Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Jul 5, 2007 14:30:12.004672000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 166 bytes Capture Length: 166 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x02f0 (752) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf89e [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x12f1 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0BAF574D0202948A Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 03 d2 20 0e a4 00 0c 29 ab 06 ab 08 00 45 00 ... ....).....E. 0010 00 98 02 f0 00 00 80 11 f8 9e a5 e3 f9 73 a5 e3 .............s.. 0020 f9 8b 01 f4 01 f4 00 84 12 f1 0b af 57 4d 02 02 ............WM.. 0030 94 8a 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (126 bytes on wire, 126 bytes captured) Arrival Time: Jul 5, 2007 14:30:12.004674000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.000002000 seconds Frame Number: 2 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0075 (117) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb41 [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0x3934 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0BAF574D0202948A Responder cookie: 0x89D9B3A49B3C1C4F Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 84 Security Association payload Next payload: NONE (0) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) 0000 00 0c 29 ab 06 ab 00 03 d2 20 0e a4 08 00 45 00 ..)...... ....E. 0010 00 70 00 75 40 00 40 11 fb 41 a5 e3 f9 8b a5 e3 .p.u@.@..A...... 0020 f9 73 01 f4 01 f4 00 5c 39 34 0b af 57 4d 02 02 .s.....\94..WM.. 0030 94 8a 89 d9 b3 a4 9b 3c 1c 4f 01 10 02 00 00 00 .......<.O...... 0040 00 00 00 00 00 54 00 00 00 38 00 00 00 01 00 00 .....T...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 .............. Frame 3 (298 bytes on wire, 298 bytes captured) Arrival Time: Jul 5, 2007 14:30:14.013590000 Time delta from previous packet: 2.008916000 seconds Time since reference or first frame: 2.008918000 seconds Frame Number: 3 Packet Length: 298 bytes Capture Length: 298 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x02f2 (754) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf818 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xb02a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0BAF574D0202948A Responder cookie: 0x89D9B3A49B3C1C4F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 03 d2 20 0e a4 00 0c 29 ab 06 ab 08 00 45 00 ... ....).....E. 0010 01 1c 02 f2 00 00 80 11 f8 18 a5 e3 f9 73 a5 e3 .............s.. 0020 f9 8b 01 f4 01 f4 01 08 b0 2a 0b af 57 4d 02 02 .........*..WM.. 0030 94 8a 89 d9 b3 a4 9b 3c 1c 4f 04 10 02 00 00 00 .......<.O...... 0040 00 00 00 00 01 00 0a 00 00 84 58 98 a0 f7 96 ba ..........X..... 0050 0a e0 c4 0b d1 b9 9b 16 5f 8d 43 29 10 33 38 6f ........_.C).38o 0060 a3 3d 56 2d e6 6a b6 cf c4 99 7f e0 a8 87 68 af .=V-.j........h. 0070 18 04 8a 6a 71 b7 82 6b f5 d4 b4 2a 8d e1 49 b9 ...jq..k...*..I. 0080 e1 88 f4 0c 3a 65 d7 cb 5f 2c 67 03 34 e7 2f 27 ....:e.._,g.4./' 0090 0e 17 b7 aa 28 ae d7 07 0e 26 6c 79 3a 43 ef 0a ....(....&ly:C.. 00a0 7e a9 4d 68 87 6d 92 67 75 0f 16 88 70 a9 5c 3f ~.Mh.m.gu...p.\? 00b0 3b 22 32 a9 d1 4a 21 12 77 96 2e 66 0d 7f da 24 ;"2..J!.w..f...$ 00c0 4d 9d 87 4d ef 02 30 d1 eb 1d 0d 00 00 18 4c eb M..M..0.......L. 00d0 9c 96 81 36 8c cf a7 8f 84 93 95 4a d9 88 52 42 ...6.......J..RB 00e0 ff 38 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .8...0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 4 (226 bytes on wire, 226 bytes captured) Arrival Time: Jul 5, 2007 14:30:14.018704000 Time delta from previous packet: 0.005114000 seconds Time since reference or first frame: 2.014032000 seconds Frame Number: 4 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x0076 (118) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfadc [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x01a6 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0BAF574D0202948A Responder cookie: 0x89D9B3A49B3C1C4F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 24 Nonce Data 0000 00 0c 29 ab 06 ab 00 03 d2 20 0e a4 08 00 45 00 ..)...... ....E. 0010 00 d4 00 76 40 00 40 11 fa dc a5 e3 f9 8b a5 e3 ...v@.@......... 0020 f9 73 01 f4 01 f4 00 c0 01 a6 0b af 57 4d 02 02 .s..........WM.. 0030 94 8a 89 d9 b3 a4 9b 3c 1c 4f 04 10 02 00 00 00 .......<.O...... 0040 00 00 00 00 00 b8 0a 00 00 84 d9 74 65 15 7b 93 ...........te.{. 0050 7a 05 a0 1e 2d 26 e7 0b d5 39 c5 62 60 6e b2 74 z...-&...9.b`n.t 0060 20 58 78 a9 dd 3e 32 97 0e 70 a2 02 e4 b9 3b b9 Xx..>2..p....;. 0070 a4 c7 5f d7 68 91 5c 8e 49 25 9c ba a4 0d c5 cb .._.h.\.I%...... 0080 0c 59 ce c5 04 d7 d6 77 d4 cf 18 12 f1 82 86 53 .Y.....w.......S 0090 0b 99 98 96 7e 5e c9 fe 49 8d 6b 02 8a 79 27 75 ....~^..I.k..y'u 00a0 87 6a 22 80 f9 5a d9 0c 2e 20 cc b2 7b 2e f3 e6 .j"..Z... ..{... 00b0 2a d6 46 a7 4c aa 85 6e 04 6e 07 0e 8c 78 a5 b1 *.F.L..n.n...x.. 00c0 f6 96 d6 6b 66 ad 00 00 88 e6 00 00 00 18 03 b9 ...kf........... 00d0 f9 ff 48 77 23 77 77 b8 95 d2 ff 84 74 f4 17 25 ..Hw#ww.....t..% 00e0 fb e8 .. Frame 5 (134 bytes on wire, 134 bytes captured) Arrival Time: Jul 5, 2007 14:30:14.330553000 Time delta from previous packet: 0.311849000 seconds Time since reference or first frame: 2.325881000 seconds Frame Number: 5 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x02f3 (755) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8bb [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x02da [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0BAF574D0202948A Responder cookie: 0x89D9B3A49B3C1C4F Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 03 d2 20 0e a4 00 0c 29 ab 06 ab 08 00 45 00 ... ....).....E. 0010 00 78 02 f3 00 00 80 11 f8 bb a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 8b 01 f4 01 f4 00 64 02 da 0b af 57 4d 02 02 .......d....WM.. 0030 94 8a 89 d9 b3 a4 9b 3c 1c 4f 05 10 02 01 00 00 .......<.O...... 0040 00 00 00 00 00 5c 29 f1 25 98 d1 4a 3a cc f9 c9 .....\).%..J:... 0050 52 33 91 3c 7c 57 b6 ad 1a a0 ba e5 1f b7 73 79 R3.<|W........sy 0060 95 5a f2 9e 2a 5e 76 a0 5c e2 f7 ef 26 cb af fd .Z..*^v.\...&... 0070 0f 6a 2a e4 00 02 20 aa ca 8b 36 1f 99 ee 7d de .j*... ...6...}. 0080 63 8a ab 75 18 02 c..u.. Frame 6 (118 bytes on wire, 118 bytes captured) Arrival Time: Jul 5, 2007 14:30:14.334465000 Time delta from previous packet: 0.003912000 seconds Time since reference or first frame: 2.329793000 seconds Frame Number: 6 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0077 (119) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb47 [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xd0d2 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0BAF574D0202948A Responder cookie: 0x89D9B3A49B3C1C4F Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 ab 06 ab 00 03 d2 20 0e a4 08 00 45 00 ..)...... ....E. 0010 00 68 00 77 40 00 40 11 fb 47 a5 e3 f9 8b a5 e3 .h.w@.@..G...... 0020 f9 73 01 f4 01 f4 00 54 d0 d2 0b af 57 4d 02 02 .s.....T....WM.. 0030 94 8a 89 d9 b3 a4 9b 3c 1c 4f 05 10 02 01 00 00 .......<.O...... 0040 00 00 00 00 00 4c 81 8a b6 15 1c e1 68 7f 13 0f .....L......h... 0050 0c a1 7e 24 85 b0 71 af ef 35 82 e6 fc 7b 46 de ..~$..q..5...{F. 0060 1f d9 d3 e0 67 b9 af 2a f5 46 6b cd 60 f3 2c 3f ....g..*.Fk.`.,? 0070 ec 55 b7 97 51 56 .U..QV Frame 7 (118 bytes on wire, 118 bytes captured) Arrival Time: Jul 5, 2007 14:30:14.449942000 Time delta from previous packet: 0.115477000 seconds Time since reference or first frame: 2.445270000 seconds Frame Number: 7 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0078 (120) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb46 [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xd0d2 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0BAF574D0202948A Responder cookie: 0x89D9B3A49B3C1C4F Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 ab 06 ab 00 03 d2 20 0e a4 08 00 45 00 ..)...... ....E. 0010 00 68 00 78 40 00 40 11 fb 46 a5 e3 f9 8b a5 e3 .h.x@.@..F...... 0020 f9 73 01 f4 01 f4 00 54 d0 d2 0b af 57 4d 02 02 .s.....T....WM.. 0030 94 8a 89 d9 b3 a4 9b 3c 1c 4f 05 10 02 01 00 00 .......<.O...... 0040 00 00 00 00 00 4c 81 8a b6 15 1c e1 68 7f 13 0f .....L......h... 0050 0c a1 7e 24 85 b0 71 af ef 35 82 e6 fc 7b 46 de ..~$..q..5...{F. 0060 1f d9 d3 e0 67 b9 af 2a f5 46 6b cd 60 f3 2c 3f ....g..*.Fk.`.,? 0070 ec 55 b7 97 51 56 .U..QV Frame 8 (118 bytes on wire, 118 bytes captured) Arrival Time: Jul 5, 2007 14:30:14.543103000 Time delta from previous packet: 0.093161000 seconds Time since reference or first frame: 2.538431000 seconds Frame Number: 8 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0079 (121) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb45 [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xd0d2 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0BAF574D0202948A Responder cookie: 0x89D9B3A49B3C1C4F Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 ab 06 ab 00 03 d2 20 0e a4 08 00 45 00 ..)...... ....E. 0010 00 68 00 79 40 00 40 11 fb 45 a5 e3 f9 8b a5 e3 .h.y@.@..E...... 0020 f9 73 01 f4 01 f4 00 54 d0 d2 0b af 57 4d 02 02 .s.....T....WM.. 0030 94 8a 89 d9 b3 a4 9b 3c 1c 4f 05 10 02 01 00 00 .......<.O...... 0040 00 00 00 00 00 4c 81 8a b6 15 1c e1 68 7f 13 0f .....L......h... 0050 0c a1 7e 24 85 b0 71 af ef 35 82 e6 fc 7b 46 de ..~$..q..5...{F. 0060 1f d9 d3 e0 67 b9 af 2a f5 46 6b cd 60 f3 2c 3f ....g..*.Fk.`.,? 0070 ec 55 b7 97 51 56 .U..QV Frame 9 (342 bytes on wire, 342 bytes captured) Arrival Time: Jul 5, 2007 14:30:16.563039000 Time delta from previous packet: 2.019936000 seconds Time since reference or first frame: 4.558367000 seconds Frame Number: 9 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x02f4 (756) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf7ea [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x8bff [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0BAF574D0202948A Responder cookie: 0x89D9B3A49B3C1C4F Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x44F758AD Length: 300 Encrypted payload (272 bytes) 0000 00 03 d2 20 0e a4 00 0c 29 ab 06 ab 08 00 45 00 ... ....).....E. 0010 01 48 02 f4 00 00 80 11 f7 ea a5 e3 f9 73 a5 e3 .H...........s.. 0020 f9 8b 01 f4 01 f4 01 34 8b ff 0b af 57 4d 02 02 .......4....WM.. 0030 94 8a 89 d9 b3 a4 9b 3c 1c 4f 08 10 20 01 44 f7 .......<.O.. .D. 0040 58 ad 00 00 01 2c da 4f 4d 22 45 50 b9 a0 35 80 X....,.OM"EP..5. 0050 86 36 6f 96 7d cc ef af 55 f5 78 4f 40 5b b4 e3 .6o.}...U.xO@[.. 0060 1a 24 ff 2c 1c 46 07 57 27 37 f6 f8 9c 18 7e f4 .$.,.F.W'7....~. 0070 22 0d f0 55 0e e4 d3 7b 21 77 0b 81 ce 74 2f 7a "..U...{!w...t/z 0080 13 b0 78 64 a8 95 72 3b ce b1 77 24 9c 40 4d 2e ..xd..r;..w$.@M. 0090 e1 e7 c1 ea 1f 56 84 24 f8 8d a0 35 25 48 29 82 .....V.$...5%H). 00a0 71 9d fd b0 bd 02 ce 85 2b cc 42 73 62 1d dd 64 q.......+.Bsb..d 00b0 ae d5 b8 7a a4 a4 04 c3 75 7b 6a f9 99 65 83 35 ...z....u{j..e.5 00c0 20 4c 4e 70 9a fa 25 f4 79 96 3b ae 72 b7 50 a3 LNp..%.y.;.r.P. 00d0 28 0b 88 06 79 14 88 a8 a2 51 8f 71 0a 0a d1 ef (...y....Q.q.... 00e0 a8 e2 66 3f e5 80 fa 10 6c a3 29 62 cb 92 24 bb ..f?....l.)b..$. 00f0 0e ab 8c 9f 17 82 28 08 30 e3 b0 7b 33 70 5a 96 ......(.0..{3pZ. 0100 df 49 70 b2 9d 49 7c c0 a5 ad c6 f0 9f d0 21 42 .Ip..I|.......!B 0110 b2 17 25 0a bd 99 91 a1 7c 7a 36 f9 bf be 94 b5 ..%.....|z6..... 0120 8d 93 ae 70 cd d9 8b 5d 11 41 1f 4a 81 b3 76 55 ...p...].A.J..vU 0130 c7 bc cf f4 73 fa 90 d6 da 46 75 bc cc 67 54 62 ....s....Fu..gTb 0140 e4 66 f4 d4 8e 41 a5 28 a7 df b6 da f6 09 78 1d .f...A.(......x. 0150 12 c5 74 94 8c 60 ..t..` Frame 10 (342 bytes on wire, 342 bytes captured) Arrival Time: Jul 5, 2007 14:30:16.570950000 Time delta from previous packet: 0.007911000 seconds Time since reference or first frame: 4.566278000 seconds Frame Number: 10 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x007a (122) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa64 [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xeef2 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0BAF574D0202948A Responder cookie: 0x89D9B3A49B3C1C4F Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x44F758AD Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 ab 06 ab 00 03 d2 20 0e a4 08 00 45 00 ..)...... ....E. 0010 01 48 00 7a 40 00 40 11 fa 64 a5 e3 f9 8b a5 e3 .H.z@.@..d...... 0020 f9 73 01 f4 01 f4 01 34 ee f2 0b af 57 4d 02 02 .s.....4....WM.. 0030 94 8a 89 d9 b3 a4 9b 3c 1c 4f 08 10 20 01 44 f7 .......<.O.. .D. 0040 58 ad 00 00 01 2c df 58 78 4d 78 35 e0 4e 0d 26 X....,.XxMx5.N.& 0050 1b 12 1c e3 18 07 79 1d a9 4c 6b 2e 5d 9d 87 39 ......y..Lk.]..9 0060 f7 37 b8 87 47 06 b7 ff 95 35 56 3e ac ff 26 cd .7..G....5V>..&. 0070 81 03 ca eb 61 c0 c4 56 1b 20 d5 b0 2a 5a df 7f ....a..V. ..*Z.. 0080 09 2c b3 81 cd a4 cc 8d a3 f1 5e 56 be 85 ef 9b .,........^V.... 0090 ac d4 17 a1 7c 69 4f 40 20 f2 96 0f 8e 7b 7e 34 ....|iO@ ....{~4 00a0 12 e3 b1 dc 9b 0d be b8 c2 eb 77 4c 9f c1 3c 79 ..........wL..