Frame 1 (326 bytes on wire, 326 bytes captured) Arrival Time: Oct 26, 2009 12:23:27.506188000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfafb [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x49a4 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 6B9528A304994BA5 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0x6B9528A304994BA5 Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 14 f6 e0 0a 87 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 01 38 00 00 40 00 40 11 fa fb a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 75 01 f4 01 f4 01 24 49 a4 6b 95 28 a3 04 99 .u.....$I.k.(... 0030 4b a5 00 00 00 00 00 00 00 00 01 10 02 00 00 00 K............... 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 6b 95 28 a3 04 99 .....|....k.(... 0060 4b a5 03 00 00 24 00 01 00 00 80 01 00 07 80 0e K....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 2 (326 bytes on wire, 326 bytes captured) Arrival Time: Oct 26, 2009 12:23:27.506196000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 0.000008000 seconds] Frame Number: 2 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfafb [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x49a4 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 6B9528A304994BA5 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0x6B9528A304994BA5 Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 14 f6 e0 0a 87 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 01 38 00 00 40 00 40 11 fa fb a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 75 01 f4 01 f4 01 24 49 a4 6b 95 28 a3 04 99 .u.....$I.k.(... 0030 4b a5 00 00 00 00 00 00 00 00 01 10 02 00 00 00 K............... 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 6b 95 28 a3 04 99 .....|....k.(... 0060 4b a5 03 00 00 24 00 01 00 00 80 01 00 07 80 0e K....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 3 (202 bytes on wire, 202 bytes captured) Arrival Time: Oct 26, 2009 12:23:27.509072000 [Time delta from previous captured frame: 0.002876000 seconds] [Time delta from previous displayed frame: 0.002876000 seconds] [Time since reference or first frame: 0.002884000 seconds] Frame Number: 3 Frame Length: 202 bytes Capture Length: 202 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 188 Identification: 0x07c1 (1985) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x33b7 [correct] [Good: True] [Bad : False] Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 168 Checksum: 0x54cb [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 6B9528A304994BA5 Responder cookie: 2E374DFA490A3808 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 160 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Key-Length (14): Key-Length (128) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: 651ECECD748D24BE685A79D5F463722820F672DF00000013... Next payload: Vendor ID (13) Payload length: 32 Vendor ID: 651ECECD748D24BE685A79D5F463722820F672DF00000013... Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID: 4865617274426561745F4E6F74696679386B0100 Next payload: NONE (0) Payload length: 24 Vendor ID: 4865617274426561745F4E6F74696679386B0100 0000 00 0c 29 48 f8 2f 00 14 f6 e0 0a 87 08 00 45 00 ..)H./........E. 0010 00 bc 07 c1 00 00 40 11 33 b7 a5 e3 f9 75 a5 e3 ......@.3....u.. 0020 f9 7c 01 f4 01 f4 00 a8 54 cb 6b 95 28 a3 04 99 .|......T.k.(... 0030 4b a5 2e 37 4d fa 49 0a 38 08 01 10 02 00 00 00 K..7M.I.8....... 0040 00 00 00 00 00 a0 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0e 00 80 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 20 65 1e ce cd 74 8d 24 be 68 5a 79 d5 f4 63 . e...t.$.hZy..c 0090 72 28 20 f6 72 df 00 00 00 13 00 00 06 14 0d 00 r( .r........... 00a0 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00b0 01 00 00 00 00 18 48 65 61 72 74 42 65 61 74 5f ......HeartBeat_ 00c0 4e 6f 74 69 66 79 38 6b 01 00 Notify8k.. Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Oct 26, 2009 12:23:27.512869000 [Time delta from previous captured frame: 0.003797000 seconds] [Time delta from previous displayed frame: 0.003797000 seconds] [Time since reference or first frame: 0.006681000 seconds] Frame Number: 4 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb63 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xae0c [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 6B9528A304994BA5 Responder cookie: 2E374DFA490A3808 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 14 f6 e0 0a 87 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 d0 00 00 40 00 40 11 fb 63 a5 e3 f9 7c a5 e3 ....@.@..c...|.. 0020 f9 75 01 f4 01 f4 00 bc ae 0c 6b 95 28 a3 04 99 .u........k.(... 0030 4b a5 2e 37 4d fa 49 0a 38 08 04 10 02 00 00 00 K..7M.I.8....... 0040 00 00 00 00 00 b4 0a 00 00 84 76 b8 07 1b 38 67 ..........v...8g 0050 4c 27 b8 7d 42 58 3a 5a b3 6e 80 ca 70 e1 62 dd L'.}BX:Z.n..p.b. 0060 b7 2a 7b d3 5b 83 55 3f 49 c5 0c 44 8c c8 a7 52 .*{.[.U?I..D...R 0070 c8 41 ba ce 9b 95 f2 f5 d3 44 83 a9 45 9a ce 1a .A.......D..E... 0080 9e e7 4d 8d 8a 56 30 6d 0b 8a 05 f4 f8 6a d8 01 ..M..V0m.....j.. 0090 1e 17 e9 45 3e 5b f1 19 21 60 92 24 b9 c2 a5 80 ...E>[..!`.$.... 00a0 42 a6 0e 98 c3 c9 79 9c cf 98 f7 6b 24 93 5a d8 B.....y....k$.Z. 00b0 1b 8b 47 f6 ee 48 9c 42 95 01 71 62 a8 21 5f 7a ..G..H.B..qb.!_z 00c0 ea b5 6a 5f 95 da 14 23 a5 10 00 00 00 14 f7 c2 ..j_...#........ 00d0 d5 6e 4b 74 3f bd 16 57 9f e2 ef 98 aa c8 .nKt?..W...... Frame 5 (222 bytes on wire, 222 bytes captured) Arrival Time: Oct 26, 2009 12:23:27.512882000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 0.006694000 seconds] Frame Number: 5 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb63 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xae0c [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 6B9528A304994BA5 Responder cookie: 2E374DFA490A3808 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 14 f6 e0 0a 87 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 d0 00 00 40 00 40 11 fb 63 a5 e3 f9 7c a5 e3 ....@.@..c...|.. 0020 f9 75 01 f4 01 f4 00 bc ae 0c 6b 95 28 a3 04 99 .u........k.(... 0030 4b a5 2e 37 4d fa 49 0a 38 08 04 10 02 00 00 00 K..7M.I.8....... 0040 00 00 00 00 00 b4 0a 00 00 84 76 b8 07 1b 38 67 ..........v...8g 0050 4c 27 b8 7d 42 58 3a 5a b3 6e 80 ca 70 e1 62 dd L'.}BX:Z.n..p.b. 0060 b7 2a 7b d3 5b 83 55 3f 49 c5 0c 44 8c c8 a7 52 .*{.[.U?I..D...R 0070 c8 41 ba ce 9b 95 f2 f5 d3 44 83 a9 45 9a ce 1a .A.......D..E... 0080 9e e7 4d 8d 8a 56 30 6d 0b 8a 05 f4 f8 6a d8 01 ..M..V0m.....j.. 0090 1e 17 e9 45 3e 5b f1 19 21 60 92 24 b9 c2 a5 80 ...E>[..!`.$.... 00a0 42 a6 0e 98 c3 c9 79 9c cf 98 f7 6b 24 93 5a d8 B.....y....k$.Z. 00b0 1b 8b 47 f6 ee 48 9c 42 95 01 71 62 a8 21 5f 7a ..G..H.B..qb.!_z 00c0 ea b5 6a 5f 95 da 14 23 a5 10 00 00 00 14 f7 c2 ..j_...#........ 00d0 d5 6e 4b 74 3f bd 16 57 9f e2 ef 98 aa c8 .nKt?..W...... Frame 6 (238 bytes on wire, 238 bytes captured) Arrival Time: Oct 26, 2009 12:23:27.543145000 [Time delta from previous captured frame: 0.030263000 seconds] [Time delta from previous displayed frame: 0.030263000 seconds] [Time since reference or first frame: 0.036957000 seconds] Frame Number: 6 Frame Length: 238 bytes Capture Length: 238 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 224 Identification: 0x07c2 (1986) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3392 [correct] [Good: True] [Bad : False] Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 204 Checksum: 0xdf78 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 6B9528A304994BA5 Responder cookie: 2E374DFA490A3808 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 196 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 36 Nonce Data 0000 00 0c 29 48 f8 2f 00 14 f6 e0 0a 87 08 00 45 00 ..)H./........E. 0010 00 e0 07 c2 00 00 40 11 33 92 a5 e3 f9 75 a5 e3 ......@.3....u.. 0020 f9 7c 01 f4 01 f4 00 cc df 78 6b 95 28 a3 04 99 .|.......xk.(... 0030 4b a5 2e 37 4d fa 49 0a 38 08 04 10 02 00 00 00 K..7M.I.8....... 0040 00 00 00 00 00 c4 0a 00 00 84 a8 b4 ae 83 23 44 ..............#D 0050 8b 8f 7e 51 8f 15 52 a5 10 66 5e f8 22 e9 7b f8 ..~Q..R..f^.".{. 0060 0a 3e 8d 54 13 a4 5a eb 29 c8 4f 48 ce b3 08 0c .>.T..Z.).OH.... 0070 0c 11 cd 69 60 70 b0 00 42 e9 a5 cf 23 01 57 9a ...i`p..B...#.W. 0080 bd 9b c1 54 36 11 ea ef 4c 9f 6d 24 57 41 a5 fe ...T6...L.m$WA.. 0090 6c a5 b8 b2 61 ba e5 dd 30 a9 68 8c 3d 1a 54 09 l...a...0.h.=.T. 00a0 ec a5 07 bd cd 1b 0d f2 e1 bd f3 e0 ee 00 83 11 ................ 00b0 22 4e c7 b0 72 b8 ff ae fa 08 37 11 a6 11 e5 93 "N..r.....7..... 00c0 eb 7a 32 1d b8 ae f7 7b 00 f7 00 00 00 24 cc 23 .z2....{.....$.# 00d0 7c cd 97 2b b8 d9 88 61 bf c7 f1 9b a6 b1 d5 07 |..+...a........ 00e0 51 70 66 38 13 9e ba aa 45 7d 46 9e 84 b6 Qpf8....E}F... Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 12:23:27.546046000 [Time delta from previous captured frame: 0.002901000 seconds] [Time delta from previous displayed frame: 0.002901000 seconds] [Time since reference or first frame: 0.039858000 seconds] Frame Number: 7 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbbb [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x5b07 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 6B9528A304994BA5 Responder cookie: 2E374DFA490A3808 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 14 f6 e0 0a 87 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 78 00 00 40 00 40 11 fb bb a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 75 01 f4 01 f4 00 64 5b 07 6b 95 28 a3 04 99 .u.....d[.k.(... 0030 4b a5 2e 37 4d fa 49 0a 38 08 05 10 02 01 00 00 K..7M.I.8....... 0040 00 00 00 00 00 5c f5 b6 a1 58 1f f9 ec 41 ea f5 .....\...X...A.. 0050 95 a0 51 84 08 d0 e7 6a a1 a8 46 29 4a 49 b0 0b ..Q....j..F)JI.. 0060 d8 a3 6e f3 ea e3 20 0c 6a 5b 99 0b 88 d1 bf 04 ..n... .j[...... 0070 63 60 36 a5 99 29 e8 9f 82 53 59 4a 2e 1e aa 1c c`6..)...SYJ.... 0080 c1 e1 ff 59 01 e6 ...Y.. Frame 8 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 12:23:27.546055000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 0.039867000 seconds] Frame Number: 8 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbbb [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x5b07 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 6B9528A304994BA5 Responder cookie: 2E374DFA490A3808 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 14 f6 e0 0a 87 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 78 00 00 40 00 40 11 fb bb a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 75 01 f4 01 f4 00 64 5b 07 6b 95 28 a3 04 99 .u.....d[.k.(... 0030 4b a5 2e 37 4d fa 49 0a 38 08 05 10 02 01 00 00 K..7M.I.8....... 0040 00 00 00 00 00 5c f5 b6 a1 58 1f f9 ec 41 ea f5 .....\...X...A.. 0050 95 a0 51 84 08 d0 e7 6a a1 a8 46 29 4a 49 b0 0b ..Q....j..F)JI.. 0060 d8 a3 6e f3 ea e3 20 0c 6a 5b 99 0b 88 d1 bf 04 ..n... .j[...... 0070 63 60 36 a5 99 29 e8 9f 82 53 59 4a 2e 1e aa 1c c`6..)...SYJ.... 0080 c1 e1 ff 59 01 e6 ...Y.. Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: Oct 26, 2009 12:23:27.549303000 [Time delta from previous captured frame: 0.003248000 seconds] [Time delta from previous displayed frame: 0.003248000 seconds] [Time since reference or first frame: 0.043115000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x07c3 (1987) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3409 [correct] [Good: True] [Bad : False] Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xeb17 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 6B9528A304994BA5 Responder cookie: 2E374DFA490A3808 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 48 f8 2f 00 14 f6 e0 0a 87 08 00 45 00 ..)H./........E. 0010 00 68 07 c3 00 00 40 11 34 09 a5 e3 f9 75 a5 e3 .h....@.4....u.. 0020 f9 7c 01 f4 01 f4 00 54 eb 17 6b 95 28 a3 04 99 .|.....T..k.(... 0030 4b a5 2e 37 4d fa 49 0a 38 08 05 10 02 01 00 00 K..7M.I.8....... 0040 00 00 00 00 00 4c 9b 77 14 36 1e 17 5c 30 62 58 .....L.w.6..\0bX 0050 27 15 ac 74 43 41 dd 96 20 34 ac d5 54 3e 04 e5 '..tCA.. 4..T>.. 0060 f2 da ef ec 41 b1 c6 98 7f 87 fa 7d 4c 9e b4 e5 ....A......}L... 0070 f4 3b e8 9e fe 21 .;...! Frame 10 (518 bytes on wire, 518 bytes captured) Arrival Time: Oct 26, 2009 12:23:27.555887000 [Time delta from previous captured frame: 0.006584000 seconds] [Time delta from previous displayed frame: 0.006584000 seconds] [Time since reference or first frame: 0.049699000 seconds] Frame Number: 10 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa3b [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0xddf1 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 6B9528A304994BA5 Responder cookie: 2E374DFA490A3808 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xec30f8a0 Length: 476 Encrypted payload (448 bytes) 0000 00 14 f6 e0 0a 87 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 01 f8 00 00 40 00 40 11 fa 3b a5 e3 f9 7c a5 e3 ....@.@..;...|.. 0020 f9 75 01 f4 01 f4 01 e4 dd f1 6b 95 28 a3 04 99 .u........k.(... 0030 4b a5 2e 37 4d fa 49 0a 38 08 08 10 20 01 ec 30 K..7M.I.8... ..0 0040 f8 a0 00 00 01 dc 61 29 7d 18 93 ab a6 6a f8 85 ......a)}....j.. 0050 9f 8f ae ab 42 66 0e 4b bd 25 77 be ad 90 ff 03 ....Bf.K.%w..... 0060 8f a0 5d e8 30 18 2a c0 08 1c 5b 32 54 26 0e d3 ..].0.*...[2T&.. 0070 60 38 f6 65 70 b8 2c e8 d1 fd ff 58 dd fe b2 33 `8.ep.,....X...3 0080 47 32 a7 20 53 62 a1 fb 0c be 14 66 d9 54 f4 79 G2. Sb.....f.T.y 0090 36 4e 08 f1 ef fe 3d 7e f9 ee 7c 0c ee 08 e6 a2 6N....=~..|..... 00a0 60 84 fc 5c 56 8a 2b 48 bf cb e9 e1 a6 43 71 99 `..\V.+H.....Cq. 00b0 ab 03 03 30 cd 81 32 22 7c bb 91 33 f4 a8 83 18 ...0..2"|..3.... 00c0 35 0a 55 68 94 5e 3b 9d 4c c2 14 a0 91 6e a9 7f 5.Uh.^;.L....n.. 00d0 c9 5b 68 03 24 ed cc aa e4 28 ae e3 2c 78 55 16 .[h.$....(..,xU. 00e0 90 e3 1b 5f e6 e0 a2 ad f0 5b 20 f6 27 f5 6f 42 ..._.....[ .'.oB 00f0 b2 43 87 4b 2b 6a ec 58 f1 47 5f ce 7e 15 d4 7a .C.K+j.X.G_.~..z 0100 82 23 9c 29 8f 27 4b 0e e7 75 db 9a fc ea 46 3b .#.).'K..u....F; 0110 ed 9e 6d bc cf db 27 8a 1d 67 6a cb f5 76 fb f4 ..m...'..gj..v.. 0120 cf 46 33 d0 16 97 04 67 ce 01 1f 8e cd 3e fc 01 .F3....g.....>.. 0130 80 23 35 a6 de 2d 1d a3 bb 28 54 6d ac b0 6e 82 .#5..-...(Tm..n. 0140 67 43 dd fc ed 14 bb 0b d1 21 7f 8c ed 12 e6 99 gC.......!...... 0150 c2 a8 ca 1c fb 88 c7 b1 d4 df df 6c 23 8e 18 f0 ...........l#... 0160 bb 05 9d 42 45 13 60 80 5c 6e 72 71 92 23 f0 cd ...BE.`.\nrq.#.. 0170 93 35 50 bd 58 ce b3 c8 ec 92 69 11 ac de 64 30 .5P.X.....i...d0 0180 cd fa b0 dd 84 be 26 a2 97 ca 3e d8 e3 d9 25 f9 ......&...>...%. 0190 10 2d 01 5a 9d 93 5a 48 c1 f2 a0 04 5b 87 26 50 .-.Z..ZH....[.&P 01a0 27 99 21 33 9c 2e 01 1a 00 b1 cc 95 45 79 53 62 '.!3........EySb 01b0 52 c8 dd eb b3 b5 de 79 68 09 18 e7 a8 ff 9a 64 R......yh......d 01c0 3e f7 75 86 b2 76 f3 6c 47 61 38 bf c8 b7 55 d0 >.u..v.lGa8...U. 01d0 e6 a8 e5 84 b7 f3 e7 33 e0 a1 32 8a 03 1a f0 78 .......3..2....x 01e0 16 e7 62 eb bc a6 bf d6 21 53 b5 cf d7 44 51 a1 ..b.....!S...DQ. 01f0 2a b3 82 58 e8 8f 51 60 e3 a4 3e 91 be a6 d0 3a *..X..Q`..>....: 0200 d3 57 12 21 75 c6 .W.!u. Frame 11 (518 bytes on wire, 518 bytes captured) Arrival Time: Oct 26, 2009 12:23:27.555900000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 0.049712000 seconds] Frame Number: 11 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa3b [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0xddf1 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 6B9528A304994BA5 Responder cookie: 2E374DFA490A3808 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xec30f8a0 Length: 476 Encrypted payload (448 bytes) 0000 00 14 f6 e0 0a 87 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 01 f8 00 00 40 00 40 11 fa 3b a5 e3 f9 7c a5 e3 ....@.@..;...|.. 0020 f9 75 01 f4 01 f4 01 e4 dd f1 6b 95 28 a3 04 99 .u........k.(... 0030 4b a5 2e 37 4d fa 49 0a 38 08 08 10 20 01 ec 30 K..7M.I.8... ..0 0040 f8 a0 00 00 01 dc 61 29 7d 18 93 ab a6 6a f8 85 ......a)}....j.. 0050 9f 8f ae ab 42 66 0e 4b bd 25 77 be ad 90 ff 03 ....Bf.K.%w..... 0060 8f a0 5d e8 30 18 2a c0 08 1c 5b 32 54 26 0e d3 ..].0.*...[2T&.. 0070 60 38 f6 65 70 b8 2c e8 d1 fd ff 58 dd fe b2 33 `8.ep.,....X...3 0080 47 32 a7 20 53 62 a1 fb 0c be 14 66 d9 54 f4 79 G2. Sb.....f.T.y 0090 36 4e 08 f1 ef fe 3d 7e f9 ee 7c 0c ee 08 e6 a2 6N....=~..|..... 00a0 60 84 fc 5c 56 8a 2b 48 bf cb e9 e1 a6 43 71 99 `..\V.+H.....Cq. 00b0 ab 03 03 30 cd 81 32 22 7c bb 91 33 f4 a8 83 18 ...0..2"|..3.... 00c0 35 0a 55 68 94 5e 3b 9d 4c c2 14 a0 91 6e a9 7f 5.Uh.^;.L....n.. 00d0 c9 5b 68 03 24 ed cc aa e4 28 ae e3 2c 78 55 16 .[h.$....(..,xU. 00e0 90 e3 1b 5f e6 e0 a2 ad f0 5b 20 f6 27 f5 6f 42 ..._.....[ .'.oB 00f0 b2 43 87 4b 2b 6a ec 58 f1 47 5f ce 7e 15 d4 7a .C.K+j.X.G_.~..z 0100 82 23 9c 29 8f 27 4b 0e e7 75 db 9a fc ea 46 3b .#.).'K..u....F; 0110 ed 9e 6d bc cf db 27 8a 1d 67 6a cb f5 76 fb f4 ..m...'..gj..v.. 0120 cf 46 33 d0 16 97 04 67 ce 01 1f 8e cd 3e fc 01 .F3....g.....>.. 0130 80 23 35 a6 de 2d 1d a3 bb 28 54 6d ac b0 6e 82 .#5..-...(Tm..n. 0140 67 43 dd fc ed 14 bb 0b d1 21 7f 8c ed 12 e6 99 gC.......!...... 0150 c2 a8 ca 1c fb 88 c7 b1 d4 df df 6c 23 8e 18 f0 ...........l#... 0160 bb 05 9d 42 45 13 60 80 5c 6e 72 71 92 23 f0 cd ...BE.`.\nrq.#.. 0170 93 35 50 bd 58 ce b3 c8 ec 92 69 11 ac de 64 30 .5P.X.....i...d0 0180 cd fa b0 dd 84 be 26 a2 97 ca 3e d8 e3 d9 25 f9 ......&...>...%. 0190 10 2d 01 5a 9d 93 5a 48 c1 f2 a0 04 5b 87 26 50 .-.Z..ZH....[.&P 01a0 27 99 21 33 9c 2e 01 1a 00 b1 cc 95 45 79 53 62 '.!3........EySb 01b0 52 c8 dd eb b3 b5 de 79 68 09 18 e7 a8 ff 9a 64 R......yh......d 01c0 3e f7 75 86 b2 76 f3 6c 47 61 38 bf c8 b7 55 d0 >.u..v.lGa8...U. 01d0 e6 a8 e5 84 b7 f3 e7 33 e0 a1 32 8a 03 1a f0 78 .......3..2....x 01e0 16 e7 62 eb bc a6 bf d6 21 53 b5 cf d7 44 51 a1 ..b.....!S...DQ. 01f0 2a b3 82 58 e8 8f 51 60 e3 a4 3e 91 be a6 d0 3a *..X..Q`..>....: 0200 d3 57 12 21 75 c6 .W.!u. Frame 12 (358 bytes on wire, 358 bytes captured) Arrival Time: Oct 26, 2009 12:23:27.587855000 [Time delta from previous captured frame: 0.031955000 seconds] [Time delta from previous displayed frame: 0.031955000 seconds] [Time since reference or first frame: 0.081667000 seconds] Frame Number: 12 Frame Length: 358 bytes Capture Length: 358 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 344 Identification: 0x07c4 (1988) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3318 [correct] [Good: True] [Bad : False] Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 324 Checksum: 0x1381 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 6B9528A304994BA5 Responder cookie: 2E374DFA490A3808 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xec30f8a0 Length: 316 Encrypted payload (288 bytes) 0000 00 0c 29 48 f8 2f 00 14 f6 e0 0a 87 08 00 45 00 ..)H./........E. 0010 01 58 07 c4 00 00 40 11 33 18 a5 e3 f9 75 a5 e3 .X....@.3....u.. 0020 f9 7c 01 f4 01 f4 01 44 13 81 6b 95 28 a3 04 99 .|.....D..k.(... 0030 4b a5 2e 37 4d fa 49 0a 38 08 08 10 20 01 ec 30 K..7M.I.8... ..0 0040 f8 a0 00 00 01 3c 54 da da 0b 05 89 db 38 b5 41 ........C+ 0060 20 e4 74 12 d8 5f .t.._ Frame 14 (102 bytes on wire, 102 bytes captured) Arrival Time: Oct 26, 2009 12:23:27.590839000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 0.084651000 seconds] Frame Number: 14 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbdb [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xb59e [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 6B9528A304994BA5 Responder cookie: 2E374DFA490A3808 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xec30f8a0 Length: 60 Encrypted payload (32 bytes) 0000 00 14 f6 e0 0a 87 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 58 00 00 40 00 40 11 fb db a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 75 01 f4 01 f4 00 44 b5 9e 6b 95 28 a3 04 99 .u.....D..k.(... 0030 4b a5 2e 37 4d fa 49 0a 38 08 08 10 20 01 ec 30 K..7M.I.8... ..0 0040 f8 a0 00 00 00 3c 43 c1 7c bc f7 de 91 64 0b 2f ........C+ 0060 20 e4 74 12 d8 5f .t.._ Frame 15 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 12:23:27.855574000 [Time delta from previous captured frame: 0.264735000 seconds] [Time delta from previous displayed frame: 0.264735000 seconds] [Time since reference or first frame: 0.349386000 seconds] Frame Number: 15 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b9a [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.117 (165.227.249.117) Encapsulating Security Payload ESP SPI: 0x9c55b733 ESP Sequence: 1 0000 00 14 f6 e0 0a 87 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 78 00 00 00 00 f0 32 8b 9a a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 75 9c 55 b7 33 00 00 00 01 82 a7 50 5c 78 9a .u.U.3......P\x. 0030 4e 17 34 55 a8 e2 c2 d2 d4 b2 25 31 aa 52 b2 27 N.4U......%1.R.' 0040 f5 79 b0 8e ce c5 19 0c 66 cf 02 3b 77 46 20 e9 .y......f..;wF . 0050 78 b3 71 cc 16 df 85 32 ee 6d 8f ff 90 b9 9c 66 x.q....2.m.....f 0060 c0 a8 9c 20 d7 69 14 51 9f 2c 15 a2 f0 b6 96 f2 ... .i.Q.,...... 0070 7f 8b 70 f3 24 f2 a4 3d 8e 01 53 b9 54 37 a1 f0 ..p.$..=..S.T7.. 0080 83 0d c5 cc c9 aa ...... Frame 16 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 12:23:27.855587000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 0.349399000 seconds] Frame Number: 16 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b9a [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.117 (165.227.249.117) Encapsulating Security Payload ESP SPI: 0x9c55b733 ESP Sequence: 1 0000 00 14 f6 e0 0a 87 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 78 00 00 00 00 f0 32 8b 9a a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 75 9c 55 b7 33 00 00 00 01 82 a7 50 5c 78 9a .u.U.3......P\x. 0030 4e 17 34 55 a8 e2 c2 d2 d4 b2 25 31 aa 52 b2 27 N.4U......%1.R.' 0040 f5 79 b0 8e ce c5 19 0c 66 cf 02 3b 77 46 20 e9 .y......f..;wF . 0050 78 b3 71 cc 16 df 85 32 ee 6d 8f ff 90 b9 9c 66 x.q....2.m.....f 0060 c0 a8 9c 20 d7 69 14 51 9f 2c 15 a2 f0 b6 96 f2 ... .i.Q.,...... 0070 7f 8b 70 f3 24 f2 a4 3d 8e 01 53 b9 54 37 a1 f0 ..p.$..=..S.T7.. 0080 83 0d c5 cc c9 aa ...... Frame 17 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 12:23:27.862961000 [Time delta from previous captured frame: 0.007374000 seconds] [Time delta from previous displayed frame: 0.007374000 seconds] [Time since reference or first frame: 0.356773000 seconds] Frame Number: 17 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x07c6 (1990) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x33d5 [correct] [Good: True] [Bad : False] Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0xe9586435 ESP Sequence: 1 0000 00 0c 29 48 f8 2f 00 14 f6 e0 0a 87 08 00 45 00 ..)H./........E. 0010 00 78 07 c6 00 00 40 32 33 d5 a5 e3 f9 75 a5 e3 .x....@23....u.. 0020 f9 7c e9 58 64 35 00 00 00 01 0c cc 64 93 d2 98 .|.Xd5......d... 0030 d8 dc a6 56 fa 14 52 c3 ff 41 24 2b 9a 02 51 21 ...V..R..A$+..Q! 0040 2d f2 34 8d 73 da e8 f9 9e 30 ae ae e0 f8 54 3a -.4.s....0....T: 0050 c0 09 63 37 7f 1f 10 5b 3e 0c 4f f3 a1 3a a2 4e ..c7...[>.O..:.N 0060 e4 03 74 63 0e fa fc db 87 06 7d 86 49 7e c3 5d ..tc......}.I~.] 0070 9b 0c 4d f5 2a 0c 8b d5 45 b6 50 6e 7a 1f 33 54 ..M.*...E.Pnz.3T 0080 86 c0 a0 fa a5 bf ...... Frame 18 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 12:23:28.494623000 [Time delta from previous captured frame: 0.631662000 seconds] [Time delta from previous displayed frame: 0.631662000 seconds] [Time since reference or first frame: 0.988435000 seconds] Frame Number: 18 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b99 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.117 (165.227.249.117) Encapsulating Security Payload ESP SPI: 0x9c55b733 ESP Sequence: 2 0000 00 14 f6 e0 0a 87 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 78 00 01 00 00 f0 32 8b 99 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 75 9c 55 b7 33 00 00 00 02 9d e5 9b 0c 44 b1 .u.U.3........D. 0030 99 bb 57 ba 6c 13 23 1b a5 2c d2 7d 34 6c 50 0d ..W.l.#..,.}4lP. 0040 8c 24 e0 c8 2b f1 d4 b7 0c 00 55 31 43 48 de b8 .$..+.....U1CH.. 0050 0b 47 f1 d1 37 86 2b 18 60 77 e2 71 33 64 14 56 .G..7.+.`w.q3d.V 0060 90 1d 8f 11 25 55 f2 b1 ab 4c 6e 56 f9 4a fd ad ....%U...LnV.J.. 0070 9f 95 a2 ea 1b 76 46 cb 7f ae a2 bd c1 a0 57 de .....vF.......W. 0080 ba 13 bd 0d 3e a4 ....>. Frame 19 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 12:23:28.494640000 [Time delta from previous captured frame: 0.000017000 seconds] [Time delta from previous displayed frame: 0.000017000 seconds] [Time since reference or first frame: 0.988452000 seconds] Frame Number: 19 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Destination: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b99 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.117 (165.227.249.117) Encapsulating Security Payload ESP SPI: 0x9c55b733 ESP Sequence: 2 0000 00 14 f6 e0 0a 87 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 78 00 01 00 00 f0 32 8b 99 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 75 9c 55 b7 33 00 00 00 02 9d e5 9b 0c 44 b1 .u.U.3........D. 0030 99 bb 57 ba 6c 13 23 1b a5 2c d2 7d 34 6c 50 0d ..W.l.#..,.}4lP. 0040 8c 24 e0 c8 2b f1 d4 b7 0c 00 55 31 43 48 de b8 .$..+.....U1CH.. 0050 0b 47 f1 d1 37 86 2b 18 60 77 e2 71 33 64 14 56 .G..7.+.`w.q3d.V 0060 90 1d 8f 11 25 55 f2 b1 ab 4c 6e 56 f9 4a fd ad ....%U...LnV.J.. 0070 9f 95 a2 ea 1b 76 46 cb 7f ae a2 bd c1 a0 57 de .....vF.......W. 0080 ba 13 bd 0d 3e a4 ....>. Frame 20 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 12:23:28.495965000 [Time delta from previous captured frame: 0.001325000 seconds] [Time delta from previous displayed frame: 0.001325000 seconds] [Time since reference or first frame: 0.989777000 seconds] Frame Number: 20 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) Address: 00:14:f6:e0:0a:87 (00:14:f6:e0:0a:87) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x07c7 (1991) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x33d4 [correct] [Good: True] [Bad : False] Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0xe9586435 ESP Sequence: 2 0000 00 0c 29 48 f8 2f 00 14 f6 e0 0a 87 08 00 45 00 ..)H./........E. 0010 00 78 07 c7 00 00 40 32 33 d4 a5 e3 f9 75 a5 e3 .x....@23....u.. 0020 f9 7c e9 58 64 35 00 00 00 02 a1 bd 5b 2a e0 99 .|.Xd5......[*.. 0030 76 a7 19 29 11 1e 20 f6 81 5b d8 16 f0 5a 88 48 v..).. ..[...Z.H 0040 5d 4e 57 f5 1e 34 1e 6e 34 c4 ab 9b 17 49 a5 d2 ]NW..4.n4....I.. 0050 14 03 4f 30 f8 23 71 53 5f 45 0e cd ee 0f fa 80 ..O0.#qS_E...... 0060 e0 74 40 28 9f 38 cf 3a 3c f6 72 de 3e 69 49 61 .t@(.8.:<.r.>iIa 0070 3c 51 c4 04 69 fc c2 4d 5d 77 02 dd 3a 32 f1 76 ~..\D...... 0040 bb 3d c1 c0 12 12 94 72 91 a1 66 45 45 dc 95 d7 .=.....r..fEE... 0050 11 bb 41 1a 3a 6e 46 a8 bd 76 76 27 e8 d9 1f 36 ..A.:nF..vv'...6 0060 3f 81 db 13 3e ea 1a ca ce 1c f2 a1 1d 14 57 3d ?...>.........W= 0070 0d 47 da c4 0b fc 57 09 9d 1a be da 10 ce 2f 4d .G....W......./M 0080 0e 7a 9d ee 5e e0 .z..^.