Frame 1 (326 bytes on wire, 326 bytes captured) Arrival Time: Aug 27, 2009 11:56:05.442525000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb05 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x143b [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 267BB70E733FAEE5 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0x267BB70E733FAEE5 Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00403 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00403 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 1e 2a d4 70 69 00 0c 29 48 f8 2f 08 00 45 00 ..*.pi..)H./..E. 0010 01 38 00 00 40 00 40 11 fb 05 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 6b 01 f4 01 f4 01 24 14 3b 26 7b b7 0e 73 3f .k.....$.;&{..s? 0030 ae e5 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 26 7b b7 0e 73 3f .....|....&{..s? 0060 ae e5 03 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 04 03 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 2 (326 bytes on wire, 326 bytes captured) Arrival Time: Aug 27, 2009 11:56:05.442534000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 0.000009000 seconds] Frame Number: 2 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb05 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x143b [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 267BB70E733FAEE5 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0x267BB70E733FAEE5 Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00403 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00403 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 1e 2a d4 70 69 00 0c 29 48 f8 2f 08 00 45 00 ..*.pi..)H./..E. 0010 01 38 00 00 40 00 40 11 fb 05 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 6b 01 f4 01 f4 01 24 14 3b 26 7b b7 0e 73 3f .k.....$.;&{..s? 0030 ae e5 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 26 7b b7 0e 73 3f .....|....&{..s? 0060 ae e5 03 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 04 03 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 3 (174 bytes on wire, 174 bytes captured) Arrival Time: Aug 27, 2009 11:56:05.490988000 [Time delta from previous captured frame: 0.048454000 seconds] [Time delta from previous displayed frame: 0.048454000 seconds] [Time since reference or first frame: 0.048463000 seconds] Frame Number: 3 Frame Length: 174 bytes Capture Length: 174 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 160 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb9d [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 140 Checksum: 0xe628 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 267BB70E733FAEE5 Responder cookie: CE82CD8F0F2E8A62 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 132 Security Association payload Next payload: Vendor ID (13) Payload length: 64 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 52 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 1 SPI: 0x0000000000000000 Transform payload # 0 Next payload: NONE (0) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 48 f8 2f 00 1e 2a d4 70 69 08 00 45 00 ..)H./..*.pi..E. 0010 00 a0 00 00 40 00 40 11 fb 9d a5 e3 f9 6b a5 e3 ....@.@......k.. 0020 f9 7c 01 f4 01 f4 00 8c e6 28 26 7b b7 0e 73 3f .|.......(&{..s? 0030 ae e5 ce 82 cd 8f 0f 2e 8a 62 01 10 02 00 00 00 .........b...... 0040 00 00 00 00 00 84 0d 00 00 40 00 00 00 01 00 00 .........@...... 0050 00 01 00 00 00 34 00 01 08 01 00 00 00 00 00 00 .....4.......... 0060 00 00 00 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 0d 00 00 14 3b 90 31 dc e4 fc ....p.....;.1... 0090 f8 8b 48 9a 92 39 63 dd 0c 49 00 00 00 14 70 03 ..H..9c..I....p. 00a0 cb c1 09 7d be 9c 26 00 ba 69 83 bc 8b 35 ...}..&..i...5 Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 27, 2009 11:56:05.495388000 [Time delta from previous captured frame: 0.004400000 seconds] [Time delta from previous displayed frame: 0.004400000 seconds] [Time since reference or first frame: 0.052863000 seconds] Frame Number: 4 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb6d [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x3bbe [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 267BB70E733FAEE5 Responder cookie: CE82CD8F0F2E8A62 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 1e 2a d4 70 69 00 0c 29 48 f8 2f 08 00 45 00 ..*.pi..)H./..E. 0010 00 d0 00 00 40 00 40 11 fb 6d a5 e3 f9 7c a5 e3 ....@.@..m...|.. 0020 f9 6b 01 f4 01 f4 00 bc 3b be 26 7b b7 0e 73 3f .k......;.&{..s? 0030 ae e5 ce 82 cd 8f 0f 2e 8a 62 04 10 02 00 00 00 .........b...... 0040 00 00 00 00 00 b4 0a 00 00 84 07 2e 4f 4f 8a 88 ............OO.. 0050 7b 21 67 19 cb 72 4b 03 c7 89 b7 7f 92 17 d3 c5 {!g..rK......... 0060 3c 9f 03 93 a4 d1 c9 77 7b 45 c2 9d c9 e0 e8 f4 <......w{E...... 0070 f0 08 6c f9 d8 9b 9a a7 1a 8b f9 f7 53 c4 15 98 ..l.........S... 0080 96 a8 74 a1 4e f8 d2 1f 34 76 34 1b d5 98 19 d2 ..t.N...4v4..... 0090 b8 59 95 a9 9d 34 70 57 96 77 91 25 76 a0 bf 86 .Y...4pW.w.%v... 00a0 05 86 2d 88 6e 86 89 2f e3 93 d1 ae f6 6b a9 ed ..-.n../.....k.. 00b0 59 af 55 e2 ca 77 a1 b6 b9 31 1c 3a 09 22 4a 27 Y.U..w...1.:."J' 00c0 39 4a 6b 06 26 21 38 3f b6 12 00 00 00 14 af b4 9Jk.&!8?........ 00d0 46 31 6d f9 d5 8c 75 23 2b 47 11 e0 e6 77 F1m...u#+G...w Frame 5 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 27, 2009 11:56:05.495402000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 0.052877000 seconds] Frame Number: 5 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb6d [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x3bbe [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 267BB70E733FAEE5 Responder cookie: CE82CD8F0F2E8A62 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 1e 2a d4 70 69 00 0c 29 48 f8 2f 08 00 45 00 ..*.pi..)H./..E. 0010 00 d0 00 00 40 00 40 11 fb 6d a5 e3 f9 7c a5 e3 ....@.@..m...|.. 0020 f9 6b 01 f4 01 f4 00 bc 3b be 26 7b b7 0e 73 3f .k......;.&{..s? 0030 ae e5 ce 82 cd 8f 0f 2e 8a 62 04 10 02 00 00 00 .........b...... 0040 00 00 00 00 00 b4 0a 00 00 84 07 2e 4f 4f 8a 88 ............OO.. 0050 7b 21 67 19 cb 72 4b 03 c7 89 b7 7f 92 17 d3 c5 {!g..rK......... 0060 3c 9f 03 93 a4 d1 c9 77 7b 45 c2 9d c9 e0 e8 f4 <......w{E...... 0070 f0 08 6c f9 d8 9b 9a a7 1a 8b f9 f7 53 c4 15 98 ..l.........S... 0080 96 a8 74 a1 4e f8 d2 1f 34 76 34 1b d5 98 19 d2 ..t.N...4v4..... 0090 b8 59 95 a9 9d 34 70 57 96 77 91 25 76 a0 bf 86 .Y...4pW.w.%v... 00a0 05 86 2d 88 6e 86 89 2f e3 93 d1 ae f6 6b a9 ed ..-.n../.....k.. 00b0 59 af 55 e2 ca 77 a1 b6 b9 31 1c 3a 09 22 4a 27 Y.U..w...1.:."J' 00c0 39 4a 6b 06 26 21 38 3f b6 12 00 00 00 14 af b4 9Jk.&!8?........ 00d0 46 31 6d f9 d5 8c 75 23 2b 47 11 e0 e6 77 F1m...u#+G...w Frame 6 (242 bytes on wire, 242 bytes captured) Arrival Time: Aug 27, 2009 11:56:05.587166000 [Time delta from previous captured frame: 0.091764000 seconds] [Time delta from previous displayed frame: 0.091764000 seconds] [Time since reference or first frame: 0.144641000 seconds] Frame Number: 6 Frame Length: 242 bytes Capture Length: 242 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb59 [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0xd155 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 267BB70E733FAEE5 Responder cookie: CE82CD8F0F2E8A62 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 20 Nonce Data Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 48 f8 2f 00 1e 2a d4 70 69 08 00 45 00 ..)H./..*.pi..E. 0010 00 e4 00 00 40 00 40 11 fb 59 a5 e3 f9 6b a5 e3 ....@.@..Y...k.. 0020 f9 7c 01 f4 01 f4 00 d0 d1 55 26 7b b7 0e 73 3f .|.......U&{..s? 0030 ae e5 ce 82 cd 8f 0f 2e 8a 62 04 10 02 00 00 00 .........b...... 0040 00 00 00 00 00 c8 0a 00 00 84 3e ff 61 7d 46 b7 ..........>.a}F. 0050 20 c4 d4 33 26 30 69 79 17 81 08 9c 29 25 a7 03 ..3&0iy....)%.. 0060 1c 99 77 07 c3 58 5b 24 93 0a 4a 76 c8 ca 24 66 ..w..X[$..Jv..$f 0070 31 9f f3 fd 53 39 25 1d 1e f4 c3 f1 8a 07 94 f5 1...S9%......... 0080 0c 25 4d 34 72 d1 a2 16 10 c3 64 d3 ba 6b cb 94 .%M4r.....d..k.. 0090 54 d5 58 46 4e 8c d5 08 c3 88 00 0e ab fe 7b ae T.XFN.........{. 00a0 d4 d4 e0 8b 1c 8c 3b 25 9f 4c 44 c0 dc 08 34 47 ......;%.LD...4G 00b0 c6 71 9c d9 0b f0 f2 e2 ab 5f f4 67 51 f5 59 df .q......._.gQ.Y. 00c0 02 c4 d4 db da 7c 93 71 d2 9a 0d 00 00 14 8c 9b .....|.q........ 00d0 36 6e b6 e2 da 44 79 2e 9d a1 cf df 02 8d 00 00 6n...Dy......... 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 27, 2009 11:56:05.591707000 [Time delta from previous captured frame: 0.004541000 seconds] [Time delta from previous displayed frame: 0.004541000 seconds] [Time since reference or first frame: 0.149182000 seconds] Frame Number: 7 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc5 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xfd12 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 267BB70E733FAEE5 Responder cookie: CE82CD8F0F2E8A62 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 1e 2a d4 70 69 00 0c 29 48 f8 2f 08 00 45 00 ..*.pi..)H./..E. 0010 00 78 00 00 40 00 40 11 fb c5 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 6b 01 f4 01 f4 00 64 fd 12 26 7b b7 0e 73 3f .k.....d..&{..s? 0030 ae e5 ce 82 cd 8f 0f 2e 8a 62 05 10 02 01 00 00 .........b...... 0040 00 00 00 00 00 5c b5 14 d9 5e 17 aa 35 26 95 f7 .....\...^..5&.. 0050 a5 5e cd 07 7b b2 c1 6a f3 cf 35 b5 71 b1 40 f5 .^..{..j..5.q.@. 0060 93 3c c2 ff b9 86 f1 24 fc fa 13 46 1d 7f dc c5 .<.....$...F.... 0070 d0 f1 89 69 87 b0 7d ba 42 f9 34 b0 dd 00 03 58 ...i..}.B.4....X 0080 69 eb f7 02 61 ac i...a. Frame 8 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 27, 2009 11:56:05.591719000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 0.149194000 seconds] Frame Number: 8 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc5 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xfd12 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 267BB70E733FAEE5 Responder cookie: CE82CD8F0F2E8A62 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 1e 2a d4 70 69 00 0c 29 48 f8 2f 08 00 45 00 ..*.pi..)H./..E. 0010 00 78 00 00 40 00 40 11 fb c5 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 6b 01 f4 01 f4 00 64 fd 12 26 7b b7 0e 73 3f .k.....d..&{..s? 0030 ae e5 ce 82 cd 8f 0f 2e 8a 62 05 10 02 01 00 00 .........b...... 0040 00 00 00 00 00 5c b5 14 d9 5e 17 aa 35 26 95 f7 .....\...^..5&.. 0050 a5 5e cd 07 7b b2 c1 6a f3 cf 35 b5 71 b1 40 f5 .^..{..j..5.q.@. 0060 93 3c c2 ff b9 86 f1 24 fc fa 13 46 1d 7f dc c5 .<.....$...F.... 0070 d0 f1 89 69 87 b0 7d ba 42 f9 34 b0 dd 00 03 58 ...i..}.B.4....X 0080 69 eb f7 02 61 ac i...a. Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: Aug 27, 2009 11:56:05.714600000 [Time delta from previous captured frame: 0.122881000 seconds] [Time delta from previous displayed frame: 0.122881000 seconds] [Time since reference or first frame: 0.272075000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbd5 [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x4ac4 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 267BB70E733FAEE5 Responder cookie: CE82CD8F0F2E8A62 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 48 f8 2f 00 1e 2a d4 70 69 08 00 45 00 ..)H./..*.pi..E. 0010 00 68 00 00 40 00 40 11 fb d5 a5 e3 f9 6b a5 e3 .h..@.@......k.. 0020 f9 7c 01 f4 01 f4 00 54 4a c4 26 7b b7 0e 73 3f .|.....TJ.&{..s? 0030 ae e5 ce 82 cd 8f 0f 2e 8a 62 05 10 02 01 00 00 .........b...... 0040 00 00 00 00 00 4c 67 38 50 40 e3 55 17 0b 8f 77 .....Lg8P@.U...w 0050 04 17 cd 35 9f aa 62 44 f4 0a 99 3c 2e 65 51 d9 ...5..bD...<.eQ. 0060 e2 76 ab dc 54 bf 3d 61 cf da c9 a3 1e 18 51 d4 .v..T.=a......Q. 0070 9a 5c 9f 0a af e1 .\.... Frame 10 (406 bytes on wire, 406 bytes captured) Arrival Time: Aug 27, 2009 11:56:05.724821000 [Time delta from previous captured frame: 0.010221000 seconds] [Time delta from previous displayed frame: 0.010221000 seconds] [Time since reference or first frame: 0.282296000 seconds] Frame Number: 10 Frame Length: 406 bytes Capture Length: 406 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 392 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfab5 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 372 Checksum: 0xd384 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 267BB70E733FAEE5 Responder cookie: CE82CD8F0F2E8A62 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xa452a288 Length: 364 Encrypted payload (336 bytes) 0000 00 1e 2a d4 70 69 00 0c 29 48 f8 2f 08 00 45 00 ..*.pi..)H./..E. 0010 01 88 00 00 40 00 40 11 fa b5 a5 e3 f9 7c a5 e3 ....@.@......|.. 0020 f9 6b 01 f4 01 f4 01 74 d3 84 26 7b b7 0e 73 3f .k.....t..&{..s? 0030 ae e5 ce 82 cd 8f 0f 2e 8a 62 08 10 20 01 a4 52 .........b.. ..R 0040 a2 88 00 00 01 6c d1 2e ae 56 c6 ac 4c c4 09 0d .....l...V..L... 0050 50 fa 06 8d 72 f8 a0 5c 39 9b 8c f0 fe d8 74 39 P...r..\9.....t9 0060 68 ec 30 05 53 dc 99 a9 f4 8d 57 86 58 ca 6a 2f h.0.S.....W.X.j/ 0070 f5 15 59 0f cc 85 6c be 25 e2 fb af 77 02 32 03 ..Y...l.%...w.2. 0080 16 a9 54 73 c8 ee 08 78 fc 06 3d 33 61 d3 66 c5 ..Ts...x..=3a.f. 0090 43 35 54 b5 be ec 80 15 32 a7 f9 f5 5a 49 0b 69 C5T.....2...ZI.i 00a0 14 17 94 4d cf 49 21 62 47 54 1c 00 29 8c fa 66 ...M.I!bGT..)..f 00b0 e7 5b dd bf ed aa c6 80 41 e5 c8 68 db 84 62 8c .[......A..h..b. 00c0 7b f4 6c a9 00 86 41 1b 34 d6 c3 1b ce 4e 87 e4 {.l...A.4....N.. 00d0 ea bb 3a fb 68 41 3d 36 b3 c4 60 22 c8 95 1e 2f ..:.hA=6..`".../ 00e0 f6 70 a2 ae 1c 43 84 00 da 3f ce c5 f2 3a 79 43 .p...C...?...:yC 00f0 99 24 31 1c cc 70 90 81 e9 1e af e6 01 12 1a 9c .$1..p.......... 0100 e3 6b 63 d6 51 d4 78 4a 1f a3 50 4e 9f bf ff f2 .kc.Q.xJ..PN.... 0110 38 96 91 a0 b1 df 83 fd 88 c6 18 1a 33 03 09 56 8...........3..V 0120 58 da 93 e7 db 6a 44 d9 28 6c 8e e2 bb 83 ce 59 X....jD.(l.....Y 0130 df 59 5b 74 8b b3 79 23 ee 15 16 d8 82 c0 ba 6d .Y[t..y#.......m 0140 d6 f2 5a 0e 6d b8 80 01 0e e9 c2 a6 4d ca db e6 ..Z.m.......M... 0150 c0 bd 8d d8 9c 78 46 39 b9 00 81 ff 1a f2 dd ec .....xF9........ 0160 e0 48 f8 f5 b5 49 04 18 7e 03 5c 0d ae 2b e6 4c .H...I..~.\..+.L 0170 4f 2f 14 a2 25 2e 32 1f e4 1f 49 49 2d d1 e4 26 O/..%.2...II-..& 0180 45 cb 7c 53 ad d6 02 b7 f7 8d d7 5f fd e7 11 8f E.|S......._.... 0190 0c fa 94 82 eb f8 ...... Frame 11 (406 bytes on wire, 406 bytes captured) Arrival Time: Aug 27, 2009 11:56:05.724833000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 0.282308000 seconds] Frame Number: 11 Frame Length: 406 bytes Capture Length: 406 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 392 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfab5 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 372 Checksum: 0xd384 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 267BB70E733FAEE5 Responder cookie: CE82CD8F0F2E8A62 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xa452a288 Length: 364 Encrypted payload (336 bytes) 0000 00 1e 2a d4 70 69 00 0c 29 48 f8 2f 08 00 45 00 ..*.pi..)H./..E. 0010 01 88 00 00 40 00 40 11 fa b5 a5 e3 f9 7c a5 e3 ....@.@......|.. 0020 f9 6b 01 f4 01 f4 01 74 d3 84 26 7b b7 0e 73 3f .k.....t..&{..s? 0030 ae e5 ce 82 cd 8f 0f 2e 8a 62 08 10 20 01 a4 52 .........b.. ..R 0040 a2 88 00 00 01 6c d1 2e ae 56 c6 ac 4c c4 09 0d .....l...V..L... 0050 50 fa 06 8d 72 f8 a0 5c 39 9b 8c f0 fe d8 74 39 P...r..\9.....t9 0060 68 ec 30 05 53 dc 99 a9 f4 8d 57 86 58 ca 6a 2f h.0.S.....W.X.j/ 0070 f5 15 59 0f cc 85 6c be 25 e2 fb af 77 02 32 03 ..Y...l.%...w.2. 0080 16 a9 54 73 c8 ee 08 78 fc 06 3d 33 61 d3 66 c5 ..Ts...x..=3a.f. 0090 43 35 54 b5 be ec 80 15 32 a7 f9 f5 5a 49 0b 69 C5T.....2...ZI.i 00a0 14 17 94 4d cf 49 21 62 47 54 1c 00 29 8c fa 66 ...M.I!bGT..)..f 00b0 e7 5b dd bf ed aa c6 80 41 e5 c8 68 db 84 62 8c .[......A..h..b. 00c0 7b f4 6c a9 00 86 41 1b 34 d6 c3 1b ce 4e 87 e4 {.l...A.4....N.. 00d0 ea bb 3a fb 68 41 3d 36 b3 c4 60 22 c8 95 1e 2f ..:.hA=6..`".../ 00e0 f6 70 a2 ae 1c 43 84 00 da 3f ce c5 f2 3a 79 43 .p...C...?...:yC 00f0 99 24 31 1c cc 70 90 81 e9 1e af e6 01 12 1a 9c .$1..p.......... 0100 e3 6b 63 d6 51 d4 78 4a 1f a3 50 4e 9f bf ff f2 .kc.Q.xJ..PN.... 0110 38 96 91 a0 b1 df 83 fd 88 c6 18 1a 33 03 09 56 8...........3..V 0120 58 da 93 e7 db 6a 44 d9 28 6c 8e e2 bb 83 ce 59 X....jD.(l.....Y 0130 df 59 5b 74 8b b3 79 23 ee 15 16 d8 82 c0 ba 6d .Y[t..y#.......m 0140 d6 f2 5a 0e 6d b8 80 01 0e e9 c2 a6 4d ca db e6 ..Z.m.......M... 0150 c0 bd 8d d8 9c 78 46 39 b9 00 81 ff 1a f2 dd ec .....xF9........ 0160 e0 48 f8 f5 b5 49 04 18 7e 03 5c 0d ae 2b e6 4c .H...I..~.\..+.L 0170 4f 2f 14 a2 25 2e 32 1f e4 1f 49 49 2d d1 e4 26 O/..%.2...II-..& 0180 45 cb 7c 53 ad d6 02 b7 f7 8d d7 5f fd e7 11 8f E.|S......._.... 0190 0c fa 94 82 eb f8 ...... Frame 12 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 27, 2009 11:56:05.725817000 [Time delta from previous captured frame: 0.000984000 seconds] [Time delta from previous displayed frame: 0.000984000 seconds] [Time since reference or first frame: 0.283292000 seconds] Frame Number: 12 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc5 [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xcd70 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 267BB70E733FAEE5 Responder cookie: CE82CD8F0F2E8A62 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xc371a66d Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 48 f8 2f 00 1e 2a d4 70 69 08 00 45 00 ..)H./..*.pi..E. 0010 00 78 00 00 40 00 40 11 fb c5 a5 e3 f9 6b a5 e3 .x..@.@......k.. 0020 f9 7c 01 f4 01 f4 00 64 cd 70 26 7b b7 0e 73 3f .|.....d.p&{..s? 0030 ae e5 ce 82 cd 8f 0f 2e 8a 62 08 10 05 01 c3 71 .........b.....q 0040 a6 6d 00 00 00 5c ab 3a 23 1b bc 7a 24 ea 41 25 .m...\.:#..z$.A% 0050 92 a1 af 2b 3a 2f a1 aa 94 f1 b1 95 e0 ab 45 04 ...+:/........E. 0060 24 cf 2d 8a 3e ea f5 3f 39 be 4e f4 16 8f 8e 0e $.-.>..?9.N..... 0070 da 0e 8f ad 2f 6f 15 31 ef df 4e a6 0b 87 76 de ..../o.1..N...v. 0080 f1 9f 06 b7 ac 4d .....M Frame 13 (342 bytes on wire, 342 bytes captured) Arrival Time: Aug 27, 2009 11:56:05.899794000 [Time delta from previous captured frame: 0.173977000 seconds] [Time delta from previous displayed frame: 0.173977000 seconds] [Time since reference or first frame: 0.457269000 seconds] Frame Number: 13 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaf5 [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xefb1 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 267BB70E733FAEE5 Responder cookie: CE82CD8F0F2E8A62 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xa452a288 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 48 f8 2f 00 1e 2a d4 70 69 08 00 45 00 ..)H./..*.pi..E. 0010 01 48 00 00 40 00 40 11 fa f5 a5 e3 f9 6b a5 e3 .H..@.@......k.. 0020 f9 7c 01 f4 01 f4 01 34 ef b1 26 7b b7 0e 73 3f .|.....4..&{..s? 0030 ae e5 ce 82 cd 8f 0f 2e 8a 62 08 10 20 01 a4 52 .........b.. ..R 0040 a2 88 00 00 01 2c d3 cc 84 98 5e 59 f9 29 c0 04 .....,....^Y.).. 0050 a6 57 eb f0 24 3d 63 45 91 2f 1d 3c f9 13 33 7d .W..$=cE./.<..3} 0060 89 5f d2 25 72 69 f7 29 1b e8 17 33 e5 7e ed 38 ._.%ri.)...3.~.8 0070 2f ec d2 d6 90 9c 70 77 e1 f3 ab 4e 9e 1f 92 08 /.....pw...N.... 0080 89 00 25 af 8f 9e 65 74 0f 17 ef b6 0f b8 3a 60 ..%...et......:` 0090 e4 59 59 9d 1e 90 6d 7c 77 fc e0 b9 f7 43 e0 2c .YY...m|w....C., 00a0 5e 5a d8 d8 49 e4 d7 b6 78 76 b1 86 3f ff 08 88 ^Z..I...xv..?... 00b0 60 5b e5 11 72 d2 7f b6 5b ef 41 6c 60 91 55 20 `[..r...[.Al`.U 00c0 37 19 a3 2d c5 e5 35 10 6f ff ba 9a c0 fb d4 7d 7..-..5.o......} 00d0 1e 81 49 f3 c3 a5 a8 aa 3a 29 f7 24 81 98 08 36 ..I.....:).$...6 00e0 d8 4b ae ad ab e5 b0 46 42 a2 6b 5d b5 9d f9 61 .K.....FB.k]...a 00f0 fe 31 a7 bb 49 02 6e ed 3a 47 ca 00 4d 77 21 1a .1..I.n.:G..Mw!. 0100 39 a4 4d 94 98 37 27 f5 51 88 c9 1d 21 5a 36 ae 9.M..7'.Q...!Z6. 0110 77 02 fa e8 1e 2a 79 b7 a5 b6 20 40 bf 9e 8c c9 w....*y... @.... 0120 63 35 35 0b bc 01 48 6e 9e ba 6a 5f 4e 9e 82 f2 c55...Hn..j_N... 0130 73 53 b3 df 42 21 a5 7a 58 fa a9 0c 3d d3 31 71 sS..B!.zX...=.1q 0140 50 c8 d5 4f 57 37 7d b3 24 c8 d6 59 95 03 45 76 P..OW7}.$..Y..Ev 0150 9d 11 03 4d 83 03 ...M.. Frame 14 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 27, 2009 11:56:05.904260000 [Time delta from previous captured frame: 0.004466000 seconds] [Time delta from previous displayed frame: 0.004466000 seconds] [Time since reference or first frame: 0.461735000 seconds] Frame Number: 14 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbe5 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xab55 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 267BB70E733FAEE5 Responder cookie: CE82CD8F0F2E8A62 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xa452a288 Length: 60 Encrypted payload (32 bytes) 0000 00 1e 2a d4 70 69 00 0c 29 48 f8 2f 08 00 45 00 ..*.pi..)H./..E. 0010 00 58 00 00 40 00 40 11 fb e5 a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 6b 01 f4 01 f4 00 44 ab 55 26 7b b7 0e 73 3f .k.....D.U&{..s? 0030 ae e5 ce 82 cd 8f 0f 2e 8a 62 08 10 20 01 a4 52 .........b.. ..R 0040 a2 88 00 00 00 3c d9 60 61 c0 ad 1a f7 66 47 d2 .....<.`a....fG. 0050 96 36 7a 37 6a 7e 32 25 53 12 dd ce 5e 8a f2 11 .6z7j~2%S...^... 0060 48 eb 44 76 89 98 H.Dv.. Frame 15 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 27, 2009 11:56:05.904272000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 0.461747000 seconds] Frame Number: 15 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbe5 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xab55 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 267BB70E733FAEE5 Responder cookie: CE82CD8F0F2E8A62 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xa452a288 Length: 60 Encrypted payload (32 bytes) 0000 00 1e 2a d4 70 69 00 0c 29 48 f8 2f 08 00 45 00 ..*.pi..)H./..E. 0010 00 58 00 00 40 00 40 11 fb e5 a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 6b 01 f4 01 f4 00 44 ab 55 26 7b b7 0e 73 3f .k.....D.U&{..s? 0030 ae e5 ce 82 cd 8f 0f 2e 8a 62 08 10 20 01 a4 52 .........b.. ..R 0040 a2 88 00 00 00 3c d9 60 61 c0 ad 1a f7 66 47 d2 .....<.`a....fG. 0050 96 36 7a 37 6a 7e 32 25 53 12 dd ce 5e 8a f2 11 .6z7j~2%S...^... 0060 48 eb 44 76 89 98 H.Dv.. Frame 16 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 27, 2009 11:56:06.166706000 [Time delta from previous captured frame: 0.262434000 seconds] [Time delta from previous displayed frame: 0.262434000 seconds] [Time since reference or first frame: 0.724181000 seconds] Frame Number: 16 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0004 (4) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8ba0 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.107 (165.227.249.107) Encapsulating Security Payload ESP SPI: 0x0541e557 ESP Sequence: 1 0000 00 1e 2a d4 70 69 00 0c 29 48 f8 2f 08 00 45 00 ..*.pi..)H./..E. 0010 00 78 00 04 00 00 f0 32 8b a0 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 6b 05 41 e5 57 00 00 00 01 29 54 eb 80 a1 8d .k.A.W....)T.... 0030 e2 a0 ed b9 e9 e1 aa 71 bb 79 b9 59 a3 49 5d 65 .......q.y.Y.I]e 0040 b6 4b 26 2a cd 45 85 76 e8 8c bf 3e 54 e4 f1 81 .K&*.E.v...>T... 0050 d0 c2 de 20 60 d6 23 7f 91 bf 9f 2b 22 ef a6 01 ... `.#....+"... 0060 5e 28 f6 c6 d1 4d e1 ee 45 e5 a7 7b 31 ea 4b 95 ^(...M..E..{1.K. 0070 27 ff 62 b8 d6 5e 3f 43 90 a3 25 5a fc cd 0d 97 '.b..^?C..%Z.... 0080 97 1e 37 62 65 57 ..7beW Frame 17 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 27, 2009 11:56:06.166720000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 0.724195000 seconds] Frame Number: 17 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0004 (4) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8ba0 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.107 (165.227.249.107) Encapsulating Security Payload ESP SPI: 0x0541e557 ESP Sequence: 1 0000 00 1e 2a d4 70 69 00 0c 29 48 f8 2f 08 00 45 00 ..*.pi..)H./..E. 0010 00 78 00 04 00 00 f0 32 8b a0 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 6b 05 41 e5 57 00 00 00 01 29 54 eb 80 a1 8d .k.A.W....)T.... 0030 e2 a0 ed b9 e9 e1 aa 71 bb 79 b9 59 a3 49 5d 65 .......q.y.Y.I]e 0040 b6 4b 26 2a cd 45 85 76 e8 8c bf 3e 54 e4 f1 81 .K&*.E.v...>T... 0050 d0 c2 de 20 60 d6 23 7f 91 bf 9f 2b 22 ef a6 01 ... `.#....+"... 0060 5e 28 f6 c6 d1 4d e1 ee 45 e5 a7 7b 31 ea 4b 95 ^(...M..E..{1.K. 0070 27 ff 62 b8 d6 5e 3f 43 90 a3 25 5a fc cd 0d 97 '.b..^?C..%Z.... 0080 97 1e 37 62 65 57 ..7beW Frame 18 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 27, 2009 11:56:06.168144000 [Time delta from previous captured frame: 0.001424000 seconds] [Time delta from previous displayed frame: 0.001424000 seconds] [Time since reference or first frame: 0.725619000 seconds] Frame Number: 18 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0xda36 (55862) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x616e [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0xbb43c9ac ESP Sequence: 1 0000 00 0c 29 48 f8 2f 00 1e 2a d4 70 69 08 00 45 00 ..)H./..*.pi..E. 0010 00 78 da 36 00 00 40 32 61 6e a5 e3 f9 6b a5 e3 .x.6..@2an...k.. 0020 f9 7c bb 43 c9 ac 00 00 00 01 3d 49 3d 84 a2 8b .|.C......=I=... 0030 0b 75 e3 6b 30 fb d8 f1 90 01 c9 87 d8 09 9c 09 .u.k0........... 0040 e7 f2 35 3c 6f 65 3e 69 20 ee 59 c8 5e 22 1a 75 ..5i .Y.^".u 0050 2b 78 88 06 b4 09 38 8b 2f 94 b3 f1 9f 53 13 4c +x....8./....S.L 0060 96 30 2d 45 ae 1e b6 cc 30 a9 a0 44 14 a8 4d 5d .0-E....0..D..M] 0070 f4 fc 58 8d 1a f9 8a 1c 06 7d d1 35 07 67 0b f1 ..X......}.5.g.. 0080 0a c3 85 50 b6 57 ...P.W Frame 19 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 27, 2009 11:56:06.427058000 [Time delta from previous captured frame: 0.258914000 seconds] [Time delta from previous displayed frame: 0.258914000 seconds] [Time since reference or first frame: 0.984533000 seconds] Frame Number: 19 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0005 (5) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b9f [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.107 (165.227.249.107) Encapsulating Security Payload ESP SPI: 0x0541e557 ESP Sequence: 2 0000 00 1e 2a d4 70 69 00 0c 29 48 f8 2f 08 00 45 00 ..*.pi..)H./..E. 0010 00 78 00 05 00 00 f0 32 8b 9f a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 6b 05 41 e5 57 00 00 00 02 98 33 aa 32 6f 0f .k.A.W.....3.2o. 0030 2b cd 27 35 1f 07 27 ca eb 14 72 51 2c 11 e9 0b +.'5..'...rQ,... 0040 c0 5f 58 8d e8 a8 cf 4b c6 98 10 f2 26 f0 e4 42 ._X....K....&..B 0050 b3 ad f9 84 d3 b3 c5 c4 36 d5 d2 2b 74 a8 6c e5 ........6..+t.l. 0060 eb ed 58 84 4a 7e ae ea d4 9c dd b5 ee 23 3f 6e ..X.J~.......#?n 0070 d1 cc f1 54 17 bc ad bb 11 86 64 84 d3 15 a7 8b ...T......d..... 0080 3e c7 1a 9f df 3b >....; Frame 20 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 27, 2009 11:56:06.427071000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 0.984546000 seconds] Frame Number: 20 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Destination: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0005 (5) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b9f [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.107 (165.227.249.107) Encapsulating Security Payload ESP SPI: 0x0541e557 ESP Sequence: 2 0000 00 1e 2a d4 70 69 00 0c 29 48 f8 2f 08 00 45 00 ..*.pi..)H./..E. 0010 00 78 00 05 00 00 f0 32 8b 9f a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 6b 05 41 e5 57 00 00 00 02 98 33 aa 32 6f 0f .k.A.W.....3.2o. 0030 2b cd 27 35 1f 07 27 ca eb 14 72 51 2c 11 e9 0b +.'5..'...rQ,... 0040 c0 5f 58 8d e8 a8 cf 4b c6 98 10 f2 26 f0 e4 42 ._X....K....&..B 0050 b3 ad f9 84 d3 b3 c5 c4 36 d5 d2 2b 74 a8 6c e5 ........6..+t.l. 0060 eb ed 58 84 4a 7e ae ea d4 9c dd b5 ee 23 3f 6e ..X.J~.......#?n 0070 d1 cc f1 54 17 bc ad bb 11 86 64 84 d3 15 a7 8b ...T......d..... 0080 3e c7 1a 9f df 3b >....; Frame 21 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 27, 2009 11:56:06.428398000 [Time delta from previous captured frame: 0.001327000 seconds] [Time delta from previous displayed frame: 0.001327000 seconds] [Time since reference or first frame: 0.985873000 seconds] Frame Number: 21 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) Address: 00:1e:2a:d4:70:69 (00:1e:2a:d4:70:69) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x3250 (12880) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x0955 [correct] [Good: True] [Bad : False] Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0xbb43c9ac ESP Sequence: 2 0000 00 0c 29 48 f8 2f 00 1e 2a d4 70 69 08 00 45 00 ..)H./..*.pi..E. 0010 00 78 32 50 00 00 40 32 09 55 a5 e3 f9 6b a5 e3 .x2P..@2.U...k.. 0020 f9 7c bb 43 c9 ac 00 00 00 02 a0 44 14 a8 4d 5d .|.C.......D..M] 0030 f4 fc 58 8d 1a f9 8a 1c 06 7d 87 5a 75 45 08 ee ..X......}.ZuE.. 0040 96 4e cd ea 78 48 bc f1 6c bc 17 1d cb 1e 6c d9 .N..xH..l.....l. 0050 af 00 51 18 0c 33 f3 59 e9 d0 7f 05 e8 06 fc 3d ..Q..3.Y.......= 0060 0c 21 36 7b a9 23 62 ce 4a 77 e1 53 0c 84 a5 ac .!6{.#b.Jw.S.... 0070 37 38 14 77 0f 86 d8 d7 32 2e e1 e6 b9 64 55 e6 78.w....2....dU. 0080 da 25 8a aa 24 c7 .%..$.