Frame 1 (326 bytes on wire, 326 bytes captured) Arrival Time: Oct 19, 2010 13:53:52.811208000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb08 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x890b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 8C7E6444F632DDD3 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0x8C7E6444F632DDD3 Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 17 c5 6d 9d fd 00 0c 29 96 68 b2 08 00 45 00 ...m....).h...E. 0010 01 38 00 00 40 00 40 11 fb 08 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 68 01 f4 01 f4 01 24 89 0b 8c 7e 64 44 f6 32 .h.....$...~dD.2 0030 dd d3 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 8c 7e 64 44 f6 32 .....|.....~dD.2 0060 dd d3 03 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 2 (326 bytes on wire, 326 bytes captured) Arrival Time: Oct 19, 2010 13:53:52.811225000 [Time delta from previous captured frame: 0.000017000 seconds] [Time delta from previous displayed frame: 0.000017000 seconds] [Time since reference or first frame: 0.000017000 seconds] Frame Number: 2 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb08 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x890b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 8C7E6444F632DDD3 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0x8C7E6444F632DDD3 Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 17 c5 6d 9d fd 00 0c 29 96 68 b2 08 00 45 00 ...m....).h...E. 0010 01 38 00 00 40 00 40 11 fb 08 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 68 01 f4 01 f4 01 24 89 0b 8c 7e 64 44 f6 32 .h.....$...~dD.2 0030 dd d3 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 8c 7e 64 44 f6 32 .....|.....~dD.2 0060 dd d3 03 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 3 (158 bytes on wire, 158 bytes captured) Arrival Time: Oct 19, 2010 13:53:52.814860000 [Time delta from previous captured frame: 0.003635000 seconds] [Time delta from previous displayed frame: 0.003635000 seconds] [Time since reference or first frame: 0.003652000 seconds] Frame Number: 3 Frame Length: 158 bytes Capture Length: 158 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.104 (165.227.249.104), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 144 Identification: 0x09d6 (2518) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x72da [correct] [Good: True] [Bad : False] Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 124 Checksum: 0x1584 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 8C7E6444F632DDD3 Responder cookie: 23B5A8A34B18724B Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 116 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: 5B362BC820F60007 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: 5B362BC820F60007 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE 0000 00 0c 29 96 68 b2 00 17 c5 6d 9d fd 08 00 45 00 ..).h....m....E. 0010 00 90 09 d6 00 00 ff 11 72 da a5 e3 f9 68 a5 e3 ........r....h.. 0020 f9 7c 01 f4 01 f4 00 7c 15 84 8c 7e 64 44 f6 32 .|.....|...~dD.2 0030 dd d3 23 b5 a8 a3 4b 18 72 4b 01 10 02 00 00 00 ..#...K.rK...... 0040 00 00 00 00 00 74 0d 00 00 38 00 00 00 01 00 00 .....t...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 0c 5b 36 2b c8 20 f6 00 07 00 00 00 14 4a 13 ..[6+. .......J. 0090 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f ....XE\W(...E/ Frame 4 (270 bytes on wire, 270 bytes captured) Arrival Time: Oct 19, 2010 13:53:52.827382000 [Time delta from previous captured frame: 0.012522000 seconds] [Time delta from previous displayed frame: 0.012522000 seconds] [Time since reference or first frame: 0.016174000 seconds] Frame Number: 4 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb40 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x2ab0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 8C7E6444F632DDD3 Responder cookie: 23B5A8A34B18724B Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (RFC 3947) (20) Payload length: 20 Nonce Data NAT-D (RFC 3947) payload Next payload: NAT-D (RFC 3947) (20) Payload length: 24 Hash of address and port: 7787E0AD965EE587E00F2D3CF93D53F5B32319EF NAT-D (RFC 3947) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: FAE8971DAAF6EBB20A8C44C14ADF308FABE32EF3 0000 00 17 c5 6d 9d fd 00 0c 29 96 68 b2 08 00 45 00 ...m....).h...E. 0010 01 00 00 00 40 00 40 11 fb 40 a5 e3 f9 7c a5 e3 ....@.@..@...|.. 0020 f9 68 01 f4 01 f4 00 ec 2a b0 8c 7e 64 44 f6 32 .h......*..~dD.2 0030 dd d3 23 b5 a8 a3 4b 18 72 4b 04 10 02 00 00 00 ..#...K.rK...... 0040 00 00 00 00 00 e4 0a 00 00 84 03 2a 7a f1 34 fd ...........*z.4. 0050 99 06 21 d9 d5 a9 44 e7 2b 09 df 02 76 ca 26 6e ..!...D.+...v.&n 0060 37 a4 e0 df 84 7f 42 6c 66 eb 5c 44 d8 88 30 ee 7.....Blf.\D..0. 0070 96 30 6c a6 e6 f7 7f 56 eb db e7 aa ca cb 1d 87 .0l....V........ 0080 0b 15 6d 46 f2 4a d1 a0 03 c1 b0 6a b3 6e ab 0f ..mF.J.....j.n.. 0090 6c ac 98 3e 72 f0 cb 51 e9 32 b9 44 3c 27 dc c6 l..>r..Q.2.D<'.. 00a0 ab fe 60 7a d9 45 e5 2d 3b 9a 65 34 99 67 01 bd ..`z.E.-;.e4.g.. 00b0 24 51 c0 03 16 8e 65 5f 6f 78 41 2e 74 da e5 e0 $Q....e_oxA.t... 00c0 4f 15 56 a6 46 d0 9c b2 7f 49 14 00 00 14 1e f2 O.V.F....I...... 00d0 b0 26 85 ed c3 a7 1a f0 21 be d2 48 4d 84 14 00 .&......!..HM... 00e0 00 18 77 87 e0 ad 96 5e e5 87 e0 0f 2d 3c f9 3d ..w....^....-<.= 00f0 53 f5 b3 23 19 ef 00 00 00 18 fa e8 97 1d aa f6 S..#............ 0100 eb b2 0a 8c 44 c1 4a df 30 8f ab e3 2e f3 ....D.J.0..... Frame 5 (270 bytes on wire, 270 bytes captured) Arrival Time: Oct 19, 2010 13:53:52.827395000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 0.016187000 seconds] Frame Number: 5 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb40 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x2ab0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 8C7E6444F632DDD3 Responder cookie: 23B5A8A34B18724B Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (RFC 3947) (20) Payload length: 20 Nonce Data NAT-D (RFC 3947) payload Next payload: NAT-D (RFC 3947) (20) Payload length: 24 Hash of address and port: 7787E0AD965EE587E00F2D3CF93D53F5B32319EF NAT-D (RFC 3947) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: FAE8971DAAF6EBB20A8C44C14ADF308FABE32EF3 0000 00 17 c5 6d 9d fd 00 0c 29 96 68 b2 08 00 45 00 ...m....).h...E. 0010 01 00 00 00 40 00 40 11 fb 40 a5 e3 f9 7c a5 e3 ....@.@..@...|.. 0020 f9 68 01 f4 01 f4 00 ec 2a b0 8c 7e 64 44 f6 32 .h......*..~dD.2 0030 dd d3 23 b5 a8 a3 4b 18 72 4b 04 10 02 00 00 00 ..#...K.rK...... 0040 00 00 00 00 00 e4 0a 00 00 84 03 2a 7a f1 34 fd ...........*z.4. 0050 99 06 21 d9 d5 a9 44 e7 2b 09 df 02 76 ca 26 6e ..!...D.+...v.&n 0060 37 a4 e0 df 84 7f 42 6c 66 eb 5c 44 d8 88 30 ee 7.....Blf.\D..0. 0070 96 30 6c a6 e6 f7 7f 56 eb db e7 aa ca cb 1d 87 .0l....V........ 0080 0b 15 6d 46 f2 4a d1 a0 03 c1 b0 6a b3 6e ab 0f ..mF.J.....j.n.. 0090 6c ac 98 3e 72 f0 cb 51 e9 32 b9 44 3c 27 dc c6 l..>r..Q.2.D<'.. 00a0 ab fe 60 7a d9 45 e5 2d 3b 9a 65 34 99 67 01 bd ..`z.E.-;.e4.g.. 00b0 24 51 c0 03 16 8e 65 5f 6f 78 41 2e 74 da e5 e0 $Q....e_oxA.t... 00c0 4f 15 56 a6 46 d0 9c b2 7f 49 14 00 00 14 1e f2 O.V.F....I...... 00d0 b0 26 85 ed c3 a7 1a f0 21 be d2 48 4d 84 14 00 .&......!..HM... 00e0 00 18 77 87 e0 ad 96 5e e5 87 e0 0f 2d 3c f9 3d ..w....^....-<.= 00f0 53 f5 b3 23 19 ef 00 00 00 18 fa e8 97 1d aa f6 S..#............ 0100 eb b2 0a 8c 44 c1 4a df 30 8f ab e3 2e f3 ....D.J.0..... Frame 6 (318 bytes on wire, 318 bytes captured) Arrival Time: Oct 19, 2010 13:53:52.875139000 [Time delta from previous captured frame: 0.047744000 seconds] [Time delta from previous displayed frame: 0.047744000 seconds] [Time since reference or first frame: 0.063931000 seconds] Frame Number: 6 Frame Length: 318 bytes Capture Length: 318 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.104 (165.227.249.104), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 304 Identification: 0x09d6 (2518) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x723a [correct] [Good: True] [Bad : False] Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 284 Checksum: 0xed23 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 8C7E6444F632DDD3 Responder cookie: 23B5A8A34B18724B Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 276 Key Exchange payload Next payload: NAT-D (RFC 3947) (20) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) NAT-D (RFC 3947) payload Next payload: NAT-D (RFC 3947) (20) Payload length: 24 Hash of address and port: FAE8971DAAF6EBB20A8C44C14ADF308FABE32EF3 NAT-D (RFC 3947) payload Next payload: Nonce (10) Payload length: 24 Hash of address and port: 7787E0AD965EE587E00F2D3CF93D53F5B32319EF Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: 404BF439522CA3F6 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: 404BF439522CA3F6 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: Vendor ID (13) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 96 68 b2 00 17 c5 6d 9d fd 08 00 45 00 ..).h....m....E. 0010 01 30 09 d6 00 00 ff 11 72 3a a5 e3 f9 68 a5 e3 .0......r:...h.. 0020 f9 7c 01 f4 01 f4 01 1c ed 23 8c 7e 64 44 f6 32 .|.......#.~dD.2 0030 dd d3 23 b5 a8 a3 4b 18 72 4b 04 10 02 00 00 00 ..#...K.rK...... 0040 00 00 00 00 01 14 14 00 00 84 2a d3 20 11 5b 95 ..........*. .[. 0050 6b 07 2c 3c 0e a4 b7 52 f5 c6 a9 fc b8 74 43 a2 k.,<...R.....tC. 0060 3d 68 62 ef de 6e a0 61 45 5a 8a 1e b8 23 83 2c =hb..n.aEZ...#., 0070 ea 9d 6a de 4c 40 6f 58 c0 ce 0a e4 c0 b9 b5 f6 ..j.L@oX........ 0080 29 fa 12 9b 29 05 9c f6 8f 9d 72 4c 47 fd ad 30 )...).....rLG..0 0090 15 0a ce 42 4f 17 b3 a2 74 3e e5 17 8f 4a ce 26 ...BO...t>...J.& 00a0 6a 4d cb f3 dc c5 cc 3b 23 d7 62 96 51 82 f9 d0 jM.....;#.b.Q... 00b0 56 fe 7f a6 3e bd 5f 6c b0 6f 95 83 c4 f2 e1 58 V...>._l.o.....X 00c0 f8 63 f3 05 7c b6 d8 66 f1 7d 14 00 00 18 fa e8 .c..|..f.}...... 00d0 97 1d aa f6 eb b2 0a 8c 44 c1 4a df 30 8f ab e3 ........D.J.0... 00e0 2e f3 0a 00 00 18 77 87 e0 ad 96 5e e5 87 e0 0f ......w....^.... 00f0 2d 3c f9 3d 53 f5 b3 23 19 ef 0d 00 00 18 0e 0a -<.=S..#........ 0100 9f e1 19 17 e3 70 37 72 23 e9 4d 3b 2c 1b 44 38 .....p7r#.M;,.D8 0110 4c 47 0d 00 00 0c 40 4b f4 39 52 2c a3 f6 0d 00 LG....@K.9R,.... 0120 00 0c 09 00 26 89 df d6 b7 12 00 00 00 14 af ca ....&........... 0130 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 19, 2010 13:53:52.879140000 [Time delta from previous captured frame: 0.004001000 seconds] [Time delta from previous displayed frame: 0.004001000 seconds] [Time since reference or first frame: 0.067932000 seconds] Frame Number: 7 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc8 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xdf31 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 8C7E6444F632DDD3 Responder cookie: 23B5A8A34B18724B Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 17 c5 6d 9d fd 00 0c 29 96 68 b2 08 00 45 00 ...m....).h...E. 0010 00 78 00 00 40 00 40 11 fb c8 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 68 01 f4 01 f4 00 64 df 31 8c 7e 64 44 f6 32 .h.....d.1.~dD.2 0030 dd d3 23 b5 a8 a3 4b 18 72 4b 05 10 02 01 00 00 ..#...K.rK...... 0040 00 00 00 00 00 5c be cc 7f 86 e9 f1 79 f7 86 72 .....\......y..r 0050 d2 c4 e1 ad b3 fd 7f 4d c8 a2 b8 a9 fe 33 e0 75 .......M.....3.u 0060 51 e2 ab cb 29 ea 6f 2c 6d d6 80 9d e8 67 05 ba Q...).o,m....g.. 0070 3e e1 c4 53 03 0a 01 9e 0f a0 06 b9 24 9f 54 06 >..S........$.T. 0080 c8 14 36 90 0e 2e ..6... Frame 8 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 19, 2010 13:53:52.879160000 [Time delta from previous captured frame: 0.000020000 seconds] [Time delta from previous displayed frame: 0.000020000 seconds] [Time since reference or first frame: 0.067952000 seconds] Frame Number: 8 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc8 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xdf31 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 8C7E6444F632DDD3 Responder cookie: 23B5A8A34B18724B Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 17 c5 6d 9d fd 00 0c 29 96 68 b2 08 00 45 00 ...m....).h...E. 0010 00 78 00 00 40 00 40 11 fb c8 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 68 01 f4 01 f4 00 64 df 31 8c 7e 64 44 f6 32 .h.....d.1.~dD.2 0030 dd d3 23 b5 a8 a3 4b 18 72 4b 05 10 02 01 00 00 ..#...K.rK...... 0040 00 00 00 00 00 5c be cc 7f 86 e9 f1 79 f7 86 72 .....\......y..r 0050 d2 c4 e1 ad b3 fd 7f 4d c8 a2 b8 a9 fe 33 e0 75 .......M.....3.u 0060 51 e2 ab cb 29 ea 6f 2c 6d d6 80 9d e8 67 05 ba Q...).o,m....g.. 0070 3e e1 c4 53 03 0a 01 9e 0f a0 06 b9 24 9f 54 06 >..S........$.T. 0080 c8 14 36 90 0e 2e ..6... Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: Oct 19, 2010 13:53:52.880387000 [Time delta from previous captured frame: 0.001227000 seconds] [Time delta from previous displayed frame: 0.001227000 seconds] [Time since reference or first frame: 0.069179000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.104 (165.227.249.104), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x09d6 (2518) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7302 [correct] [Good: True] [Bad : False] Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xc2d3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 8C7E6444F632DDD3 Responder cookie: 23B5A8A34B18724B Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 96 68 b2 00 17 c5 6d 9d fd 08 00 45 00 ..).h....m....E. 0010 00 68 09 d6 00 00 ff 11 73 02 a5 e3 f9 68 a5 e3 .h......s....h.. 0020 f9 7c 01 f4 01 f4 00 54 c2 d3 8c 7e 64 44 f6 32 .|.....T...~dD.2 0030 dd d3 23 b5 a8 a3 4b 18 72 4b 05 10 02 01 00 00 ..#...K.rK...... 0040 00 00 00 00 00 4c be 64 5b 30 35 da df 0a 15 60 .....L.d[05....` 0050 4d e1 8a d8 7a d0 a3 e4 74 f0 d3 ab 7c c4 58 fb M...z...t...|.X. 0060 ab d6 ae e4 a9 b1 25 02 19 9d ba eb c5 2c 3e b8 ......%......,>. 0070 66 b7 6e a4 73 1c f.n.s. Frame 10 (518 bytes on wire, 518 bytes captured) Arrival Time: Oct 19, 2010 13:53:52.907170000 [Time delta from previous captured frame: 0.026783000 seconds] [Time delta from previous displayed frame: 0.026783000 seconds] [Time since reference or first frame: 0.095962000 seconds] Frame Number: 10 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa48 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0xbcbf [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 8C7E6444F632DDD3 Responder cookie: 23B5A8A34B18724B Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xeb576c9d Length: 476 Encrypted payload (448 bytes) 0000 00 17 c5 6d 9d fd 00 0c 29 96 68 b2 08 00 45 00 ...m....).h...E. 0010 01 f8 00 00 40 00 40 11 fa 48 a5 e3 f9 7c a5 e3 ....@.@..H...|.. 0020 f9 68 01 f4 01 f4 01 e4 bc bf 8c 7e 64 44 f6 32 .h.........~dD.2 0030 dd d3 23 b5 a8 a3 4b 18 72 4b 08 10 20 01 eb 57 ..#...K.rK.. ..W 0040 6c 9d 00 00 01 dc e9 46 ab c4 3e 80 e1 c8 cc 81 l......F..>..... 0050 09 82 12 b4 27 c0 c6 ab 7b d1 60 76 eb dc 52 40 ....'...{.`v..R@ 0060 9d 85 ab 20 fb a8 f0 92 54 f2 71 30 fd ad 70 6e ... ....T.q0..pn 0070 61 99 12 2e 3c c6 19 0d 9b 83 b6 c6 10 c6 d4 0f a...<........... 0080 13 cc 9a 19 e4 5f f5 c1 7c 72 69 7d c2 04 50 5a ....._..|ri}..PZ 0090 14 6a 4a 3c 62 d2 29 2b 56 d9 a5 50 1f 2c 64 bd .jJ....P'Z... 0160 62 7a 58 3d 0d 0e d0 70 46 0c 9f 9c 5f d5 76 40 bzX=...pF..._.v@ 0170 9f a4 f9 e6 75 27 91 02 77 95 5e 72 4d 78 8a ea ....u'..w.^rMx.. 0180 8c 65 c6 1a d0 fc a1 4a 4f f2 bc ce 7e a7 e9 b1 .e.....JO...~... 0190 df fb 5c 4f f4 89 d1 dd 4c 95 d5 4b 5b f2 7c e7 ..\O....L..K[.|. 01a0 30 bf f2 02 74 1a 43 56 97 09 90 db 72 77 e0 0d 0...t.CV....rw.. 01b0 05 12 6f cd e2 ab 90 9d b4 69 2f 6a 60 39 64 b0 ..o......i/j`9d. 01c0 11 58 7d 0c 57 46 b1 37 bf 97 90 69 3b 0c f6 8c .X}.WF.7...i;... 01d0 80 10 ce 1c 97 ab 3f 44 c1 fb 2e c0 0a 62 21 51 ......?D.....b!Q 01e0 02 72 01 96 17 67 5c 2d 2e 6c f6 df 59 b0 61 ed .r...g\-.l..Y.a. 01f0 cd ab 47 5d 3c 9c 65 44 cf 2b 13 b8 ad 83 87 53 ..G]<.eD.+.....S 0200 14 de 5c e2 3b b1 ..\.;. Frame 11 (518 bytes on wire, 518 bytes captured) Arrival Time: Oct 19, 2010 13:53:52.907195000 [Time delta from previous captured frame: 0.000025000 seconds] [Time delta from previous displayed frame: 0.000025000 seconds] [Time since reference or first frame: 0.095987000 seconds] Frame Number: 11 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa48 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0xbcbf [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 8C7E6444F632DDD3 Responder cookie: 23B5A8A34B18724B Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xeb576c9d Length: 476 Encrypted payload (448 bytes) 0000 00 17 c5 6d 9d fd 00 0c 29 96 68 b2 08 00 45 00 ...m....).h...E. 0010 01 f8 00 00 40 00 40 11 fa 48 a5 e3 f9 7c a5 e3 ....@.@..H...|.. 0020 f9 68 01 f4 01 f4 01 e4 bc bf 8c 7e 64 44 f6 32 .h.........~dD.2 0030 dd d3 23 b5 a8 a3 4b 18 72 4b 08 10 20 01 eb 57 ..#...K.rK.. ..W 0040 6c 9d 00 00 01 dc e9 46 ab c4 3e 80 e1 c8 cc 81 l......F..>..... 0050 09 82 12 b4 27 c0 c6 ab 7b d1 60 76 eb dc 52 40 ....'...{.`v..R@ 0060 9d 85 ab 20 fb a8 f0 92 54 f2 71 30 fd ad 70 6e ... ....T.q0..pn 0070 61 99 12 2e 3c c6 19 0d 9b 83 b6 c6 10 c6 d4 0f a...<........... 0080 13 cc 9a 19 e4 5f f5 c1 7c 72 69 7d c2 04 50 5a ....._..|ri}..PZ 0090 14 6a 4a 3c 62 d2 29 2b 56 d9 a5 50 1f 2c 64 bd .jJ....P'Z... 0160 62 7a 58 3d 0d 0e d0 70 46 0c 9f 9c 5f d5 76 40 bzX=...pF..._.v@ 0170 9f a4 f9 e6 75 27 91 02 77 95 5e 72 4d 78 8a ea ....u'..w.^rMx.. 0180 8c 65 c6 1a d0 fc a1 4a 4f f2 bc ce 7e a7 e9 b1 .e.....JO...~... 0190 df fb 5c 4f f4 89 d1 dd 4c 95 d5 4b 5b f2 7c e7 ..\O....L..K[.|. 01a0 30 bf f2 02 74 1a 43 56 97 09 90 db 72 77 e0 0d 0...t.CV....rw.. 01b0 05 12 6f cd e2 ab 90 9d b4 69 2f 6a 60 39 64 b0 ..o......i/j`9d. 01c0 11 58 7d 0c 57 46 b1 37 bf 97 90 69 3b 0c f6 8c .X}.WF.7...i;... 01d0 80 10 ce 1c 97 ab 3f 44 c1 fb 2e c0 0a 62 21 51 ......?D.....b!Q 01e0 02 72 01 96 17 67 5c 2d 2e 6c f6 df 59 b0 61 ed .r...g\-.l..Y.a. 01f0 cd ab 47 5d 3c 9c 65 44 cf 2b 13 b8 ad 83 87 53 ..G]<.eD.+.....S 0200 14 de 5c e2 3b b1 ..\.;. Frame 12 (342 bytes on wire, 342 bytes captured) Arrival Time: Oct 19, 2010 13:53:52.954746000 [Time delta from previous captured frame: 0.047551000 seconds] [Time delta from previous displayed frame: 0.047551000 seconds] [Time since reference or first frame: 0.143538000 seconds] Frame Number: 12 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.104 (165.227.249.104), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x09d6 (2518) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7222 [correct] [Good: True] [Bad : False] Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x94fd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 8C7E6444F632DDD3 Responder cookie: 23B5A8A34B18724B Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xeb576c9d Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 96 68 b2 00 17 c5 6d 9d fd 08 00 45 00 ..).h....m....E. 0010 01 48 09 d6 00 00 ff 11 72 22 a5 e3 f9 68 a5 e3 .H......r"...h.. 0020 f9 7c 01 f4 01 f4 01 34 94 fd 8c 7e 64 44 f6 32 .|.....4...~dD.2 0030 dd d3 23 b5 a8 a3 4b 18 72 4b 08 10 20 01 eb 57 ..#...K.rK.. ..W 0040 6c 9d 00 00 01 2c 44 b9 21 32 76 8f 54 f5 05 41 l....,D.!2v.T..A 0050 39 3a 9c d6 f8 4c c3 3a a6 cd 2a d1 3b 47 1d bd 9:...L.:..*.;G.. 0060 1c c9 dd f1 c1 5a 52 c8 18 61 f0 cd 73 9a 8b f5 .....ZR..a..s... 0070 d3 8f 35 d6 e3 2b 6a e4 57 8d 35 3f c9 5e 07 be ..5..+j.W.5?.^.. 0080 61 40 1a d6 c6 90 64 24 7f 0f b9 57 36 fa d8 ae a@....d$...W6... 0090 d9 e8 ae 1c a7 68 1e 42 ac af 85 8a 52 c8 f4 bc .....h.B....R... 00a0 e7 50 e0 c8 ff 8a b1 69 1e a3 e9 d6 9a 2b 89 35 .P.....i.....+.5 00b0 77 da db 11 de 8b 4e cb 41 f5 72 13 65 3f 6b eb w.....N.A.r.e?k. 00c0 90 e4 66 45 ff 31 c3 bb 70 9c 78 7c d1 48 8a 02 ..fE.1..p.x|.H.. 00d0 f2 a3 c2 a2 e1 42 e5 48 f6 6d e5 de 7f 0a 1b df .....B.H.m...... 00e0 e2 b6 8f 36 0c 55 6d c9 9e 6d 43 01 bf d8 7d 02 ...6.Um..mC...}. 00f0 13 8d c0 de 62 19 b4 e8 86 42 df 0d 31 53 eb ee ....b....B..1S.. 0100 50 30 18 c7 4a 33 39 a8 6e f6 d9 ca ae ad e3 cd P0..J39.n....... 0110 05 56 a0 01 ba 83 bf 42 e0 7a 77 95 c4 f1 e3 cf .V.....B.zw..... 0120 32 79 bd 84 25 74 d7 65 fc eb 8c 21 09 fd 6b ee 2y..%t.e...!..k. 0130 9c 57 b1 f0 d0 9a 70 41 eb 4f 47 fb 6b 7f ba 58 .W....pA.OG.k..X 0140 29 66 2d a1 c2 4c d9 73 c8 90 bd cb e4 b7 30 d8 )f-..L.s......0. 0150 ce ed 3a 6c 77 a2 ..:lw. Frame 13 (102 bytes on wire, 102 bytes captured) Arrival Time: Oct 19, 2010 13:53:52.958920000 [Time delta from previous captured frame: 0.004174000 seconds] [Time delta from previous displayed frame: 0.004174000 seconds] [Time since reference or first frame: 0.147712000 seconds] Frame Number: 13 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbe8 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x7bcd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 8C7E6444F632DDD3 Responder cookie: 23B5A8A34B18724B Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xeb576c9d Length: 60 Encrypted payload (32 bytes) 0000 00 17 c5 6d 9d fd 00 0c 29 96 68 b2 08 00 45 00 ...m....).h...E. 0010 00 58 00 00 40 00 40 11 fb e8 a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 68 01 f4 01 f4 00 44 7b cd 8c 7e 64 44 f6 32 .h.....D{..~dD.2 0030 dd d3 23 b5 a8 a3 4b 18 72 4b 08 10 20 01 eb 57 ..#...K.rK.. ..W 0040 6c 9d 00 00 00 3c 5c 30 e5 f0 78 8e fc da 44 4f l....<\0..x...DO 0050 cc f7 50 3b 21 79 60 cb 65 d1 ed 8f 5c ab 10 dd ..P;!y`.e...\... 0060 eb 90 e8 6f 41 ff ...oA. Frame 14 (102 bytes on wire, 102 bytes captured) Arrival Time: Oct 19, 2010 13:53:52.958937000 [Time delta from previous captured frame: 0.000017000 seconds] [Time delta from previous displayed frame: 0.000017000 seconds] [Time since reference or first frame: 0.147729000 seconds] Frame Number: 14 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbe8 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x7bcd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 8C7E6444F632DDD3 Responder cookie: 23B5A8A34B18724B Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xeb576c9d Length: 60 Encrypted payload (32 bytes) 0000 00 17 c5 6d 9d fd 00 0c 29 96 68 b2 08 00 45 00 ...m....).h...E. 0010 00 58 00 00 40 00 40 11 fb e8 a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 68 01 f4 01 f4 00 44 7b cd 8c 7e 64 44 f6 32 .h.....D{..~dD.2 0030 dd d3 23 b5 a8 a3 4b 18 72 4b 08 10 20 01 eb 57 ..#...K.rK.. ..W 0040 6c 9d 00 00 00 3c 5c 30 e5 f0 78 8e fc da 44 4f l....<\0..x...DO 0050 cc f7 50 3b 21 79 60 cb 65 d1 ed 8f 5c ab 10 dd ..P;!y`.e...\... 0060 eb 90 e8 6f 41 ff ...oA. Frame 15 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 19, 2010 13:53:53.250704000 [Time delta from previous captured frame: 0.291767000 seconds] [Time delta from previous displayed frame: 0.291767000 seconds] [Time since reference or first frame: 0.439496000 seconds] Frame Number: 15 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0007 (7) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8ba0 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.104 (165.227.249.104) Encapsulating Security Payload ESP SPI: 0x7e36dc81 ESP Sequence: 1 0000 00 17 c5 6d 9d fd 00 0c 29 96 68 b2 08 00 45 00 ...m....).h...E. 0010 00 78 00 07 00 00 f0 32 8b a0 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 68 7e 36 dc 81 00 00 00 01 64 7d 1b 90 06 68 .h~6......d}...h 0030 e6 d7 20 c5 b0 60 f2 a1 42 4a 34 39 07 59 44 e9 .. ..`..BJ49.YD. 0040 09 7a d0 82 57 28 15 5b e2 c8 c3 8c 8e e7 86 4e .z..W(.[.......N 0050 aa d5 89 b1 87 8c 91 ea 3e 0e 11 ac 48 f0 57 bc ........>...H.W. 0060 6d e3 f2 f2 c2 99 3a d2 1f 64 69 8b 50 d4 36 e4 m.....:..di.P.6. 0070 c6 47 5f d1 9e 1f 98 d7 91 89 0a 83 d4 76 e2 0d .G_..........v.. 0080 f7 23 10 47 ba 83 .#.G.. Frame 16 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 19, 2010 13:53:53.250722000 [Time delta from previous captured frame: 0.000018000 seconds] [Time delta from previous displayed frame: 0.000018000 seconds] [Time since reference or first frame: 0.439514000 seconds] Frame Number: 16 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0007 (7) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8ba0 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.104 (165.227.249.104) Encapsulating Security Payload ESP SPI: 0x7e36dc81 ESP Sequence: 1 0000 00 17 c5 6d 9d fd 00 0c 29 96 68 b2 08 00 45 00 ...m....).h...E. 0010 00 78 00 07 00 00 f0 32 8b a0 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 68 7e 36 dc 81 00 00 00 01 64 7d 1b 90 06 68 .h~6......d}...h 0030 e6 d7 20 c5 b0 60 f2 a1 42 4a 34 39 07 59 44 e9 .. ..`..BJ49.YD. 0040 09 7a d0 82 57 28 15 5b e2 c8 c3 8c 8e e7 86 4e .z..W(.[.......N 0050 aa d5 89 b1 87 8c 91 ea 3e 0e 11 ac 48 f0 57 bc ........>...H.W. 0060 6d e3 f2 f2 c2 99 3a d2 1f 64 69 8b 50 d4 36 e4 m.....:..di.P.6. 0070 c6 47 5f d1 9e 1f 98 d7 91 89 0a 83 d4 76 e2 0d .G_..........v.. 0080 f7 23 10 47 ba 83 .#.G.. Frame 17 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 19, 2010 13:53:53.253838000 [Time delta from previous captured frame: 0.003116000 seconds] [Time delta from previous displayed frame: 0.003116000 seconds] [Time since reference or first frame: 0.442630000 seconds] Frame Number: 17 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.104 (165.227.249.104), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0204 (516) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x39a4 [correct] [Good: True] [Bad : False] Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0x51707b2a ESP Sequence: 1 0000 00 0c 29 96 68 b2 00 17 c5 6d 9d fd 08 00 45 00 ..).h....m....E. 0010 00 78 02 04 00 00 40 32 39 a4 a5 e3 f9 68 a5 e3 .x....@29....h.. 0020 f9 7c 51 70 7b 2a 00 00 00 01 fd 86 03 ff f1 a4 .|Qp{*.......... 0030 f1 a2 75 76 77 61 62 63 64 65 72 d0 08 e1 ac cf ..uvwabcder..... 0040 c3 68 12 2c 30 a9 30 3d 27 34 83 ff b5 2c cb 36 .h.,0.0='4...,.6 0050 25 de 58 98 59 70 cb cd 6d 4b ff 63 5f 96 e7 a1 %.X.Yp..mK.c_... 0060 1f 14 93 48 f0 0d 57 56 1b 6e 1e 8d 8e 00 2c 66 ...H..WV.n....,f 0070 ca d3 82 8d bd 76 ce f3 4a fb 2e 5d c7 22 fe d6 .....v..J..].".. 0080 2e 88 58 f6 59 05 ..X.Y. Frame 18 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 19, 2010 13:53:53.821750000 [Time delta from previous captured frame: 0.567912000 seconds] [Time delta from previous displayed frame: 0.567912000 seconds] [Time since reference or first frame: 1.010542000 seconds] Frame Number: 18 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0008 (8) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b9f [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.104 (165.227.249.104) Encapsulating Security Payload ESP SPI: 0x7e36dc81 ESP Sequence: 2 0000 00 17 c5 6d 9d fd 00 0c 29 96 68 b2 08 00 45 00 ...m....).h...E. 0010 00 78 00 08 00 00 f0 32 8b 9f a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 68 7e 36 dc 81 00 00 00 02 63 2c 42 95 b7 64 .h~6......c,B..d 0030 8d b0 59 83 af 42 cc 60 15 65 f5 55 b5 a7 ee 28 ..Y..B.`.e.U...( 0040 e1 f6 fd 56 94 89 93 ad a5 16 e6 2e 74 f5 36 34 ...V........t.64 0050 34 0c 32 92 ec 8b d7 ba 52 03 21 d8 42 f8 e9 c2 4.2.....R.!.B... 0060 59 fb 70 e4 2d a4 70 28 9a 37 78 c8 4d e7 8b 55 Y.p.-.p(.7x.M..U 0070 1a 9b b1 42 c0 9f fe c1 23 31 5d d6 19 65 fc b6 ...B....#1]..e.. 0080 c7 fe 7a ea 50 b1 ..z.P. Frame 19 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 19, 2010 13:53:53.821761000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 1.010553000 seconds] Frame Number: 19 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Destination: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0008 (8) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b9f [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.104 (165.227.249.104) Encapsulating Security Payload ESP SPI: 0x7e36dc81 ESP Sequence: 2 0000 00 17 c5 6d 9d fd 00 0c 29 96 68 b2 08 00 45 00 ...m....).h...E. 0010 00 78 00 08 00 00 f0 32 8b 9f a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 68 7e 36 dc 81 00 00 00 02 63 2c 42 95 b7 64 .h~6......c,B..d 0030 8d b0 59 83 af 42 cc 60 15 65 f5 55 b5 a7 ee 28 ..Y..B.`.e.U...( 0040 e1 f6 fd 56 94 89 93 ad a5 16 e6 2e 74 f5 36 34 ...V........t.64 0050 34 0c 32 92 ec 8b d7 ba 52 03 21 d8 42 f8 e9 c2 4.2.....R.!.B... 0060 59 fb 70 e4 2d a4 70 28 9a 37 78 c8 4d e7 8b 55 Y.p.-.p(.7x.M..U 0070 1a 9b b1 42 c0 9f fe c1 23 31 5d d6 19 65 fc b6 ...B....#1]..e.. 0080 c7 fe 7a ea 50 b1 ..z.P. Frame 20 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 19, 2010 13:53:53.824202000 [Time delta from previous captured frame: 0.002441000 seconds] [Time delta from previous displayed frame: 0.002441000 seconds] [Time since reference or first frame: 1.012994000 seconds] Frame Number: 20 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) Address: 00:17:c5:6d:9d:fd (00:17:c5:6d:9d:fd) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.104 (165.227.249.104), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0204 (516) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x39a4 [correct] [Good: True] [Bad : False] Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0x51707b2a ESP Sequence: 2 0000 00 0c 29 96 68 b2 00 17 c5 6d 9d fd 08 00 45 00 ..).h....m....E. 0010 00 78 02 04 00 00 40 32 39 a4 a5 e3 f9 68 a5 e3 .x....@29....h.. 0020 f9 7c 51 70 7b 2a 00 00 00 02 a6 f4 6a 3b 84 d2 .|Qp{*......j;.. 0030 ad e4 75 76 77 61 62 63 64 65 6d df de 57 98 77 ..uvwabcdem..W.w 0040 a5 30 63 57 ee 0e cc 71 8a b1 c9 ea 6c f0 22 89 .0cW...q....l.". 0050 f3 64 34 b6 cc c9 80 5a f6 76 e3 e0 51 a0 ee 03 .d4....Z.v..Q... 0060 0b 65 c2 ca c2 9c 4d 82 53 69 c5 01 ce f5 9e 0d .e....M.Si...... 0070 cf fa 0e 25 d3 a0 b0 d8 13 0e b1 fe f6 4f f7 d9 ...%.........O.. 0080 c4 ff 27 40 0f ba ..'@..