Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Jun 11, 2010 14:50:28.245240000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x01c4 (452) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9c3 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x4ef3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 0c 29 ba 58 19 00 0c 29 6d a9 a5 08 00 45 00 ..).X...)m....E. 0010 00 98 01 c4 00 00 80 11 f9 c3 a5 e3 f9 73 a5 e3 .............s.. 0020 f9 92 01 f4 01 f4 00 84 4e f3 34 8b 8a fe b6 57 ........N.4....W 0030 47 9e 00 00 00 00 00 00 00 00 01 10 02 00 00 00 G............... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (166 bytes on wire, 166 bytes captured) Arrival Time: Jun 11, 2010 14:50:28.245252000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 0.000012000 seconds] Frame Number: 2 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x01c4 (452) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9c3 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x4ef3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 0c 29 ba 58 19 00 0c 29 6d a9 a5 08 00 45 00 ..).X...)m....E. 0010 00 98 01 c4 00 00 80 11 f9 c3 a5 e3 f9 73 a5 e3 .............s.. 0020 f9 92 01 f4 01 f4 00 84 4e f3 34 8b 8a fe b6 57 ........N.4....W 0030 47 9e 00 00 00 00 00 00 00 00 01 10 02 00 00 00 G............... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 3 (166 bytes on wire, 166 bytes captured) Arrival Time: Jun 11, 2010 14:50:28.267234000 [Time delta from previous captured frame: 0.021982000 seconds] [Time delta from previous displayed frame: 0.021982000 seconds] [Time since reference or first frame: 0.021994000 seconds] Frame Number: 3 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb87 [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x7f31 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: EC39E66B47DFF376 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Hash-Algorithm (2): SHA (2) Encryption-Algorithm (1): AES-CBC (7) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Key-Length (14): Key-Length (128) Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: Microsoft L2TP/IPSec VPN Client Next payload: NONE (0) Payload length: 20 Vendor ID: Microsoft L2TP/IPSec VPN Client 0000 00 0c 29 6d a9 a5 00 0c 29 ba 58 19 08 00 45 00 ..)m....).X...E. 0010 00 98 00 00 40 00 40 11 fb 87 a5 e3 f9 92 a5 e3 ....@.@......... 0020 f9 73 01 f4 01 f4 00 84 7f 31 34 8b 8a fe b6 57 .s.......14....W 0030 47 9e ec 39 e6 6b 47 df f3 76 01 10 02 00 00 00 G..9.kG..v...... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 03 00 01 80 04 00 02 80 02 00 02 80 01 ................ 0070 00 07 80 0b 00 01 80 0c 0e 10 80 0e 00 80 0d 00 ................ 0080 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 ......>.in.c...B 0090 7b 1f 00 00 00 14 40 48 b7 d5 6e bc e8 85 25 e7 {.....@H..n...%. 00a0 de 7f 00 d6 c2 d3 ...... Frame 4 (166 bytes on wire, 166 bytes captured) Arrival Time: Jun 11, 2010 14:50:28.267245000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 0.022005000 seconds] Frame Number: 4 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb87 [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x7f31 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: EC39E66B47DFF376 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Hash-Algorithm (2): SHA (2) Encryption-Algorithm (1): AES-CBC (7) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Key-Length (14): Key-Length (128) Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: Microsoft L2TP/IPSec VPN Client Next payload: NONE (0) Payload length: 20 Vendor ID: Microsoft L2TP/IPSec VPN Client 0000 00 0c 29 6d a9 a5 00 0c 29 ba 58 19 08 00 45 00 ..)m....).X...E. 0010 00 98 00 00 40 00 40 11 fb 87 a5 e3 f9 92 a5 e3 ....@.@......... 0020 f9 73 01 f4 01 f4 00 84 7f 31 34 8b 8a fe b6 57 .s.......14....W 0030 47 9e ec 39 e6 6b 47 df f3 76 01 10 02 00 00 00 G..9.kG..v...... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 03 00 01 80 04 00 02 80 02 00 02 80 01 ................ 0070 00 07 80 0b 00 01 80 0c 0e 10 80 0e 00 80 0d 00 ................ 0080 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 ......>.in.c...B 0090 7b 1f 00 00 00 14 40 48 b7 d5 6e bc e8 85 25 e7 {.....@H..n...%. 00a0 de 7f 00 d6 c2 d3 ...... Frame 5 (346 bytes on wire, 346 bytes captured) Arrival Time: Jun 11, 2010 14:50:30.274078000 [Time delta from previous captured frame: 2.006833000 seconds] [Time delta from previous displayed frame: 2.006833000 seconds] [Time since reference or first frame: 2.028838000 seconds] Frame Number: 5 Frame Length: 346 bytes Capture Length: 346 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x01ca (458) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf909 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xee26 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: EC39E66B47DFF376 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: C03F69FB7ED1FC87E40988FE6B8B0384C75C66B5 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: Vendor ID (13) Payload length: 24 Hash of address and port: ACFD8DCC4E6087D018B9D4203EEB4430C8E4B389 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 ba 58 19 00 0c 29 6d a9 a5 08 00 45 00 ..).X...)m....E. 0010 01 4c 01 ca 00 00 80 11 f9 09 a5 e3 f9 73 a5 e3 .L...........s.. 0020 f9 92 01 f4 01 f4 01 38 ee 26 34 8b 8a fe b6 57 .......8.&4....W 0030 47 9e ec 39 e6 6b 47 df f3 76 04 10 02 00 00 00 G..9.kG..v...... 0040 00 00 00 00 01 30 0a 00 00 84 b7 33 f3 28 29 92 .....0.....3.(). 0050 30 32 e3 2a 0c e9 5a f3 76 12 b5 e2 76 31 8a 35 02.*..Z.v...v1.5 0060 fa 72 7c de 08 e9 44 b0 6a a4 9f 68 f2 d5 76 dd .r|...D.j..h..v. 0070 c3 95 29 4d 40 0a e0 4d 89 ae 00 e6 5f e2 7d ba ..)M@..M...._.}. 0080 9f 0b f7 91 68 d6 3c 35 f9 82 94 a5 46 79 94 f4 ....h.<5....Fy.. 0090 63 1f f4 59 b0 38 8c 8f e1 ed bf 7e 38 88 22 36 c..Y.8.....~8."6 00a0 4b 4a d6 3e da 80 c3 4e 04 2e c4 ff 66 f9 b3 d8 KJ.>...N....f... 00b0 f7 b8 2e 13 5d 72 62 a3 a5 15 45 e4 e3 8f c6 8e ....]rb...E..... 00c0 5b d9 cf 02 ea d4 b9 4c 8a ec 82 00 00 18 63 10 [......L......c. 00d0 ff 42 be 4e 05 5e 59 c7 01 25 3a 73 bb e9 9e c3 .B.N.^Y..%:s.... 00e0 6c f6 82 00 00 18 c0 3f 69 fb 7e d1 fc 87 e4 09 l......?i.~..... 00f0 88 fe 6b 8b 03 84 c7 5c 66 b5 0d 00 00 18 ac fd ..k....\f....... 0100 8d cc 4e 60 87 d0 18 b9 d4 20 3e eb 44 30 c8 e4 ..N`..... >.D0.. 0110 b3 89 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 6 (346 bytes on wire, 346 bytes captured) Arrival Time: Jun 11, 2010 14:50:30.274096000 [Time delta from previous captured frame: 0.000018000 seconds] [Time delta from previous displayed frame: 0.000018000 seconds] [Time since reference or first frame: 2.028856000 seconds] Frame Number: 6 Frame Length: 346 bytes Capture Length: 346 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x01ca (458) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf909 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xee26 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: EC39E66B47DFF376 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: C03F69FB7ED1FC87E40988FE6B8B0384C75C66B5 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: Vendor ID (13) Payload length: 24 Hash of address and port: ACFD8DCC4E6087D018B9D4203EEB4430C8E4B389 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 ba 58 19 00 0c 29 6d a9 a5 08 00 45 00 ..).X...)m....E. 0010 01 4c 01 ca 00 00 80 11 f9 09 a5 e3 f9 73 a5 e3 .L...........s.. 0020 f9 92 01 f4 01 f4 01 38 ee 26 34 8b 8a fe b6 57 .......8.&4....W 0030 47 9e ec 39 e6 6b 47 df f3 76 04 10 02 00 00 00 G..9.kG..v...... 0040 00 00 00 00 01 30 0a 00 00 84 b7 33 f3 28 29 92 .....0.....3.(). 0050 30 32 e3 2a 0c e9 5a f3 76 12 b5 e2 76 31 8a 35 02.*..Z.v...v1.5 0060 fa 72 7c de 08 e9 44 b0 6a a4 9f 68 f2 d5 76 dd .r|...D.j..h..v. 0070 c3 95 29 4d 40 0a e0 4d 89 ae 00 e6 5f e2 7d ba ..)M@..M...._.}. 0080 9f 0b f7 91 68 d6 3c 35 f9 82 94 a5 46 79 94 f4 ....h.<5....Fy.. 0090 63 1f f4 59 b0 38 8c 8f e1 ed bf 7e 38 88 22 36 c..Y.8.....~8."6 00a0 4b 4a d6 3e da 80 c3 4e 04 2e c4 ff 66 f9 b3 d8 KJ.>...N....f... 00b0 f7 b8 2e 13 5d 72 62 a3 a5 15 45 e4 e3 8f c6 8e ....]rb...E..... 00c0 5b d9 cf 02 ea d4 b9 4c 8a ec 82 00 00 18 63 10 [......L......c. 00d0 ff 42 be 4e 05 5e 59 c7 01 25 3a 73 bb e9 9e c3 .B.N.^Y..%:s.... 00e0 6c f6 82 00 00 18 c0 3f 69 fb 7e d1 fc 87 e4 09 l......?i.~..... 00f0 88 fe 6b 8b 03 84 c7 5c 66 b5 0d 00 00 18 ac fd ..k....\f....... 0100 8d cc 4e 60 87 d0 18 b9 d4 20 3e eb 44 30 c8 e4 ..N`..... >.D0.. 0110 b3 89 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 7 (270 bytes on wire, 270 bytes captured) Arrival Time: Jun 11, 2010 14:50:30.330579000 [Time delta from previous captured frame: 0.056483000 seconds] [Time delta from previous displayed frame: 0.056483000 seconds] [Time since reference or first frame: 2.085339000 seconds] Frame Number: 7 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb1f [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x2874 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: EC39E66B47DFF376 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: ACFD8DCC4E6087D018B9D4203EEB4430C8E4B389 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: C03F69FB7ED1FC87E40988FE6B8B0384C75C66B5 0000 00 0c 29 6d a9 a5 00 0c 29 ba 58 19 08 00 45 00 ..)m....).X...E. 0010 01 00 00 00 40 00 40 11 fb 1f a5 e3 f9 92 a5 e3 ....@.@......... 0020 f9 73 01 f4 01 f4 00 ec 28 74 34 8b 8a fe b6 57 .s......(t4....W 0030 47 9e ec 39 e6 6b 47 df f3 76 04 10 02 00 00 00 G..9.kG..v...... 0040 00 00 00 00 00 e4 0a 00 00 84 54 7a 82 f8 fd 1b ..........Tz.... 0050 94 5d b2 da 1d e1 80 88 04 a3 fb 0a 30 83 cf 07 .]..........0... 0060 4e a9 71 7a d3 cf 6c db cd fc ef 10 f0 e9 72 35 N.qz..l.......r5 0070 47 55 5a e9 32 dc 6d 2a d5 d3 d4 52 11 74 dc cc GUZ.2.m*...R.t.. 0080 9c c4 62 33 b0 e8 f2 38 81 e1 7a d7 b3 48 fa 08 ..b3...8..z..H.. 0090 22 c8 aa d7 47 bf 8c a0 6d ad 48 00 b5 ca ef 7f "...G...m.H..... 00a0 79 a9 39 18 20 40 03 65 78 1c ef 8f 35 95 46 38 y.9. @.ex...5.F8 00b0 21 9e 1a b6 42 0f 05 57 ba 43 e7 3e ee 3c 42 41 !...B..W.C.>.. 00f0 44 30 c8 e4 b3 89 00 00 00 18 c0 3f 69 fb 7e d1 D0.........?i.~. 0100 fc 87 e4 09 88 fe 6b 8b 03 84 c7 5c 66 b5 ......k....\f. Frame 8 (270 bytes on wire, 270 bytes captured) Arrival Time: Jun 11, 2010 14:50:30.330591000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 2.085351000 seconds] Frame Number: 8 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb1f [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x2874 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: EC39E66B47DFF376 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: ACFD8DCC4E6087D018B9D4203EEB4430C8E4B389 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: C03F69FB7ED1FC87E40988FE6B8B0384C75C66B5 0000 00 0c 29 6d a9 a5 00 0c 29 ba 58 19 08 00 45 00 ..)m....).X...E. 0010 01 00 00 00 40 00 40 11 fb 1f a5 e3 f9 92 a5 e3 ....@.@......... 0020 f9 73 01 f4 01 f4 00 ec 28 74 34 8b 8a fe b6 57 .s......(t4....W 0030 47 9e ec 39 e6 6b 47 df f3 76 04 10 02 00 00 00 G..9.kG..v...... 0040 00 00 00 00 00 e4 0a 00 00 84 54 7a 82 f8 fd 1b ..........Tz.... 0050 94 5d b2 da 1d e1 80 88 04 a3 fb 0a 30 83 cf 07 .]..........0... 0060 4e a9 71 7a d3 cf 6c db cd fc ef 10 f0 e9 72 35 N.qz..l.......r5 0070 47 55 5a e9 32 dc 6d 2a d5 d3 d4 52 11 74 dc cc GUZ.2.m*...R.t.. 0080 9c c4 62 33 b0 e8 f2 38 81 e1 7a d7 b3 48 fa 08 ..b3...8..z..H.. 0090 22 c8 aa d7 47 bf 8c a0 6d ad 48 00 b5 ca ef 7f "...G...m.H..... 00a0 79 a9 39 18 20 40 03 65 78 1c ef 8f 35 95 46 38 y.9. @.ex...5.F8 00b0 21 9e 1a b6 42 0f 05 57 ba 43 e7 3e ee 3c 42 41 !...B..W.C.>.. 00f0 44 30 c8 e4 b3 89 00 00 00 18 c0 3f 69 fb 7e d1 D0.........?i.~. 0100 fc 87 e4 09 88 fe 6b 8b 03 84 c7 5c 66 b5 ......k....\f. Frame 9 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:50:31.284525000 [Time delta from previous captured frame: 0.953934000 seconds] [Time delta from previous displayed frame: 0.953934000 seconds] [Time since reference or first frame: 3.039285000 seconds] Frame Number: 9 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x01ce (462) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9d9 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x8192 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: EC39E66B47DFF376 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 ba 58 19 00 0c 29 6d a9 a5 08 00 45 00 ..).X...)m....E. 0010 00 78 01 ce 00 00 80 11 f9 d9 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 92 01 f4 01 f4 00 64 81 92 34 8b 8a fe b6 57 .......d..4....W 0030 47 9e ec 39 e6 6b 47 df f3 76 05 10 02 01 00 00 G..9.kG..v...... 0040 00 00 00 00 00 5c 5f cb 5a 1d 4d 5d 71 0c 46 46 .....\_.Z.M]q.FF 0050 c8 8e 71 14 85 d3 dc ac 0c cc 05 57 88 12 a4 22 ..q........W..." 0060 db ce 04 7a 85 1b 10 30 a3 08 76 da e8 51 6e 94 ...z...0..v..Qn. 0070 78 64 84 1f 19 aa 6e a2 b6 fc 99 df ba 88 94 e7 xd....n......... 0080 b1 da 46 f5 ca 95 ..F... Frame 10 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:50:31.284542000 [Time delta from previous captured frame: 0.000017000 seconds] [Time delta from previous displayed frame: 0.000017000 seconds] [Time since reference or first frame: 3.039302000 seconds] Frame Number: 10 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x01ce (462) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9d9 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x8192 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: EC39E66B47DFF376 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 ba 58 19 00 0c 29 6d a9 a5 08 00 45 00 ..).X...)m....E. 0010 00 78 01 ce 00 00 80 11 f9 d9 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 92 01 f4 01 f4 00 64 81 92 34 8b 8a fe b6 57 .......d..4....W 0030 47 9e ec 39 e6 6b 47 df f3 76 05 10 02 01 00 00 G..9.kG..v...... 0040 00 00 00 00 00 5c 5f cb 5a 1d 4d 5d 71 0c 46 46 .....\_.Z.M]q.FF 0050 c8 8e 71 14 85 d3 dc ac 0c cc 05 57 88 12 a4 22 ..q........W..." 0060 db ce 04 7a 85 1b 10 30 a3 08 76 da e8 51 6e 94 ...z...0..v..Qn. 0070 78 64 84 1f 19 aa 6e a2 b6 fc 99 df ba 88 94 e7 xd....n......... 0080 b1 da 46 f5 ca 95 ..F... Frame 11 (118 bytes on wire, 118 bytes captured) Arrival Time: Jun 11, 2010 14:50:31.291052000 [Time delta from previous captured frame: 0.006510000 seconds] [Time delta from previous displayed frame: 0.006510000 seconds] [Time since reference or first frame: 3.045812000 seconds] Frame Number: 11 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb7 [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xf342 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: EC39E66B47DFF376 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 6d a9 a5 00 0c 29 ba 58 19 08 00 45 00 ..)m....).X...E. 0010 00 68 00 00 40 00 40 11 fb b7 a5 e3 f9 92 a5 e3 .h..@.@......... 0020 f9 73 01 f4 01 f4 00 54 f3 42 34 8b 8a fe b6 57 .s.....T.B4....W 0030 47 9e ec 39 e6 6b 47 df f3 76 05 10 02 01 00 00 G..9.kG..v...... 0040 00 00 00 00 00 4c 19 23 fd e3 c7 43 1b 3e 2b f9 .....L.#...C.>+. 0050 38 fc b3 c4 f6 c6 cd b4 b4 15 a8 e4 08 53 1d 7c 8............S.| 0060 0f b2 ff 57 6b e9 c5 7a 85 22 84 5f d5 d0 86 5f ...Wk..z."._..._ 0070 8d 99 d9 40 8f f1 ...@.. Frame 12 (118 bytes on wire, 118 bytes captured) Arrival Time: Jun 11, 2010 14:50:31.291063000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 3.045823000 seconds] Frame Number: 12 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb7 [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xf342 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: EC39E66B47DFF376 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 6d a9 a5 00 0c 29 ba 58 19 08 00 45 00 ..)m....).X...E. 0010 00 68 00 00 40 00 40 11 fb b7 a5 e3 f9 92 a5 e3 .h..@.@......... 0020 f9 73 01 f4 01 f4 00 54 f3 42 34 8b 8a fe b6 57 .s.....T.B4....W 0030 47 9e ec 39 e6 6b 47 df f3 76 05 10 02 01 00 00 G..9.kG..v...... 0040 00 00 00 00 00 4c 19 23 fd e3 c7 43 1b 3e 2b f9 .....L.#...C.>+. 0050 38 fc b3 c4 f6 c6 cd b4 b4 15 a8 e4 08 53 1d 7c 8............S.| 0060 0f b2 ff 57 6b e9 c5 7a 85 22 84 5f d5 d0 86 5f ...Wk..z."._..._ 0070 8d 99 d9 40 8f f1 ...@.. Frame 13 (342 bytes on wire, 342 bytes captured) Arrival Time: Jun 11, 2010 14:50:33.226437000 [Time delta from previous captured frame: 1.935374000 seconds] [Time delta from previous displayed frame: 1.935374000 seconds] [Time since reference or first frame: 4.981197000 seconds] Frame Number: 13 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x01d7 (471) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf900 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x863c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: EC39E66B47DFF376 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x338b19d3 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 ba 58 19 00 0c 29 6d a9 a5 08 00 45 00 ..).X...)m....E. 0010 01 48 01 d7 00 00 80 11 f9 00 a5 e3 f9 73 a5 e3 .H...........s.. 0020 f9 92 01 f4 01 f4 01 34 86 3c 34 8b 8a fe b6 57 .......4.<4....W 0030 47 9e ec 39 e6 6b 47 df f3 76 08 10 20 01 33 8b G..9.kG..v.. .3. 0040 19 d3 00 00 01 2c 04 18 7d 4d e8 f1 72 e9 39 8d .....,..}M..r.9. 0050 40 31 54 f4 fe ec 9e 52 65 16 b8 87 97 88 f8 f9 @1T....Re....... 0060 75 6e fa 01 7b 1d 8e 19 5a 1b 3f 2e db c7 f3 7e un..{...Z.?....~ 0070 8d bb b2 87 a3 7e 6c cc cf 62 6e 87 2b bf 7b 53 .....~l..bn.+.{S 0080 78 ca dc db 24 0d 8d b8 18 01 93 d1 d8 06 84 7e x...$..........~ 0090 b5 5e 3b 11 4d ac dd e7 c1 bd 35 8f c3 26 61 5c .^;.M.....5..&a\ 00a0 6b 04 d4 f8 cb f0 7a 19 74 db 64 d1 f0 47 89 38 k.....z.t.d..G.8 00b0 73 60 d5 ec 3b e4 3d 6d bd 15 4b 7f 5f 89 fe 43 s`..;.=m..K._..C 00c0 58 1e bb ea ad f6 82 2e 1d c4 3d e8 72 36 d8 89 X.........=.r6.. 00d0 61 1e 25 0e ac aa 60 3f 79 70 54 dc ce 8c c6 ea a.%...`?ypT..... 00e0 ab 5d 5f bb 0f 29 f9 df 00 06 1b bf 18 11 65 c7 .]_..)........e. 00f0 e0 36 c5 14 03 3a e5 69 88 11 0b 04 43 ae b9 45 .6...:.i....C..E 0100 24 a2 bb 68 40 87 d3 c4 fe 4c f3 9e 3d c0 58 fa $..h@....L..=.X. 0110 78 5d 1f c3 b2 b8 9f 48 8f 06 83 7e 91 1a 9a 88 x].....H...~.... 0120 7a 36 2b f0 44 e9 6c c2 41 84 88 1a 9f 14 19 9f z6+.D.l.A....... 0130 e5 4b 7d 38 ad ee 24 0a 29 a2 83 4f 92 f4 28 bf .K}8..$.)..O..(. 0140 b3 19 f7 f1 6e f1 a6 d0 e0 43 f4 93 0c e4 a2 e4 ....n....C...... 0150 fd 93 9e 6e ef 68 ...n.h Frame 14 (342 bytes on wire, 342 bytes captured) Arrival Time: Jun 11, 2010 14:50:33.226456000 [Time delta from previous captured frame: 0.000019000 seconds] [Time delta from previous displayed frame: 0.000019000 seconds] [Time since reference or first frame: 4.981216000 seconds] Frame Number: 14 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x01d7 (471) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf900 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x863c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: EC39E66B47DFF376 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x338b19d3 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 ba 58 19 00 0c 29 6d a9 a5 08 00 45 00 ..).X...)m....E. 0010 01 48 01 d7 00 00 80 11 f9 00 a5 e3 f9 73 a5 e3 .H...........s.. 0020 f9 92 01 f4 01 f4 01 34 86 3c 34 8b 8a fe b6 57 .......4.<4....W 0030 47 9e ec 39 e6 6b 47 df f3 76 08 10 20 01 33 8b G..9.kG..v.. .3. 0040 19 d3 00 00 01 2c 04 18 7d 4d e8 f1 72 e9 39 8d .....,..}M..r.9. 0050 40 31 54 f4 fe ec 9e 52 65 16 b8 87 97 88 f8 f9 @1T....Re....... 0060 75 6e fa 01 7b 1d 8e 19 5a 1b 3f 2e db c7 f3 7e un..{...Z.?....~ 0070 8d bb b2 87 a3 7e 6c cc cf 62 6e 87 2b bf 7b 53 .....~l..bn.+.{S 0080 78 ca dc db 24 0d 8d b8 18 01 93 d1 d8 06 84 7e x...$..........~ 0090 b5 5e 3b 11 4d ac dd e7 c1 bd 35 8f c3 26 61 5c .^;.M.....5..&a\ 00a0 6b 04 d4 f8 cb f0 7a 19 74 db 64 d1 f0 47 89 38 k.....z.t.d..G.8 00b0 73 60 d5 ec 3b e4 3d 6d bd 15 4b 7f 5f 89 fe 43 s`..;.=m..K._..C 00c0 58 1e bb ea ad f6 82 2e 1d c4 3d e8 72 36 d8 89 X.........=.r6.. 00d0 61 1e 25 0e ac aa 60 3f 79 70 54 dc ce 8c c6 ea a.%...`?ypT..... 00e0 ab 5d 5f bb 0f 29 f9 df 00 06 1b bf 18 11 65 c7 .]_..)........e. 00f0 e0 36 c5 14 03 3a e5 69 88 11 0b 04 43 ae b9 45 .6...:.i....C..E 0100 24 a2 bb 68 40 87 d3 c4 fe 4c f3 9e 3d c0 58 fa $..h@....L..=.X. 0110 78 5d 1f c3 b2 b8 9f 48 8f 06 83 7e 91 1a 9a 88 x].....H...~.... 0120 7a 36 2b f0 44 e9 6c c2 41 84 88 1a 9f 14 19 9f z6+.D.l.A....... 0130 e5 4b 7d 38 ad ee 24 0a 29 a2 83 4f 92 f4 28 bf .K}8..$.)..O..(. 0140 b3 19 f7 f1 6e f1 a6 d0 e0 43 f4 93 0c e4 a2 e4 ....n....C...... 0150 fd 93 9e 6e ef 68 ...n.h Frame 15 (342 bytes on wire, 342 bytes captured) Arrival Time: Jun 11, 2010 14:50:33.276724000 [Time delta from previous captured frame: 0.050268000 seconds] [Time delta from previous displayed frame: 0.050268000 seconds] [Time since reference or first frame: 5.031484000 seconds] Frame Number: 15 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfad7 [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xc69c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: EC39E66B47DFF376 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x338b19d3 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 6d a9 a5 00 0c 29 ba 58 19 08 00 45 00 ..)m....).X...E. 0010 01 48 00 00 40 00 40 11 fa d7 a5 e3 f9 92 a5 e3 .H..@.@......... 0020 f9 73 01 f4 01 f4 01 34 c6 9c 34 8b 8a fe b6 57 .s.....4..4....W 0030 47 9e ec 39 e6 6b 47 df f3 76 08 10 20 01 33 8b G..9.kG..v.. .3. 0040 19 d3 00 00 01 2c 06 62 92 04 8d 42 74 3e 6e 27 .....,.b...Bt>n' 0050 25 b6 a6 13 86 f8 99 6a 76 a2 39 8e 56 d4 95 f7 %......jv.9.V... 0060 b8 09 03 5c bf e6 41 ea 0f 53 2c f7 b0 21 df 4f ...\..A..S,..!.O 0070 27 9f b3 0f a3 a3 2e ca d9 fc 9d 65 c4 53 e3 63 '..........e.S.c 0080 22 c3 83 c9 21 73 1b cd 35 2f 7e 19 a3 ba fc 89 "...!s..5/~..... 0090 b0 4e 14 5c 49 7d 64 b2 16 7c fc bc a2 58 a8 f7 .N.\I}d..|...X.. 00a0 65 fd 55 bb db c1 37 b2 ff b1 99 ed f4 5b 66 45 e.U...7......[fE 00b0 52 2c 6c 9c 2b 98 f7 fe 30 a2 e8 f2 ec 5d ef 0e R,l.+...0....].. 00c0 cb fa 41 fd 66 b6 38 4e e3 49 7a 8b 2c e9 10 3e ..A.f.8N.Iz.,..> 00d0 85 28 57 11 8a 30 c0 26 98 09 32 7c e3 4b fa f3 .(W..0.&..2|.K.. 00e0 37 79 83 65 2f 31 83 16 ac 32 5b cb 83 78 68 71 7y.e/1...2[..xhq 00f0 b9 63 40 57 61 6e 93 72 b1 77 f0 9d f1 24 b8 fa .c@Wan.r.w...$.. 0100 39 ac 14 0d 22 ca 94 9e 2e 5e 11 8a 42 ea c3 18 9..."....^..B... 0110 6e 40 ac 66 30 bd d4 5f b3 86 b5 cf 61 24 d8 05 n@.f0.._....a$.. 0120 b9 45 4b 33 57 94 43 a0 ca 7d 15 c1 1a 37 9d 4c .EK3W.C..}...7.L 0130 4a d9 23 ce 4f 88 1f 6d 30 af fb b2 c5 9e 62 7c J.#.O..m0.....b| 0140 ed 19 89 b7 7b f0 08 ac 50 2e 2c 40 e7 68 ec 0d ....{...P.,@.h.. 0150 2b 08 ae 78 d9 4c +..x.L Frame 16 (342 bytes on wire, 342 bytes captured) Arrival Time: Jun 11, 2010 14:50:33.276739000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 5.031499000 seconds] Frame Number: 16 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfad7 [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xc69c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: EC39E66B47DFF376 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x338b19d3 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 6d a9 a5 00 0c 29 ba 58 19 08 00 45 00 ..)m....).X...E. 0010 01 48 00 00 40 00 40 11 fa d7 a5 e3 f9 92 a5 e3 .H..@.@......... 0020 f9 73 01 f4 01 f4 01 34 c6 9c 34 8b 8a fe b6 57 .s.....4..4....W 0030 47 9e ec 39 e6 6b 47 df f3 76 08 10 20 01 33 8b G..9.kG..v.. .3. 0040 19 d3 00 00 01 2c 06 62 92 04 8d 42 74 3e 6e 27 .....,.b...Bt>n' 0050 25 b6 a6 13 86 f8 99 6a 76 a2 39 8e 56 d4 95 f7 %......jv.9.V... 0060 b8 09 03 5c bf e6 41 ea 0f 53 2c f7 b0 21 df 4f ...\..A..S,..!.O 0070 27 9f b3 0f a3 a3 2e ca d9 fc 9d 65 c4 53 e3 63 '..........e.S.c 0080 22 c3 83 c9 21 73 1b cd 35 2f 7e 19 a3 ba fc 89 "...!s..5/~..... 0090 b0 4e 14 5c 49 7d 64 b2 16 7c fc bc a2 58 a8 f7 .N.\I}d..|...X.. 00a0 65 fd 55 bb db c1 37 b2 ff b1 99 ed f4 5b 66 45 e.U...7......[fE 00b0 52 2c 6c 9c 2b 98 f7 fe 30 a2 e8 f2 ec 5d ef 0e R,l.+...0....].. 00c0 cb fa 41 fd 66 b6 38 4e e3 49 7a 8b 2c e9 10 3e ..A.f.8N.Iz.,..> 00d0 85 28 57 11 8a 30 c0 26 98 09 32 7c e3 4b fa f3 .(W..0.&..2|.K.. 00e0 37 79 83 65 2f 31 83 16 ac 32 5b cb 83 78 68 71 7y.e/1...2[..xhq 00f0 b9 63 40 57 61 6e 93 72 b1 77 f0 9d f1 24 b8 fa .c@Wan.r.w...$.. 0100 39 ac 14 0d 22 ca 94 9e 2e 5e 11 8a 42 ea c3 18 9..."....^..B... 0110 6e 40 ac 66 30 bd d4 5f b3 86 b5 cf 61 24 d8 05 n@.f0.._....a$.. 0120 b9 45 4b 33 57 94 43 a0 ca 7d 15 c1 1a 37 9d 4c .EK3W.C..}...7.L 0130 4a d9 23 ce 4f 88 1f 6d 30 af fb b2 c5 9e 62 7c J.#.O..m0.....b| 0140 ed 19 89 b7 7b f0 08 ac 50 2e 2c 40 e7 68 ec 0d ....{...P.,@.h.. 0150 2b 08 ae 78 d9 4c +..x.L Frame 17 (102 bytes on wire, 102 bytes captured) Arrival Time: Jun 11, 2010 14:50:33.280040000 [Time delta from previous captured frame: 0.003301000 seconds] [Time delta from previous displayed frame: 0.003301000 seconds] [Time since reference or first frame: 5.034800000 seconds] Frame Number: 17 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x01db (475) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9ec [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xa953 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: EC39E66B47DFF376 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x338b19d3 Length: 60 Encrypted payload (32 bytes) 0000 00 0c 29 ba 58 19 00 0c 29 6d a9 a5 08 00 45 00 ..).X...)m....E. 0010 00 58 01 db 00 00 80 11 f9 ec a5 e3 f9 73 a5 e3 .X...........s.. 0020 f9 92 01 f4 01 f4 00 44 a9 53 34 8b 8a fe b6 57 .......D.S4....W 0030 47 9e ec 39 e6 6b 47 df f3 76 08 10 20 01 33 8b G..9.kG..v.. .3. 0040 19 d3 00 00 00 3c 17 34 a7 b5 c5 7f c8 64 c4 e1 .....<.4.....d.. 0050 38 de b5 94 b7 e6 91 9e 88 f0 ff d7 82 9c 4d b9 8.............M. 0060 ef 68 bb 06 84 ff .h.... Frame 18 (102 bytes on wire, 102 bytes captured) Arrival Time: Jun 11, 2010 14:50:33.280054000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 5.034814000 seconds] Frame Number: 18 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x01db (475) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9ec [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xa953 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 348B8AFEB657479E Responder cookie: EC39E66B47DFF376 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x338b19d3 Length: 60 Encrypted payload (32 bytes) 0000 00 0c 29 ba 58 19 00 0c 29 6d a9 a5 08 00 45 00 ..).X...)m....E. 0010 00 58 01 db 00 00 80 11 f9 ec a5 e3 f9 73 a5 e3 .X...........s.. 0020 f9 92 01 f4 01 f4 00 44 a9 53 34 8b 8a fe b6 57 .......D.S4....W 0030 47 9e ec 39 e6 6b 47 df f3 76 08 10 20 01 33 8b G..9.kG..v.. .3. 0040 19 d3 00 00 00 3c 17 34 a7 b5 c5 7f c8 64 c4 e1 .....<.4.....d.. 0050 38 de b5 94 b7 e6 91 9e 88 f0 ff d7 82 9c 4d b9 8.............M. 0060 ef 68 bb 06 84 ff .h.... Frame 19 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:50:43.197641000 [Time delta from previous captured frame: 9.917587000 seconds] [Time delta from previous displayed frame: 9.917587000 seconds] [Time since reference or first frame: 14.952401000 seconds] Frame Number: 19 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb85 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) Encapsulating Security Payload ESP SPI: 0x8adc3750 ESP Sequence: 1 0000 00 0c 29 ba 58 19 00 0c 29 6d a9 a5 08 00 45 00 ..).X...)m....E. 0010 00 78 00 01 00 00 80 32 fb 85 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 92 8a dc 37 50 00 00 00 01 d1 b2 4d cc a8 df ....7P......M... 0030 f8 dd 6d 3f 95 c5 af 5e 91 c0 bf fc d2 1e 08 ab ..m?...^........ 0040 ab 40 36 ee d6 32 67 73 11 f0 f6 6c 95 02 02 ec .@6..2gs...l.... 0050 3b 17 ee 1e 91 5c 6a aa 91 4c 37 e8 5f c4 87 5c ;....\j..L7._..\ 0060 b9 28 34 14 46 8a 9c 85 de dc 00 27 eb af e2 f4 .(4.F......'.... 0070 e1 1b cd 92 cc 14 d5 f8 8b 91 a2 0d 28 58 ba dd ............(X.. 0080 40 9a 91 db 01 7f @..... Frame 20 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:50:43.197655000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 14.952415000 seconds] Frame Number: 20 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb85 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) Encapsulating Security Payload ESP SPI: 0x8adc3750 ESP Sequence: 1 0000 00 0c 29 ba 58 19 00 0c 29 6d a9 a5 08 00 45 00 ..).X...)m....E. 0010 00 78 00 01 00 00 80 32 fb 85 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 92 8a dc 37 50 00 00 00 01 d1 b2 4d cc a8 df ....7P......M... 0030 f8 dd 6d 3f 95 c5 af 5e 91 c0 bf fc d2 1e 08 ab ..m?...^........ 0040 ab 40 36 ee d6 32 67 73 11 f0 f6 6c 95 02 02 ec .@6..2gs...l.... 0050 3b 17 ee 1e 91 5c 6a aa 91 4c 37 e8 5f c4 87 5c ;....\j..L7._..\ 0060 b9 28 34 14 46 8a 9c 85 de dc 00 27 eb af e2 f4 .(4.F......'.... 0070 e1 1b cd 92 cc 14 d5 f8 8b 91 a2 0d 28 58 ba dd ............(X.. 0080 40 9a 91 db 01 7f @..... Frame 21 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:50:43.199885000 [Time delta from previous captured frame: 0.002230000 seconds] [Time delta from previous displayed frame: 0.002230000 seconds] [Time since reference or first frame: 14.954645000 seconds] Frame Number: 21 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x1d36 (7478) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 127 Protocol: ESP (0x32) Header checksum: 0xdf50 [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0x9837b7d3 ESP Sequence: 1 0000 00 0c 29 6d a9 a5 00 0c 29 ba 58 19 08 00 45 00 ..)m....).X...E. 0010 00 78 1d 36 00 00 7f 32 df 50 a5 e3 f9 92 a5 e3 .x.6...2.P...... 0020 f9 73 98 37 b7 d3 00 00 00 01 bb ad 0b 85 c8 59 .s.7...........Y 0030 96 6f c2 14 e6 17 ac 95 26 d4 72 4b 07 67 6d 47 .o......&.rK.gmG 0040 0e bf aa c0 5b d8 32 cf 01 15 18 68 f5 b3 fb 63 ....[.2....h...c 0050 38 c6 d4 17 79 a4 0c 7b f8 6a c3 43 85 16 4b 8d 8...y..{.j.C..K. 0060 de 92 19 a3 4b 76 f8 b2 3e 95 f9 e8 88 34 86 47 ....Kv..>....4.G 0070 d0 78 64 3a f5 a8 8a b2 02 bd 5f af ef 3f 8c f0 .xd:......_..?.. 0080 33 9c b7 af 61 53 3...aS Frame 22 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:50:43.199899000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 14.954659000 seconds] Frame Number: 22 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x1d36 (7478) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 127 Protocol: ESP (0x32) Header checksum: 0xdf50 [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0x9837b7d3 ESP Sequence: 1 0000 00 0c 29 6d a9 a5 00 0c 29 ba 58 19 08 00 45 00 ..)m....).X...E. 0010 00 78 1d 36 00 00 7f 32 df 50 a5 e3 f9 92 a5 e3 .x.6...2.P...... 0020 f9 73 98 37 b7 d3 00 00 00 01 bb ad 0b 85 c8 59 .s.7...........Y 0030 96 6f c2 14 e6 17 ac 95 26 d4 72 4b 07 67 6d 47 .o......&.rK.gmG 0040 0e bf aa c0 5b d8 32 cf 01 15 18 68 f5 b3 fb 63 ....[.2....h...c 0050 38 c6 d4 17 79 a4 0c 7b f8 6a c3 43 85 16 4b 8d 8...y..{.j.C..K. 0060 de 92 19 a3 4b 76 f8 b2 3e 95 f9 e8 88 34 86 47 ....Kv..>....4.G 0070 d0 78 64 3a f5 a8 8a b2 02 bd 5f af ef 3f 8c f0 .xd:......_..?.. 0080 33 9c b7 af 61 53 3...aS Frame 23 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:50:44.190573000 [Time delta from previous captured frame: 0.990674000 seconds] [Time delta from previous displayed frame: 0.990674000 seconds] [Time since reference or first frame: 15.945333000 seconds] Frame Number: 23 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb84 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) Encapsulating Security Payload ESP SPI: 0x8adc3750 ESP Sequence: 2 0000 00 0c 29 ba 58 19 00 0c 29 6d a9 a5 08 00 45 00 ..).X...)m....E. 0010 00 78 00 02 00 00 80 32 fb 84 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 92 8a dc 37 50 00 00 00 02 00 27 eb af e2 f4 ....7P.....'.... 0030 e1 1b cd 92 cc 14 d5 f8 8b 91 de a3 eb 09 e5 71 ...............q 0040 1d 78 71 62 02 8a b7 e5 f4 27 b0 f4 86 8e c5 8a .xqb.....'...... 0050 17 3f b8 bf e3 7a e1 be fb 98 b5 9a 4e 91 73 6d .?...z......N.sm 0060 f8 5c a4 82 8a 2e 65 c8 c6 dc 07 28 8f a4 48 a7 .\....e....(..H. 0070 c8 0d cb e4 9b 38 7f 32 79 46 15 f0 62 bb 4d ab .....8.2yF..b.M. 0080 74 e5 ad 58 70 36 t..Xp6 Frame 24 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:50:44.190591000 [Time delta from previous captured frame: 0.000018000 seconds] [Time delta from previous displayed frame: 0.000018000 seconds] [Time since reference or first frame: 15.945351000 seconds] Frame Number: 24 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb84 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) Encapsulating Security Payload ESP SPI: 0x8adc3750 ESP Sequence: 2 0000 00 0c 29 ba 58 19 00 0c 29 6d a9 a5 08 00 45 00 ..).X...)m....E. 0010 00 78 00 02 00 00 80 32 fb 84 a5 e3 f9 73 a5 e3 .x.....2.....s.. 0020 f9 92 8a dc 37 50 00 00 00 02 00 27 eb af e2 f4 ....7P.....'.... 0030 e1 1b cd 92 cc 14 d5 f8 8b 91 de a3 eb 09 e5 71 ...............q 0040 1d 78 71 62 02 8a b7 e5 f4 27 b0 f4 86 8e c5 8a .xqb.....'...... 0050 17 3f b8 bf e3 7a e1 be fb 98 b5 9a 4e 91 73 6d .?...z......N.sm 0060 f8 5c a4 82 8a 2e 65 c8 c6 dc 07 28 8f a4 48 a7 .\....e....(..H. 0070 c8 0d cb e4 9b 38 7f 32 79 46 15 f0 62 bb 4d ab .....8.2yF..b.M. 0080 74 e5 ad 58 70 36 t..Xp6 Frame 25 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:50:44.192032000 [Time delta from previous captured frame: 0.001441000 seconds] [Time delta from previous displayed frame: 0.001441000 seconds] [Time since reference or first frame: 15.946792000 seconds] Frame Number: 25 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x1d37 (7479) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 127 Protocol: ESP (0x32) Header checksum: 0xdf4f [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0x9837b7d3 ESP Sequence: 2 0000 00 0c 29 6d a9 a5 00 0c 29 ba 58 19 08 00 45 00 ..)m....).X...E. 0010 00 78 1d 37 00 00 7f 32 df 4f a5 e3 f9 92 a5 e3 .x.7...2.O...... 0020 f9 73 98 37 b7 d3 00 00 00 02 08 ae a3 0b b7 cb .s.7............ 0030 74 67 09 79 bd be b1 5a 12 c2 1c 71 99 02 17 3b tg.y...Z...q...; 0040 64 ce 39 26 e8 8d 40 d0 37 d0 e3 10 28 1a d6 c8 d.9&..@.7...(... 0050 95 a2 61 71 86 cb f6 0f 3f 13 01 c2 f4 d7 a6 45 ..aq....?......E 0060 be bb 79 0e 8d 9c f2 74 72 88 68 8f 02 50 a9 ca ..y....tr.h..P.. 0070 64 09 a7 0f 1a 8d 17 5f 7c 64 12 d9 bd 07 8b af d......_|d...... 0080 49 ac 3e 10 fb 9f I.>... Frame 26 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:50:44.192048000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 15.946808000 seconds] Frame Number: 26 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Destination: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) Address: 00:0c:29:6d:a9:a5 (00:0c:29:6d:a9:a5) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x1d37 (7479) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 127 Protocol: ESP (0x32) Header checksum: 0xdf4f [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0x9837b7d3 ESP Sequence: 2 0000 00 0c 29 6d a9 a5 00 0c 29 ba 58 19 08 00 45 00 ..)m....).X...E. 0010 00 78 1d 37 00 00 7f 32 df 4f a5 e3 f9 92 a5 e3 .x.7...2.O...... 0020 f9 73 98 37 b7 d3 00 00 00 02 08 ae a3 0b b7 cb .s.7............ 0030 74 67 09 79 bd be b1 5a 12 c2 1c 71 99 02 17 3b tg.y...Z...q...; 0040 64 ce 39 26 e8 8d 40 d0 37 d0 e3 10 28 1a d6 c8 d.9&..@.7...(... 0050 95 a2 61 71 86 cb f6 0f 3f 13 01 c2 f4 d7 a6 45 ..aq....?......E 0060 be bb 79 0e 8d 9c f2 74 72 88 68 8f 02 50 a9 ca ..y....tr.h..P.. 0070 64 09 a7 0f 1a 8d 17 5f 7c 64 12 d9 bd 07 8b af d......_|d...... 0080 49 ac 3e 10 fb 9f I.>...