Frame 1 (266 bytes on wire, 266 bytes captured) Arrival Time: Nov 12, 2007 14:36:01.233435000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 266 bytes Capture Length: 266 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16) Destination: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.111 (165.227.249.111) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0139 (313) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a05 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.111 (165.227.249.111) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 232 Checksum: 0x69ca [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE24B015BB036CBC6 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 224 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 44 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x8F9CC94E01248ECDF147594C284B213B Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-01 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 0000 00 1c f0 72 2f 16 00 0c 29 f4 af 90 08 00 45 00 ...r/...).....E. 0010 00 fc 01 39 00 00 40 11 3a 05 a5 e3 f9 7c a5 e3 ...9..@.:....|.. 0020 f9 6f 01 f4 01 f4 00 e8 69 ca e2 4b 01 5b b0 36 .o......i..K.[.6 0030 cb c6 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 e0 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 00 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 8f 9c c9 4e 01 24 8e cd f1 47 59 4c 28 4b .....N.$...GYL(K 0090 21 3b 0d 00 00 14 27 ba b5 dc 01 ea 07 60 ea 4e !;....'......`.N 00a0 31 90 ac 27 c0 d0 0d 00 00 14 61 05 c4 22 e7 68 1..'......a..".h 00b0 47 e4 3f 96 84 80 12 92 ae cd 0d 00 00 14 44 85 G.?...........D. 00c0 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 0d 00 .-.......F.y.... 00d0 00 14 cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 ...`FC5.!.|...h. 00e0 a4 48 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .H........>.in.c 00f0 81 b5 ec 42 7b 1f 00 00 00 14 7d 94 19 a6 53 10 ...B{.....}...S. 0100 ca 6f 2c 17 9d 92 15 52 9d 56 .o,....R.V Frame 2 (166 bytes on wire, 166 bytes captured) Arrival Time: Nov 12, 2007 14:36:01.255266000 Time delta from previous packet: 0.021831000 seconds Time since reference or first frame: 0.021831000 seconds Frame Number: 2 Packet Length: 166 bytes Capture Length: 166 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.111 (165.227.249.111), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x632f (25391) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x1972 [correct] Good: True Bad : False Source: 165.227.249.111 (165.227.249.111) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0xf205 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE24B015BB036CBC6 Responder cookie: 0x67DDF9360E9F1250 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 44 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x8F9CC94E01248ECDF147594C284B213B Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 f4 af 90 00 1c f0 72 2f 16 08 00 45 00 ..)......r/...E. 0010 00 98 63 2f 00 00 ff 11 19 72 a5 e3 f9 6f a5 e3 ..c/.....r...o.. 0020 f9 7c 01 f4 01 f4 00 84 f2 05 e2 4b 01 5b b0 36 .|.........K.[.6 0030 cb c6 67 dd f9 36 0e 9f 12 50 01 10 02 00 00 00 ..g..6...P...... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 00 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 8f 9c c9 4e 01 24 8e cd f1 47 59 4c 28 4b .....N.$...GYL(K 0090 21 3b 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 !;........h...k. 00a0 96 fc 77 57 01 00 ..wW.. Frame 3 (222 bytes on wire, 222 bytes captured) Arrival Time: Nov 12, 2007 14:36:01.255268000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.021833000 seconds Frame Number: 3 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16) Destination: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.111 (165.227.249.111) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x013a (314) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a30 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.111 (165.227.249.111) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xdad1 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE24B015BB036CBC6 Responder cookie: 0x67DDF9360E9F1250 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 1c f0 72 2f 16 00 0c 29 f4 af 90 08 00 45 00 ...r/...).....E. 0010 00 d0 01 3a 00 00 40 11 3a 30 a5 e3 f9 7c a5 e3 ...:..@.:0...|.. 0020 f9 6f 01 f4 01 f4 00 bc da d1 e2 4b 01 5b b0 36 .o.........K.[.6 0030 cb c6 67 dd f9 36 0e 9f 12 50 04 10 02 00 00 00 ..g..6...P...... 0040 00 00 00 00 00 b4 0a 00 00 84 a6 16 bb 13 77 62 ..............wb 0050 ce 13 06 e6 69 b0 98 d0 3a 84 7b 44 78 84 93 ae ....i...:.{Dx... 0060 86 63 40 f6 ef 96 87 ac d4 69 62 00 01 e6 a3 81 .c@......ib..... 0070 31 c5 5c 96 23 7f 08 c1 12 13 63 4f df 6e e7 ca 1.\.#.....cO.n.. 0080 5b 70 ab ab d2 5b e9 2f ff 11 a6 5d fa 16 00 a4 [p...[./...].... 0090 0c 0a eb 9f 9c ed 05 5e b9 26 81 4a 5e 62 7e 86 .......^.&.J^b~. 00a0 ec 82 4f 3f 2f 78 98 e9 11 1f 1c fd f1 fb c5 93 ..O?/x.......... 00b0 c5 17 17 b4 7d 76 cb 50 68 13 94 e7 61 42 77 af ....}v.Ph...aBw. 00c0 f2 1a db 0a 23 43 7a 94 e9 e2 00 00 00 14 5c 39 ....#Cz.......\9 00d0 5c 58 55 32 37 d7 b4 28 ed 04 f1 63 43 db \XU27..(...cC. Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Nov 12, 2007 14:36:01.473165000 Time delta from previous packet: 0.217897000 seconds Time since reference or first frame: 0.239730000 seconds Frame Number: 4 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.111 (165.227.249.111), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x64a9 (25769) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x17c0 [correct] Good: True Bad : False Source: 165.227.249.111 (165.227.249.111) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x731d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE24B015BB036CBC6 Responder cookie: 0x67DDF9360E9F1250 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 f4 af 90 00 1c f0 72 2f 16 08 00 45 00 ..)......r/...E. 0010 00 d0 64 a9 00 00 ff 11 17 c0 a5 e3 f9 6f a5 e3 ..d..........o.. 0020 f9 7c 01 f4 01 f4 00 bc 73 1d e2 4b 01 5b b0 36 .|......s..K.[.6 0030 cb c6 67 dd f9 36 0e 9f 12 50 04 10 02 00 00 00 ..g..6...P...... 0040 00 00 00 00 00 b4 0a 00 00 84 95 93 22 0a c1 07 ............"... 0050 f7 a1 74 ef f7 2e cb 91 7b ed de 60 b4 67 ad cb ..t.....{..`.g.. 0060 a4 fa 4a 87 48 f1 c3 e8 ff 94 df a6 53 17 fc 76 ..J.H.......S..v 0070 98 ef 7d 63 37 fc f3 0c 7e 95 7e 5d 4e f4 45 01 ..}c7...~.~]N.E. 0080 c4 a7 54 43 28 0b b5 0a e7 96 5d 9c a5 03 12 13 ..TC(.....]..... 0090 7a 73 bd 63 9c 7e 1b 05 bf ec 18 81 c1 23 30 93 zs.c.~.......#0. 00a0 f2 92 00 f2 62 d2 73 ca 50 cf 01 9e a5 23 1c bf ....b.s.P....#.. 00b0 55 87 e6 c3 59 c3 cd de 30 44 70 39 4b 9a f8 ff U...Y...0Dp9K... 00c0 01 92 cd 9e f3 8c c2 38 87 0b 00 00 00 14 ea 3a .......8.......: 00d0 da e1 a4 aa e9 e9 d2 72 bb 6a b1 bd 81 44 .......r.j...D Frame 5 (118 bytes on wire, 118 bytes captured) Arrival Time: Nov 12, 2007 14:36:01.473167000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.239732000 seconds Frame Number: 5 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16) Destination: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.111 (165.227.249.111) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x013b (315) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a97 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.111 (165.227.249.111) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x7158 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE24B015BB036CBC6 Responder cookie: 0x67DDF9360E9F1250 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 1c f0 72 2f 16 00 0c 29 f4 af 90 08 00 45 00 ...r/...).....E. 0010 00 68 01 3b 00 00 40 11 3a 97 a5 e3 f9 7c a5 e3 .h.;..@.:....|.. 0020 f9 6f 01 f4 01 f4 00 54 71 58 e2 4b 01 5b b0 36 .o.....TqX.K.[.6 0030 cb c6 67 dd f9 36 0e 9f 12 50 05 10 02 01 00 00 ..g..6...P...... 0040 00 00 00 00 00 4c 29 8c 7c d5 b8 5b f7 f6 da 32 .....L).|..[...2 0050 a4 e3 71 41 1a 8c 3e 5d 01 c5 81 3d 2b db 7d 8a ..qA..>]...=+.}. 0060 b7 7a ad 61 92 9a 6a 97 b1 d5 d0 4c 70 1d 50 44 .z.a..j....Lp.PD 0070 cc 0f a4 c0 80 8c ...... Frame 6 (118 bytes on wire, 118 bytes captured) Arrival Time: Nov 12, 2007 14:36:01.478821000 Time delta from previous packet: 0.005654000 seconds Time since reference or first frame: 0.245386000 seconds Frame Number: 6 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.111 (165.227.249.111), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x614b (24907) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x1b86 [correct] Good: True Bad : False Source: 165.227.249.111 (165.227.249.111) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xa2e2 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE24B015BB036CBC6 Responder cookie: 0x67DDF9360E9F1250 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 f4 af 90 00 1c f0 72 2f 16 08 00 45 00 ..)......r/...E. 0010 00 68 61 4b 00 00 ff 11 1b 86 a5 e3 f9 6f a5 e3 .haK.........o.. 0020 f9 7c 01 f4 01 f4 00 54 a2 e2 e2 4b 01 5b b0 36 .|.....T...K.[.6 0030 cb c6 67 dd f9 36 0e 9f 12 50 05 10 02 01 00 00 ..g..6...P...... 0040 00 00 00 00 00 4c 69 f3 c9 ee 23 03 47 4b be a3 .....Li...#.GK.. 0050 14 d3 27 f0 c1 90 f4 47 89 ba fa 4f 7e 4c 94 da ..'....G...O~L.. 0060 6a eb b0 db 00 8c 39 4c e9 5b df f2 bb 96 f6 aa j.....9L.[...... 0070 86 33 2c 96 c6 27 .3,..' Frame 7 (342 bytes on wire, 342 bytes captured) Arrival Time: Nov 12, 2007 14:36:01.478823000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.245388000 seconds Frame Number: 7 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16) Destination: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.111 (165.227.249.111) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x013c (316) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x39b6 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.111 (165.227.249.111) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xb309 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE24B015BB036CBC6 Responder cookie: 0x67DDF9360E9F1250 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x73566EB9 Length: 300 Encrypted payload (272 bytes) 0000 00 1c f0 72 2f 16 00 0c 29 f4 af 90 08 00 45 00 ...r/...).....E. 0010 01 48 01 3c 00 00 40 11 39 b6 a5 e3 f9 7c a5 e3 .H.<..@.9....|.. 0020 f9 6f 01 f4 01 f4 01 34 b3 09 e2 4b 01 5b b0 36 .o.....4...K.[.6 0030 cb c6 67 dd f9 36 0e 9f 12 50 08 10 20 01 73 56 ..g..6...P.. .sV 0040 6e b9 00 00 01 2c de e9 83 ec 5d 64 ee 10 3e b7 n....,....]d..>. 0050 83 ac fe 51 0c 74 a8 b8 7e 6e db 85 6b 81 df 16 ...Q.t..~n..k... 0060 74 04 f1 d5 ed 1a 98 96 98 c9 34 33 e3 35 34 c7 t.........43.54. 0070 ce 32 dd 2f 6b eb 90 e0 a9 4b 75 22 56 24 0e 4c .2./k....Ku"V$.L 0080 1d 67 07 ec 54 b6 b4 f6 f4 b7 d7 2f 4f a7 9f 02 .g..T....../O... 0090 9f 72 6b 02 3d e5 7d 7c 49 1d 52 e1 5d 66 cb 35 .rk.=.}|I.R.]f.5 00a0 1f 1b 3f 2e 40 f7 95 77 ef 5c 39 8c 1f 98 b8 fc ..?.@..w.\9..... 00b0 4c db 79 13 66 71 06 d8 0f d9 e6 8a 61 d1 36 51 L.y.fq......a.6Q 00c0 53 7e 52 3c ab 7c 76 da db f3 02 28 5e 21 4a b2 S~R<.|v....(^!J. 00d0 8a ef 53 e5 11 db 76 23 f8 79 be 38 de 43 38 9b ..S...v#.y.8.C8. 00e0 24 18 3b 4d 9c fe 35 44 6d 47 fa 7b c4 5f 82 f2 $.;M..5DmG.{._.. 00f0 03 ad 56 47 6b 37 2d 58 eb 0e 45 ab 46 48 9f 62 ..VGk7-X..E.FH.b 0100 32 b9 ab 0f 4c f9 72 75 14 6d fa 6d 22 10 f3 ce 2...L.ru.m.m"... 0110 97 3a 35 c6 43 ec 6e e2 32 18 37 cf d9 9d 24 58 .:5.C.n.2.7...$X 0120 67 8e 63 b9 64 60 c2 a2 a9 39 21 55 57 00 74 ed g.c.d`...9!UW.t. 0130 9b a0 19 fe 26 a4 86 05 c9 6f e3 4c 8f b8 e9 7f ....&....o.L.... 0140 ae 36 c3 cd 51 5d 66 cb 05 15 7c 71 e0 43 d5 5b .6..Q]f...|q.C.[ 0150 79 b8 73 be 74 2a y.s.t* Frame 8 (342 bytes on wire, 342 bytes captured) Arrival Time: Nov 12, 2007 14:36:01.546507000 Time delta from previous packet: 0.067684000 seconds Time since reference or first frame: 0.313072000 seconds Frame Number: 8 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.111 (165.227.249.111), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x6441 (25665) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x17b0 [correct] Good: True Bad : False Source: 165.227.249.111 (165.227.249.111) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xc6e1 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE24B015BB036CBC6 Responder cookie: 0x67DDF9360E9F1250 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x73566EB9 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 f4 af 90 00 1c f0 72 2f 16 08 00 45 00 ..)......r/...E. 0010 01 48 64 41 00 00 ff 11 17 b0 a5 e3 f9 6f a5 e3 .HdA.........o.. 0020 f9 7c 01 f4 01 f4 01 34 c6 e1 e2 4b 01 5b b0 36 .|.....4...K.[.6 0030 cb c6 67 dd f9 36 0e 9f 12 50 08 10 20 01 73 56 ..g..6...P.. .sV 0040 6e b9 00 00 01 2c 86 cf 9d 54 a4 ef 24 b3 02 60 n....,...T..$..` 0050 5e be ea f2 55 a1 e4 8d 36 bc f3 d3 0b bf 90 22 ^...U...6......" 0060 dc 53 55 a1 ea 44 29 7f 6b d2 04 1f 14 93 b3 fd .SU..D).k....... 0070 66 0a 83 da 42 d9 cc 62 e5 68 75 3f 28 27 61 a2 f...B..b.hu?('a. 0080 50 68 c8 be 39 f2 e6 48 bf 76 70 84 64 c6 15 da Ph..9..H.vp.d... 0090 20 92 48 cd 0c 45 8d 38 ca 4e 9c e6 d6 c5 99 fd .H..E.8.N...... 00a0 98 c5 4d 4b 29 37 65 54 f0 a2 c2 68 c6 c8 73 67 ..MK)7eT...h..sg 00b0 fc 66 21 d3 43 1e 80 9d bf ac c5 33 4f 95 15 cc .f!.C......3O... 00c0 d3 6b 0c 01 87 4e 57 dc ca 56 36 c5 59 43 2e 11 .k...NW..V6.YC.. 00d0 d1 a6 15 15 aa 12 ab 15 fa 94 7e 74 7f 55 43 48 ..........~t.UCH 00e0 e5 d1 32 d5 5f cc 8f b1 7f 73 b8 20 d1 9d 55 57 ..2._....s. ..UW 00f0 2c 1f b8 85 84 b8 ef 47 d2 47 39 97 86 db 83 40 ,......G.G9....@ 0100 20 ba f5 43 50 56 37 8d 77 46 57 4c 04 a3 81 0f ..CPV7.wFWL.... 0110 cb 6d b6 da 40 cc be 60 47 a0 64 bb d5 bb e1 86 .m..@..`G.d..... 0120 29 c7 04 35 b2 db 9a 98 45 a1 e6 7c 50 6f 4e 97 )..5....E..|PoN. 0130 1e 0e 34 c8 1a df 98 90 c7 cb be cf 3e 89 6e 2c ..4.........>.n, 0140 78 9a 16 6f 2b 22 f4 7f 81 de 97 bb 39 a4 b5 25 x..o+"......9..% 0150 28 ce 90 f6 27 ca (...'. Frame 9 (102 bytes on wire, 102 bytes captured) Arrival Time: Nov 12, 2007 14:36:01.549787000 Time delta from previous packet: 0.003280000 seconds Time since reference or first frame: 0.316352000 seconds Frame Number: 9 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16) Destination: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.111 (165.227.249.111) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x013d (317) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3aa5 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.111 (165.227.249.111) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xf949 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE24B015BB036CBC6 Responder cookie: 0x67DDF9360E9F1250 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x73566EB9 Length: 60 Encrypted payload (32 bytes) 0000 00 1c f0 72 2f 16 00 0c 29 f4 af 90 08 00 45 00 ...r/...).....E. 0010 00 58 01 3d 00 00 40 11 3a a5 a5 e3 f9 7c a5 e3 .X.=..@.:....|.. 0020 f9 6f 01 f4 01 f4 00 44 f9 49 e2 4b 01 5b b0 36 .o.....D.I.K.[.6 0030 cb c6 67 dd f9 36 0e 9f 12 50 08 10 20 01 73 56 ..g..6...P.. .sV 0040 6e b9 00 00 00 3c f0 af 2c 6e d1 37 aa 3c 48 5d n....<..,n.7.4!] . Frame 11 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 12, 2007 14:36:01.801590000 Time delta from previous packet: 0.005280000 seconds Time since reference or first frame: 0.568155000 seconds Frame Number: 11 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:1c:f0:72:2f:16 (00:1c:f0:72:2f:16) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.111 (165.227.249.111), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x6263 (25187) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x293d [correct] Good: True Bad : False Source: 165.227.249.111 (165.227.249.111) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0xed27b6b6 Sequence: 2 Data (92 bytes) 0000 00 0c 29 f4 af 90 00 1c f0 72 2f 16 08 00 45 00 ..)......r/...E. 0010 00 78 62 63 00 00 f0 32 29 3d a5 e3 f9 6f a5 e3 .xbc...2)=...o.. 0020 f9 7c ed 27 b6 b6 00 00 00 02 03 72 88 3f 0a 9f .|.'.......r.?.. 0030 12 07 00 00 00 00 00 00 00 00 c8 16 79 82 06 99 ............y... 0040 90 43 16 be eb 25 a5 0c d4 bf 93 92 dd 20 94 1a .C...%....... .. 0050 b0 74 e6 40 05 10 f5 5f b1 72 7e 7a 0f e7 24 f3 .t.@..._.r~z..$. 0060 99 41 24 29 9c 41 3c 63 ae 5f 6b e0 96 44 d0 f5 .A$).A8.]5. 0080 a7 6a a7 c2 c4 27 .j...'