Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Feb 7, 2011 16:08:16.068791000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x029f (671) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8de [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x1e33 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 15AEDB4971828BBB Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 23 f8 10 29 12 00 0c 29 3f 71 77 08 00 45 00 .#..)...)?qw..E. 0010 00 98 02 9f 00 00 80 11 f8 de a5 e3 f9 73 a5 e3 .............s.. 0020 f9 9c 01 f4 01 f4 00 84 1e 33 15 ae db 49 71 82 .........3...Iq. 0030 8b bb 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 2 (166 bytes on wire, 166 bytes captured) Arrival Time: Feb 7, 2011 16:08:16.068821000 [Time delta from previous captured frame: 0.000030000 seconds] [Time delta from previous displayed frame: 0.000030000 seconds] [Time since reference or first frame: 0.000030000 seconds] Frame Number: 2 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x029f (671) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8de [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x1e33 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 15AEDB4971828BBB Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NONE (0) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n 0000 00 23 f8 10 29 12 00 0c 29 3f 71 77 08 00 45 00 .#..)...)?qw..E. 0010 00 98 02 9f 00 00 80 11 f8 de a5 e3 f9 73 a5 e3 .............s.. 0020 f9 9c 01 f4 01 f4 00 84 1e 33 15 ae db 49 71 82 .........3...Iq. 0030 8b bb 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 00 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f ...B{. Frame 3 (162 bytes on wire, 162 bytes captured) Arrival Time: Feb 7, 2011 16:08:16.073674000 [Time delta from previous captured frame: 0.004853000 seconds] [Time delta from previous displayed frame: 0.004853000 seconds] [Time since reference or first frame: 0.004883000 seconds] Frame Number: 3 Frame Length: 162 bytes Capture Length: 162 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:23:f8:10:29:12 (00:23:f8:10:29:12), Dst: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Destination: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.156 (165.227.249.156), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 148 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb81 [correct] [Good: True] [Bad : False] Source: 165.227.249.156 (165.227.249.156) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 128 Checksum: 0x31fe [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 15AEDB4971828BBB Responder cookie: F673FDF9C5056600 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 120 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID: 4F457E717F6B5A4E727D576B Next payload: Vendor ID (13) Payload length: 16 Vendor ID: 4F457E717F6B5A4E727D576B Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 3f 71 77 00 23 f8 10 29 12 08 00 45 00 ..)?qw.#..)...E. 0010 00 94 00 00 40 00 40 11 fb 81 a5 e3 f9 9c a5 e3 ....@.@......... 0020 f9 73 01 f4 01 f4 00 80 31 fe 15 ae db 49 71 82 .s......1....Iq. 0030 8b bb f6 73 fd f9 c5 05 66 00 01 10 02 00 00 00 ...s....f....... 0040 00 00 00 00 00 78 0d 00 00 38 00 00 00 01 00 00 .....x...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 0e 10 0d 00 ................ 0080 00 10 4f 45 7e 71 7f 6b 5a 4e 72 7d 57 6b 00 00 ..OE~q.kZNr}Wk.. 0090 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00a0 01 00 .. Frame 4 (298 bytes on wire, 298 bytes captured) Arrival Time: Feb 7, 2011 16:08:18.089425000 [Time delta from previous captured frame: 2.015751000 seconds] [Time delta from previous displayed frame: 2.015751000 seconds] [Time since reference or first frame: 2.020634000 seconds] Frame Number: 4 Frame Length: 298 bytes Capture Length: 298 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x02a2 (674) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf857 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xa7bc [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 15AEDB4971828BBB Responder cookie: F673FDF9C5056600 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 23 f8 10 29 12 00 0c 29 3f 71 77 08 00 45 00 .#..)...)?qw..E. 0010 01 1c 02 a2 00 00 80 11 f8 57 a5 e3 f9 73 a5 e3 .........W...s.. 0020 f9 9c 01 f4 01 f4 01 08 a7 bc 15 ae db 49 71 82 .............Iq. 0030 8b bb f6 73 fd f9 c5 05 66 00 04 10 02 00 00 00 ...s....f....... 0040 00 00 00 00 01 00 0a 00 00 84 50 67 9c 93 67 1e ..........Pg..g. 0050 c0 53 9f 5b df 5f 50 40 21 02 ba 76 33 21 22 1c .S.[._P@!..v3!". 0060 31 c3 f9 ff d2 bc 1c 29 81 e4 7d 14 05 d2 7f 61 1......)..}....a 0070 f5 2e a2 f4 91 50 38 2e b4 a9 e7 5e c9 bf 20 41 .....P8....^.. A 0080 5a 0b 3c c4 9b c1 a6 5f 61 95 10 fd c0 65 36 8b Z.<...._a....e6. 0090 1a 12 9a a2 88 d4 c4 78 17 7c 00 e0 d8 36 91 b8 .......x.|...6.. 00a0 0c 32 8b 7a e7 69 34 df 85 3a d7 fd b5 a5 68 d9 .2.z.i4..:....h. 00b0 8c e9 c0 06 a8 24 8a 87 6c 51 44 e9 ff 87 4a 23 .....$..lQD...J# 00c0 4e 63 02 89 2c 96 42 39 86 96 0d 00 00 18 51 7d Nc..,.B9......Q} 00d0 62 4f f6 50 cf f4 7c 1f fc df 59 f7 21 d1 ee 63 bO.P..|...Y.!..c 00e0 61 77 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 aw...0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 5 (298 bytes on wire, 298 bytes captured) Arrival Time: Feb 7, 2011 16:08:18.089455000 [Time delta from previous captured frame: 0.000030000 seconds] [Time delta from previous displayed frame: 0.000030000 seconds] [Time since reference or first frame: 2.020664000 seconds] Frame Number: 5 Frame Length: 298 bytes Capture Length: 298 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x02a2 (674) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf857 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xa7bc [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 15AEDB4971828BBB Responder cookie: F673FDF9C5056600 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Next payload: Vendor ID (13) Payload length: 48 Vendor ID: 47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID: DA8E937880010000 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: DA8E937880010000 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 23 f8 10 29 12 00 0c 29 3f 71 77 08 00 45 00 .#..)...)?qw..E. 0010 01 1c 02 a2 00 00 80 11 f8 57 a5 e3 f9 73 a5 e3 .........W...s.. 0020 f9 9c 01 f4 01 f4 01 08 a7 bc 15 ae db 49 71 82 .............Iq. 0030 8b bb f6 73 fd f9 c5 05 66 00 04 10 02 00 00 00 ...s....f....... 0040 00 00 00 00 01 00 0a 00 00 84 50 67 9c 93 67 1e ..........Pg..g. 0050 c0 53 9f 5b df 5f 50 40 21 02 ba 76 33 21 22 1c .S.[._P@!..v3!". 0060 31 c3 f9 ff d2 bc 1c 29 81 e4 7d 14 05 d2 7f 61 1......)..}....a 0070 f5 2e a2 f4 91 50 38 2e b4 a9 e7 5e c9 bf 20 41 .....P8....^.. A 0080 5a 0b 3c c4 9b c1 a6 5f 61 95 10 fd c0 65 36 8b Z.<...._a....e6. 0090 1a 12 9a a2 88 d4 c4 78 17 7c 00 e0 d8 36 91 b8 .......x.|...6.. 00a0 0c 32 8b 7a e7 69 34 df 85 3a d7 fd b5 a5 68 d9 .2.z.i4..:....h. 00b0 8c e9 c0 06 a8 24 8a 87 6c 51 44 e9 ff 87 4a 23 .....$..lQD...J# 00c0 4e 63 02 89 2c 96 42 39 86 96 0d 00 00 18 51 7d Nc..,.B9......Q} 00d0 62 4f f6 50 cf f4 7c 1f fc df 59 f7 21 d1 ee 63 bO.P..|...Y.!..c 00e0 61 77 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 aw...0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 6 (222 bytes on wire, 222 bytes captured) Arrival Time: Feb 7, 2011 16:08:18.158160000 [Time delta from previous captured frame: 0.068705000 seconds] [Time delta from previous displayed frame: 0.068705000 seconds] [Time since reference or first frame: 2.089369000 seconds] Frame Number: 6 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:23:f8:10:29:12 (00:23:f8:10:29:12), Dst: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Destination: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.156 (165.227.249.156), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb45 [correct] [Good: True] [Bad : False] Source: 165.227.249.156 (165.227.249.156) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x0a48 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 15AEDB4971828BBB Responder cookie: F673FDF9C5056600 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 0c 29 3f 71 77 00 23 f8 10 29 12 08 00 45 00 ..)?qw.#..)...E. 0010 00 d0 00 00 40 00 40 11 fb 45 a5 e3 f9 9c a5 e3 ....@.@..E...... 0020 f9 73 01 f4 01 f4 00 bc 0a 48 15 ae db 49 71 82 .s.......H...Iq. 0030 8b bb f6 73 fd f9 c5 05 66 00 04 10 02 00 00 00 ...s....f....... 0040 00 00 00 00 00 b4 0a 00 00 84 68 95 ef 5e 19 9c ..........h..^.. 0050 45 0c 82 cd 78 30 59 2a 63 25 8b 89 97 a4 91 5d E...x0Y*c%.....] 0060 8b 54 9d f2 2a 88 3a 06 9d f4 f8 30 f2 5c c0 0b .T..*.:....0.\.. 0070 f9 7b 27 b7 be af 1f c5 f8 cf 42 b9 90 79 b6 f8 .{'.......B..y.. 0080 cf 40 80 47 28 bd 65 90 6a 56 f9 b4 63 d4 d8 ff .@.G(.e.jV..c... 0090 48 1d 6c 2c 57 9b b0 60 31 df 8d 06 3e ee b7 7b H.l,W..`1...>..{ 00a0 64 8c 73 33 6b a5 56 44 45 80 eb 45 31 b9 9a 1e d.s3k.VDE..E1... 00b0 75 07 e6 40 fb 78 bc 44 56 f5 5a d6 50 70 65 cd u..@.x.DV.Z.Ppe. 00c0 74 8c 41 b0 81 72 d3 11 03 d3 00 00 00 14 0e e1 t.A..r.......... 00d0 af b5 d3 89 c5 39 50 e5 77 de b9 6a 2d 2c .....9P.w..j-, Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 7, 2011 16:08:19.198423000 [Time delta from previous captured frame: 1.040263000 seconds] [Time delta from previous displayed frame: 1.040263000 seconds] [Time since reference or first frame: 3.129632000 seconds] Frame Number: 7 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x02a5 (677) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8f8 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x8bb5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 15AEDB4971828BBB Responder cookie: F673FDF9C5056600 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 23 f8 10 29 12 00 0c 29 3f 71 77 08 00 45 00 .#..)...)?qw..E. 0010 00 78 02 a5 00 00 80 11 f8 f8 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 9c 01 f4 01 f4 00 64 8b b5 15 ae db 49 71 82 .......d.....Iq. 0030 8b bb f6 73 fd f9 c5 05 66 00 05 10 02 01 00 00 ...s....f....... 0040 00 00 00 00 00 5c 9e b8 d5 42 f0 e0 6d b2 e3 d4 .....\...B..m... 0050 7c 91 95 83 5e a9 98 07 f7 e2 56 a6 e2 e5 f7 e2 |...^.....V..... 0060 58 25 d7 9a a0 91 3a fc 32 b6 00 3e 20 1b 57 39 X%....:.2..> .W9 0070 4d e1 af 91 de b4 92 aa f2 51 b4 d3 7a 75 d8 14 M........Q..zu.. 0080 fa 6b 8d 08 8d 90 .k.... Frame 8 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 7, 2011 16:08:19.198448000 [Time delta from previous captured frame: 0.000025000 seconds] [Time delta from previous displayed frame: 0.000025000 seconds] [Time since reference or first frame: 3.129657000 seconds] Frame Number: 8 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x02a5 (677) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8f8 [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x8bb5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 15AEDB4971828BBB Responder cookie: F673FDF9C5056600 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 23 f8 10 29 12 00 0c 29 3f 71 77 08 00 45 00 .#..)...)?qw..E. 0010 00 78 02 a5 00 00 80 11 f8 f8 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 9c 01 f4 01 f4 00 64 8b b5 15 ae db 49 71 82 .......d.....Iq. 0030 8b bb f6 73 fd f9 c5 05 66 00 05 10 02 01 00 00 ...s....f....... 0040 00 00 00 00 00 5c 9e b8 d5 42 f0 e0 6d b2 e3 d4 .....\...B..m... 0050 7c 91 95 83 5e a9 98 07 f7 e2 56 a6 e2 e5 f7 e2 |...^.....V..... 0060 58 25 d7 9a a0 91 3a fc 32 b6 00 3e 20 1b 57 39 X%....:.2..> .W9 0070 4d e1 af 91 de b4 92 aa f2 51 b4 d3 7a 75 d8 14 M........Q..zu.. 0080 fa 6b 8d 08 8d 90 .k.... Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: Feb 7, 2011 16:08:19.200769000 [Time delta from previous captured frame: 0.002321000 seconds] [Time delta from previous displayed frame: 0.002321000 seconds] [Time since reference or first frame: 3.131978000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:23:f8:10:29:12 (00:23:f8:10:29:12), Dst: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Destination: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.156 (165.227.249.156), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbad [correct] [Good: True] [Bad : False] Source: 165.227.249.156 (165.227.249.156) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xd09c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 15AEDB4971828BBB Responder cookie: F673FDF9C5056600 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 3f 71 77 00 23 f8 10 29 12 08 00 45 00 ..)?qw.#..)...E. 0010 00 68 00 00 40 00 40 11 fb ad a5 e3 f9 9c a5 e3 .h..@.@......... 0020 f9 73 01 f4 01 f4 00 54 d0 9c 15 ae db 49 71 82 .s.....T.....Iq. 0030 8b bb f6 73 fd f9 c5 05 66 00 05 10 02 01 00 00 ...s....f....... 0040 00 00 00 00 00 4c 2b ce 9d 93 d3 78 30 ee 10 8b .....L+....x0... 0050 c7 47 69 91 31 79 7c 21 00 3f 43 8e 44 ae 84 6e .Gi.1y|!.?C.D..n 0060 d2 fa ea 22 93 8e 39 a6 81 0e b6 21 3c 74 85 9d ..."..9....!=. 00f0 fe 6c 72 a6 4f 8b b7 74 65 f8 f9 99 fc 60 cc 69 .lr.O..te....`.i 0100 c4 93 a2 5e 07 2b ec 51 a6 51 21 b6 16 6a 6d 2f ...^.+.Q.Q!..jm/ 0110 f4 02 76 36 4a 42 9e f9 18 57 7e 1b 69 8c eb d5 ..v6JB...W~.i... 0120 6d 5f 58 9d 21 92 2a 18 a4 71 1b 24 6a 69 75 dc m_X.!.*..q.$jiu. 0130 43 58 5a e6 59 45 8b a3 e7 b0 c2 86 94 b6 01 a7 CXZ.YE.......... 0140 79 9b 92 4b b3 7d 74 c1 4f 6a 47 ae 2b df 74 09 y..K.}t.OjG.+.t. 0150 10 c9 eb 6a 7d 41 ...j}A Frame 13 (102 bytes on wire, 102 bytes captured) Arrival Time: Feb 7, 2011 16:08:20.669259000 [Time delta from previous captured frame: 0.004473000 seconds] [Time delta from previous displayed frame: 0.004473000 seconds] [Time since reference or first frame: 4.600468000 seconds] Frame Number: 13 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x02b3 (691) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf90a [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x48bd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 15AEDB4971828BBB Responder cookie: F673FDF9C5056600 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x6f00e75a Length: 60 Encrypted payload (32 bytes) 0000 00 23 f8 10 29 12 00 0c 29 3f 71 77 08 00 45 00 .#..)...)?qw..E. 0010 00 58 02 b3 00 00 80 11 f9 0a a5 e3 f9 73 a5 e3 .X...........s.. 0020 f9 9c 01 f4 01 f4 00 44 48 bd 15 ae db 49 71 82 .......DH....Iq. 0030 8b bb f6 73 fd f9 c5 05 66 00 08 10 20 01 6f 00 ...s....f... .o. 0040 e7 5a 00 00 00 3c 36 d6 ac 4b 41 b7 45 25 62 41 .Z...<6..KA.E%bA 0050 b4 e3 32 d0 21 ea 92 b8 56 dd 3b f8 ac a1 6a 11 ..2.!...V.;...j. 0060 6d 3b 1a bf 4d 7d m;..M} Frame 14 (102 bytes on wire, 102 bytes captured) Arrival Time: Feb 7, 2011 16:08:20.669291000 [Time delta from previous captured frame: 0.000032000 seconds] [Time delta from previous displayed frame: 0.000032000 seconds] [Time since reference or first frame: 4.600500000 seconds] Frame Number: 14 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x02b3 (691) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf90a [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x48bd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 15AEDB4971828BBB Responder cookie: F673FDF9C5056600 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x6f00e75a Length: 60 Encrypted payload (32 bytes) 0000 00 23 f8 10 29 12 00 0c 29 3f 71 77 08 00 45 00 .#..)...)?qw..E. 0010 00 58 02 b3 00 00 80 11 f9 0a a5 e3 f9 73 a5 e3 .X...........s.. 0020 f9 9c 01 f4 01 f4 00 44 48 bd 15 ae db 49 71 82 .......DH....Iq. 0030 8b bb f6 73 fd f9 c5 05 66 00 08 10 20 01 6f 00 ...s....f... .o. 0040 e7 5a 00 00 00 3c 36 d6 ac 4b 41 b7 45 25 62 41 .Z...<6..KA.E%bA 0050 b4 e3 32 d0 21 ea 92 b8 56 dd 3b f8 ac a1 6a 11 ..2.!...V.;...j. 0060 6d 3b 1a bf 4d 7d m;..M} Frame 15 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 7, 2011 16:08:31.437282000 [Time delta from previous captured frame: 10.767991000 seconds] [Time delta from previous displayed frame: 10.767991000 seconds] [Time since reference or first frame: 15.368491000 seconds] Frame Number: 15 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb7b [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.156 (165.227.249.156) Encapsulating Security Payload ESP SPI: 0x775061a1 ESP Sequence: 1 0000 00 23 f8 10 29 12 00 0c 29 3f 71 77 08 00 45 00 .#..)...)?qw..E. 0010 00 78 00 01 00 00 80 32 fb 7b a5 e3 f9 73 a5 e3 .x.....2.{...s.. 0020 f9 9c 77 50 61 a1 00 00 00 01 49 ca 70 d5 3f a6 ..wPa.....I.p.?. 0030 dd 04 c3 e1 87 bb e3 93 5e 7d bc e7 a5 49 06 de ........^}...I.. 0040 51 77 07 2b 1f 2f 95 88 c0 19 19 07 2b 45 ec b2 Qw.+./......+E.. 0050 fc e3 a0 77 27 f1 7c 96 61 24 a1 77 30 3a cf 11 ...w'.|.a$.w0:.. 0060 06 56 84 2e 72 f8 15 95 3c 26 55 40 f0 54 23 0c .V..r...<&U@.T#. 0070 fa 10 3d ce 77 35 5b 7d c9 f2 bf c6 a7 b1 99 7f ..=.w5[}........ 0080 2a af 8a ec db f9 *..... Frame 16 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 7, 2011 16:08:31.437298000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 15.368507000 seconds] Frame Number: 16 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb7b [correct] [Good: True] [Bad : False] Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.156 (165.227.249.156) Encapsulating Security Payload ESP SPI: 0x775061a1 ESP Sequence: 1 0000 00 23 f8 10 29 12 00 0c 29 3f 71 77 08 00 45 00 .#..)...)?qw..E. 0010 00 78 00 01 00 00 80 32 fb 7b a5 e3 f9 73 a5 e3 .x.....2.{...s.. 0020 f9 9c 77 50 61 a1 00 00 00 01 49 ca 70 d5 3f a6 ..wPa.....I.p.?. 0030 dd 04 c3 e1 87 bb e3 93 5e 7d bc e7 a5 49 06 de ........^}...I.. 0040 51 77 07 2b 1f 2f 95 88 c0 19 19 07 2b 45 ec b2 Qw.+./......+E.. 0050 fc e3 a0 77 27 f1 7c 96 61 24 a1 77 30 3a cf 11 ...w'.|.a$.w0:.. 0060 06 56 84 2e 72 f8 15 95 3c 26 55 40 f0 54 23 0c .V..r...<&U@.T#. 0070 fa 10 3d ce 77 35 5b 7d c9 f2 bf c6 a7 b1 99 7f ..=.w5[}........ 0080 2a af 8a ec db f9 *..... Frame 17 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 7, 2011 16:08:31.440519000 [Time delta from previous captured frame: 0.003221000 seconds] [Time delta from previous displayed frame: 0.003221000 seconds] [Time since reference or first frame: 15.371728000 seconds] Frame Number: 17 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:23:f8:10:29:12 (00:23:f8:10:29:12), Dst: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Destination: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) Address: 00:0c:29:3f:71:77 (00:0c:29:3f:71:77) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.156 (165.227.249.156), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0xc649 (50761) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x7533 [correct] [Good: True] [Bad : False] Source: 165.227.249.156 (165.227.249.156) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload ESP SPI: 0xb922fae7 ESP Sequence: 1 0000 00 0c 29 3f 71 77 00 23 f8 10 29 12 08 00 45 00 ..)?qw.#..)...E. 0010 00 78 c6 49 00 00 40 32 75 33 a5 e3 f9 9c a5 e3 .x.I..@2u3...... 0020 f9 73 b9 22 fa e7 00 00 00 01 d8 c0 d8 bd bf e2 .s."............ 0030 f0 bc 7b 30 1c 55 62 d3 47 aa 14 c3 00 97 78 16 ..{0.Ub.G.....x. 0040 e6 52 8a dc fd 2b 59 d4 fb fd 59 54 c0 20 41 92 .R...+Y...YT. A. 0050 87 a7 fb 29 29 dd ed 2e c3 c6 7f a7 a2 8f 6b f2 ...)).........k. 0060 41 07 3a 2f 15 69 95 10 65 23 7b 2a 7e 34 6c f2 A.:/.i..e#{*~4l. 0070 bf 19 a0 c3 7f 42 ab 16 63 f2 21 91 5e ab ab 0e .....B..c.!.^... 0080 bd db e8 86 1c 2c .....,