020 f9 73 01 f4 01 f4 00 64 b1 8a 0e 62 aa 3c 25 2c .s.....d...b.<%, 0030 3f 94 bd 57 b1 fa 24 2d a3 70 08 10 05 01 9d 75 ?..W..$-.p.....u 0040 ba f3 00 00 00 5c 88 5d f5 f3 e1 a1 01 e0 0f 51 .....\.].......Q 0050 59 ff fa 89 46 3f 86 99 17 d8 fa 23 f6 5a 05 38 Y...F?.....#.Z.8 0060 3e d8 be b0 af f8 0a 06 1b 93 18 c4 67 c9 f4 ad >...........g... 0070 d5 4a e1 64 74 53 b8 a1 ad 68 d7 a1 43 4b a7 ec .J.dtS...h..CK.. 0080 52 99 36 8f 8b 4c R.6..L Frame 11 (342 bytes on wire, 342 bytes captured) Arrival Time: May 27, 2009 15:40:04.510772000 [Time delta from previous captured frame: 2.097086000 seconds] [Time delta from previous displayed frame: 2.097086000 seconds] [Time since reference or first frame: 5.968467000 seconds] Frame Number: 11 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x05c6 (1478) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf519 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xe10b [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E62AA3C252C3F94 Responder cookie: BD57B1FA242DA370 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x48eed950 Length: 300 Encrypted payload (272 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 6d a9 a5 08 00 45 00 .$.1.=..)m....E. 0010 01 48 05 c6 00 00 80 11 f5 19 a5 e3 f9 73 a5 e3 .H...........s.. 0020 f9 8a 01 f4 01 f4 01 34 e1 0b 0e 62 aa 3c 25 2c .......4...b.<%, 0030 3f 94 bd 57 b1 fa 24 2d a3 70 08 10 20 01 48 ee ?..W..$-.p.. .H. 0040 d9 50 00 00 01 2c 65 32 aa 91 a4 fd f8 a5 71 8a .P...,e2......q. 0050 32 30 4e 24 ca f5 15 41 ec aa 37 33 0d df 77 09 20N$...A..73..w. 0060 4b 7c ae 3d 67 0e 6b 1a 0c 50 6d 83 10 dd 0e 7b K|.=g.k..Pm....{ 0070 7a f0 96 c5 70 72 aa 44 8c 53 69 23 77 01 23 4f z...pr.D.Si#w.#O 0080 8f 4e 5d f0 24 42 fd df 00 22 c2 bb 2b 16 63 0e .N].$B..."..+.c. 0090 ec 07 d6 da 9d 73 cf c9 f6 d0 6b 19 34 d4 44 07 .....s....k.4.D. 00a0 9d b7 58 f3 dd 9a 3d 67 15 c1 14 f5 21 d8 5e de ..X...=g....!.^. 00b0 db 2a d4 7a a0 fd ba 75 ab d8 ce 68 fc b1 4f f7 .*.z...u...h..O. 00c0 a7 03 a6 2b f1 8b 11 46 29 f4 e8 17 6f b7 d4 ab ...+...F)...o... 00d0 34 89 83 b2 cf 06 f9 6b b0 4e 39 44 04 f9 a9 56 4......k.N9D...V 00e0 6e dc 78 34 ea 24 03 22 80 ae 97 8d c2 47 de e5 n.x4.$.".....G.. 00f0 cb 4e 8e d3 54 97 61 1b c0 93 27 3e 7f 85 a5 f5 .N..T.a...'>.... 0100 2e 2f 13 8b ee 32 2e 4e 9a 40 e0 16 f9 be 07 7d ./...2.N.@.....} 0110 9f aa 2e ac 40 7a 89 48 d7 45 e6 88 f1 43 7d c1 ....@z.H.E...C}. 0120 94 a2 25 29 95 28 83 45 13 44 db 84 e6 a8 26 28 ..%).(.E.D....&( 0130 51 46 cd 22 5b e4 7b 32 c8 9d 66 14 a1 54 b2 2c QF."[.{2..f..T., 0140 17 db b1 1e 39 88 ae 10 be 96 6d 40 23 2e 9d 5d ....9.....m@#..] 0150 81 c7 67 a1 21 8b ..g.!. Frame 12 (342 bytes on wire, 342 bytes captured) Arrival Time: May 27, 2009 15:40:04.510788000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 5.968483000 seconds] Frame Number: 12 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x05c6 (1478) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf519 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xe10b [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E62AA3C252C3F94 Responder cookie: BD57B1FA242DA370 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x48eed950 Length: 300 Encrypted payload (272 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 6d a9 a5 08 00 45 00 .$.1.=..)m....E. 0010 01 48 05 c6 00 00 80 11 f5 19 a5 e3 f9 73 a5 e3 .H...........s.. 0020 f9 8a 01 f4 01 f4 01 34 e1 0b 0e 62 aa 3c 25 2c .......4...b.<%, 0030 3f 94 bd 57 b1 fa 24 2d a3 70 08 10 20 01 48 ee ?..W..$-.p.. .H. 0040 d9 50 00 00 01 2c 65 32 aa 91 a4 fd f8 a5 71 8a .P...,e2......q. 0050 32 30 4e 24 ca f5 15 41 ec aa 37 33 0d df 77 09 20N$...A..73..w. 0060 4b 7c ae 3d 67 0e 6b 1a 0c 50 6d 83 10 dd 0e 7b K|.=g.k..Pm....{ 0070 7a f0 96 c5 70 72 aa 44 8c 53 69 23 77 01 23 4f z...pr.D.Si#w.#O 0080 8f 4e 5d f0 24 42 fd df 00 22 c2 bb 2b 16 63 0e .N].$B..."..+.c. 0090 ec 07 d6 da 9d 73 cf c9 f6 d0 6b 19 34 d4 44 07 .....s....k.4.D. 00a0 9d b7 58 f3 dd 9a 3d 67 15 c1 14 f5 21 d8 5e de ..X...=g....!.^. 00b0 db 2a d4 7a a0 fd ba 75 ab d8 ce 68 fc b1 4f f7 .*.z...u...h..O. 00c0 a7 03 a6 2b f1 8b 11 46 29 f4 e8 17 6f b7 d4 ab ...+...F)...o... 00d0 34 89 83 b2 cf 06 f9 6b b0 4e 39 44 04 f9 a9 56 4......k.N9D...V 00e0 6e dc 78 34 ea 24 03 22 80 ae 97 8d c2 47 de e5 n.x4.$.".....G.. 00f0 cb 4e 8e d3 54 97 61 1b c0 93 27 3e 7f 85 a5 f5 .N..T.a...'>.... 0100 2e 2f 13 8b ee 32 2e 4e 9a 40 e0 16 f9 be 07 7d ./...2.N.@.....} 0110 9f aa 2e ac 40 7a 89 48 d7 45 e6 88 f1 43 7d c1 ....@z.H.E...C}. 0120 94 a2 25 29 95 28 83 45 13 44 db 84 e6 a8 26 28 ..%).(.E.D....&( 0130 51 46 cd 22 5b e4 7b 32 c8 9d 66 14 a1 54 b2 2c QF."[.{2..f..T., 0140 17 db b1 1e 39 88 ae 10 be 96 6d 40 23 2e 9d 5d ....9.....m@#..] 0150 81 c7 67 a1 21 8b ..g.!. Frame 13 (342 bytes on wire, 342 bytes captured) Arrival Time: May 27, 2009 15:40:05.239984000 [Time delta from previous captured frame: 0.729196000 seconds] [Time delta from previous displayed frame: 0.729196000 seconds] [Time since reference or first frame: 6.697679000 seconds] Frame Number: 13 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfadf [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xda8f [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E62AA3C252C3F94 Responder cookie: BD57B1FA242DA370 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x48eed950 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 6d a9 a5 00 24 b2 31 e1 3d 08 00 45 00 ..)m...$.1.=..E. 0010 01 48 00 00 40 00 40 11 fa df a5 e3 f9 8a a5 e3 .H..@.@......... 0020 f9 73 01 f4 01 f4 01 34 da 8f 0e 62 aa 3c 25 2c .s.....4...b.<%, 0030 3f 94 bd 57 b1 fa 24 2d a3 70 08 10 20 01 48 ee ?..W..$-.p.. .H. 0040 d9 50 00 00 01 2c fb 24 fe a0 2b f1 89 60 2d ec .P...,.$..+..`-. 0050 22 b0 33 99 aa d1 02 8e 18 ea ea 0b 0e 1a 28 5b ".3...........([ 0060 ff 72 c7 62 b9 fe f5 13 5f 5c de 82 a8 b6 0b df .r.b...._\...... 0070 c4 56 e2 3a fb dc 28 17 fb 13 b0 f2 c4 f3 eb e4 .V.:..(......... 0080 3e 1e 5a 32 a3 33 5a e5 67 ca 9c 92 6a e2 43 98 >.Z2.3Z.g...j.C. 0090 48 e4 71 37 44 9f ff 49 39 c8 06 1b e0 8e dd b2 H.q7D..I9....... 00a0 1c 89 dd 73 14 62 51 f7 48 8f 7b 5b 08 f0 6a 3a ...s.bQ.H.{[..j: 00b0 a1 e0 6d b0 5f 78 46 41 e7 4f af bc 66 29 81 3f ..m._xFA.O..f).? 00c0 f8 11 34 be 42 83 05 af 47 2d 96 1d ae c5 a7 c1 ..4.B...G-...... 00d0 ad 7b 76 27 30 89 36 e0 f7 1d c1 63 ff c6 8e ff .{v'0.6....c.... 00e0 ee 6f e6 f6 dc c1 1d 5b 68 b2 a6 47 94 9f 86 95 .o.....[h..G.... 00f0 1a 72 bf 97 02 41 e2 64 3e 9d 10 ea b5 e0 8d d9 .r...A.d>....... 0100 cd ac 59 27 68 75 33 07 cc 71 81 b0 05 a1 46 c1 ..Y'hu3..q....F. 0110 36 03 63 4d 63 11 3c ab 29 0d b0 4a 11 dc ba 9a 6.cMc.<.)..J.... 0120 95 f1 ab 5f b6 06 6f 9e 4d d7 f6 09 77 79 af fd ..._..o.M...wy.. 0130 2f b6 f3 4f 4e ee 88 9d bd 55 7e fc a3 4c 1e ee /..ON....U~..L.. 0140 b8 9f ef f8 30 68 0b f1 f5 d2 35 f5 97 f9 c2 31 ....0h....5....1 0150 7a 92 89 87 49 1f z...I. Frame 14 (102 bytes on wire, 102 bytes captured) Arrival Time: May 27, 2009 15:40:05.243344000 [Time delta from previous captured frame: 0.003360000 seconds] [Time delta from previous displayed frame: 0.003360000 seconds] [Time since reference or first frame: 6.701039000 seconds] Frame Number: 14 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x05cb (1483) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf604 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xbed5 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E62AA3C252C3F94 Responder cookie: BD57B1FA242DA370 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x48eed950 Length: 60 Encrypted payload (32 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 6d a9 a5 08 00 45 00 .$.1.=..)m....E. 0010 00 58 05 cb 00 00 80 11 f6 04 a5 e3 f9 73 a5 e3 .X...........s.. 0020 f9 8a 01 f4 01 f4 00 44 be d5 0e 62 aa 3c 25 2c .......D...b.<%, 0030 3f 94 bd 57 b1 fa 24 2d a3 70 08 10 20 01 48 ee ?..W..$-.p.. .H. 0040 d9 50 00 00 00 3c cf be 70 02 65 a2 a4 23 ce 20 .P...<..p.e..#. 0050 d0 b4 0a c4 fe 21 1f 02 84 dd 48 86 aa 6f e9 6b .....!....H..o.k 0060 43 52 09 f1 a0 3f CR...? Frame 15 (102 bytes on wire, 102 bytes captured) Arrival Time: May 27, 2009 15:40:05.243357000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 6.701052000 seconds] Frame Number: 15 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x05cb (1483) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf604 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xbed5 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E62AA3C252C3F94 Responder cookie: BD57B1FA242DA370 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x48eed950 Length: 60 Encrypted payload (32 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 6d a9 a5 08 00 45 00 .$.1.=..)m....E. 0010 00 58 05 cb 00 00 80 11 f6 04 a5 e3 f9 73 a5 e3 .X...........s.. 0020 f9 8a 01 f4 01 f4 00 44 be d5 0e 62 aa 3c 25 2c .......D...b.<%, 0030 3f 94 bd 57 b1 fa 24 2d a3 70 08 10 20 01 48 ee ?..W..$-.p.. .H. 0040 d9 50 00 00 00 3c cf be 70 02 65 a2 a4 23 ce 20 .P...<..p.e..#. 0050 d0 b4 0a c4 fe 21 1f 02 84 dd 48 86 aa 6f e9 6b .....!....H..o.k 0060 43 52 09 f1 a0 3f CR...? Frame 16 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 15:40:14.534148000 [Time delta from previous captured frame: 9.290791000 seconds] [Time delta from previous displayed frame: 9.290791000 seconds] [Time since reference or first frame: 15.991843000 seconds] Frame Number: 16 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb8d [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x024c04a6 ESP Sequence: 1 0000 00 24 b2 31 e1 3d 00 0c 29 6d a9 a5 08 00 45 00 .$.1.=..)m....E. 0010 00 78 00 01 00 00 80 32 fb 8d a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 8a 02 4c 04 a6 00 00 00 01 76 0e 2a 89 e1 a1 ...L......v.*... 0030 0a 45 d6 88 2e cf 82 a9 4f 60 37 0b d3 5b c7 a2 .E......O`7..[.. 0040 cd 92 e3 55 0c 0e fc 4d 01 54 7c bc 47 d6 78 6b ...U...M.T|.G.xk 0050 12 15 69 f6 88 23 b6 85 c1 67 94 79 7c 27 e4 e9 ..i..#...g.y|'.. 0060 21 80 52 4f 05 fc 18 b6 7b 83 e3 41 93 0d ee e3 !.RO....{..A.... 0070 c6 39 7a a0 1c 26 5e 51 05 f5 ad 23 5a 9c 7f ec .9z..&^Q...#Z... 0080 5c af b5 c2 b0 2d \....- Frame 17 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 15:40:14.534161000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 15.991856000 seconds] Frame Number: 17 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb8d [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x024c04a6 ESP Sequence: 1 0000 00 24 b2 31 e1 3d 00 0c 29 6d a9 a5 08 00 45 00 .$.1.=..)m....E. 0010 00 78 00 01 00 00 80 32 fb 8d a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 8a 02 4c 04 a6 00 00 00 01 76 0e 2a 89 e1 a1 ...L......v.*... 0030 0a 45 d6 88 2e cf 82 a9 4f 60 37 0b d3 5b c7 a2 .E......O`7..[.. 0040 cd 92 e3 55 0c 0e fc 4d 01 54 7c bc 47 d6 78 6b ...U...M.T|.G.xk 0050 12 15 69 f6 88 23 b6 85 c1 67 94 79 7c 27 e4 e9 ..i..#...g.y|'.. 0060 21 80 52 4f 05 fc 18 b6 7b 83 e3 41 93 0d ee e3 !.RO....{..A.... 0070 c6 39 7a a0 1c 26 5e 51 05 f5 ad 23 5a 9c 7f ec .9z..&^Q...#Z... 0080 5c af b5 c2 b0 2d \....- Frame 18 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 15:40:14.540379000 [Time delta from previous captured frame: 0.006218000 seconds] [Time delta from previous displayed frame: 0.006218000 seconds] [Time since reference or first frame: 15.998074000 seconds] Frame Number: 18 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x8ed8 (36568) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xacb6 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0x824bffdd ESP Sequence: 1 0000 00 0c 29 6d a9 a5 00 24 b2 31 e1 3d 08 00 45 00 ..)m...$.1.=..E. 0010 00 78 8e d8 00 00 40 32 ac b6 a5 e3 f9 8a a5 e3 .x....@2........ 0020 f9 73 82 4b ff dd 00 00 00 01 f7 94 2f 06 00 f9 .s.K......../... 0030 52 54 6e e2 4e 01 15 f7 33 ce 19 1f 97 b0 7c 08 RTn.N...3.....|. 0040 8e 9a b7 80 e5 46 c4 72 c9 63 b7 67 05 3e 82 7d .....F.r.c.g.>.} 0050 3e b9 99 a9 b9 7e 87 5d 5a da 0d a1 c9 3f bc e7 >....~.]Z....?.. 0060 33 e7 93 5c ad c9 0d d3 a9 45 f2 ac 4a 39 01 f6 3..\.....E..J9.. 0070 ce 13 d6 c4 35 ec 10 16 28 14 3f 7d e6 57 c6 80 ....5...(.?}.W.. 0080 59 01 a6 2d 1d c2 Y..-.. Frame 19 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 15:40:15.541384000 [Time delta from previous captured frame: 1.001005000 seconds] [Time delta from previous displayed frame: 1.001005000 seconds] [Time since reference or first frame: 16.999079000 seconds] Frame Number: 19 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb8c [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x024c04a6 ESP Sequence: 2 0000 00 24 b2 31 e1 3d 00 0c 29 6d a9 a5 08 00 45 00 .$.1.=..)m....E. 0010 00 78 00 02 00 00 80 32 fb 8c a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 8a 02 4c 04 a6 00 00 00 02 e3 41 93 0d ee e3 ...L.......A.... 0030 c6 39 7a a0 1c 26 5e 51 05 f5 0a 2b d3 59 c9 24 .9z..&^Q...+.Y.$ 0040 8a 23 8b ca fd 2b 0f 51 37 12 83 07 0a b7 92 47 .#...+.Q7......G 0050 85 fd e4 d2 02 24 6a b2 7b 05 af 39 27 af ec 06 .....$j.{..9'... 0060 f2 de 8e ff 4c 75 e5 0d 5b 36 9d ae bd 52 f1 99 ....Lu..[6...R.. 0070 c3 f7 7d 2d 20 7e 8f 70 83 d2 0d 09 95 36 c2 8f ..}- ~.p.....6.. 0080 89 83 10 68 bb b9 ...h.. Frame 20 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 15:40:15.541399000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 16.999094000 seconds] Frame Number: 20 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb8c [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x024c04a6 ESP Sequence: 2 0000 00 24 b2 31 e1 3d 00 0c 29 6d a9 a5 08 00 45 00 .$.1.=..)m....E. 0010 00 78 00 02 00 00 80 32 fb 8c a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 8a 02 4c 04 a6 00 00 00 02 e3 41 93 0d ee e3 ...L.......A.... 0030 c6 39 7a a0 1c 26 5e 51 05 f5 0a 2b d3 59 c9 24 .9z..&^Q...+.Y.$ 0040 8a 23 8b ca fd 2b 0f 51 37 12 83 07 0a b7 92 47 .#...+.Q7......G 0050 85 fd e4 d2 02 24 6a b2 7b 05 af 39 27 af ec 06 .....$j.{..9'... 0060 f2 de 8e ff 4c 75 e5 0d 5b 36 9d ae bd 52 f1 99 ....Lu..[6...R.. 0070 c3 f7 7d 2d 20 7e 8f 70 83 d2 0d 09 95 36 c2 8f ..}- ~.p.....6.. 0080 89 83 10 68 bb b9 ...h.. Frame 21 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 15:40:15.545905000 [Time delta from previous captured frame: 0.004506000 seconds] [Time delta from previous displayed frame: 0.004506000 seconds] [Time since reference or first frame: 17.003600000 seconds] Frame Number: 21 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x09fe (2558) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x3191 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0x824bffdd ESP Sequence: 2 0000 00 0c 29 6d a9 a5 00 24 b2 31 e1 3d 08 00 45 00 ..)m...$.1.=..E. 0010 00 78 09 fe 00 00 40 32 31 91 a5 e3 f9 8a a5 e3 .x....@21....... 0020 f9 73 82 4b ff dd 00 00 00 02 bd 50 bd 83 ae 5f .s.K.......P..._ 0030 45 f7 e6 c6 b6 b9 06 f0 6e 96 f5 64 26 70 aa 1b E.......n..d&p.. 0040 17 63 8e a0 7a 5e b7 ff a9 b4 21 67 9f 51 a8 76 .c..z^....!g.Q.v 0050 6e 19 2f 1b c6 6a 59 81 a5 af c6 e9 8b ae ee 5e n./..jY........^ 0060 65 ad 05 9b 8c 02 f4 2e ce 90 5b ff 06 6b 96 ad e.........[..k.. 0070 67 c5 e9 00 6c 16 57 28 0a fd 53 7c 89 7a 76 93 g...l.W(..S|.zv. 0080 c3 f8 f3 75 bd af ...u..