Frame 1 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 29, 2010 11:34:31.122474000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b97 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) Encapsulating Security Payload ESP SPI: 0x0df3fa0c ESP Sequence: 3 0000 c8 4c 75 18 34 40 00 0c 29 96 68 b2 08 00 45 00 .Lu.4@..).h...E. 0010 00 78 00 02 00 00 f0 32 8b 97 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 76 0d f3 fa 0c 00 00 00 03 33 df 77 d0 03 51 .v........3.w..Q 0030 20 17 f8 a2 6d 25 6d f4 0e c8 5f 87 47 a7 fe 57 ...m%m..._.G..W 0040 80 d1 47 94 40 4f cc e9 a4 bb 1b 67 9d a4 45 b9 ..G.@O.....g..E. 0050 0c bc 1e 45 3a 98 e2 00 88 82 1d 51 50 42 b9 df ...E:......QPB.. 0060 c4 20 c3 83 18 cb 46 3a ee f2 2b 4c f6 47 6f 77 . ....F:..+L.Gow 0070 a1 91 31 d2 93 47 58 5f 15 21 ba 27 56 fb 28 55 ..1..GX_.!.'V.(U 0080 6d e3 6a a6 84 53 m.j..S Frame 2 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 29, 2010 11:34:31.122507000 [Time delta from previous captured frame: 0.000033000 seconds] [Time delta from previous displayed frame: 0.000033000 seconds] [Time since reference or first frame: 0.000033000 seconds] Frame Number: 2 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b97 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) Encapsulating Security Payload ESP SPI: 0x0df3fa0c ESP Sequence: 3 0000 c8 4c 75 18 34 40 00 0c 29 96 68 b2 08 00 45 00 .Lu.4@..).h...E. 0010 00 78 00 02 00 00 f0 32 8b 97 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 76 0d f3 fa 0c 00 00 00 03 33 df 77 d0 03 51 .v........3.w..Q 0030 20 17 f8 a2 6d 25 6d f4 0e c8 5f 87 47 a7 fe 57 ...m%m..._.G..W 0040 80 d1 47 94 40 4f cc e9 a4 bb 1b 67 9d a4 45 b9 ..G.@O.....g..E. 0050 0c bc 1e 45 3a 98 e2 00 88 82 1d 51 50 42 b9 df ...E:......QPB.. 0060 c4 20 c3 83 18 cb 46 3a ee f2 2b 4c f6 47 6f 77 . ....F:..+L.Gow 0070 a1 91 31 d2 93 47 58 5f 15 21 ba 27 56 fb 28 55 ..1..GX_.!.'V.(U 0080 6d e3 6a a6 84 53 m.j..S Frame 3 (326 bytes on wire, 326 bytes captured) Arrival Time: Nov 29, 2010 11:34:33.717513000 [Time delta from previous captured frame: 2.595006000 seconds] [Time delta from previous displayed frame: 2.595006000 seconds] [Time since reference or first frame: 2.595039000 seconds] Frame Number: 3 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfafa [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x11e4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: B5E1A1A33C74951D Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0xB5E1A1A33C74951D Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): RESERVED (0) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): RESERVED (0) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): RESERVED (0) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 c8 4c 75 18 34 40 00 0c 29 96 68 b2 08 00 45 00 .Lu.4@..).h...E. 0010 01 38 00 00 40 00 40 11 fa fa a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 76 01 f4 01 f4 01 24 11 e4 b5 e1 a1 a3 3c 74 .v.....$....... 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 4 (326 bytes on wire, 326 bytes captured) Arrival Time: Nov 29, 2010 11:34:33.717543000 [Time delta from previous captured frame: 0.000030000 seconds] [Time delta from previous displayed frame: 0.000030000 seconds] [Time since reference or first frame: 2.595069000 seconds] Frame Number: 4 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfafa [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x11e4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: B5E1A1A33C74951D Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0xB5E1A1A33C74951D Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): RESERVED (0) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): RESERVED (0) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): RESERVED (0) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 c8 4c 75 18 34 40 00 0c 29 96 68 b2 08 00 45 00 .Lu.4@..).h...E. 0010 01 38 00 00 40 00 40 11 fa fa a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 76 01 f4 01 f4 01 24 11 e4 b5 e1 a1 a3 3c 74 .v.....$....... 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 5 (138 bytes on wire, 138 bytes captured) Arrival Time: Nov 29, 2010 11:34:33.740626000 [Time delta from previous captured frame: 0.023083000 seconds] [Time delta from previous displayed frame: 0.023083000 seconds] [Time since reference or first frame: 2.618152000 seconds] Frame Number: 5 Frame Length: 138 bytes Capture Length: 138 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: c8:4c:75:18:34:40 (c8:4c:75:18:34:40), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.118 (165.227.249.118), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00) 1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 124 Identification: 0x0056 (86) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7ba0 [correct] [Good: True] [Bad : False] Source: 165.227.249.118 (165.227.249.118) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 104 Checksum: 0x916e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: B5E1A1A33C74951D Responder cookie: 431D909BCF582C5A Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 96 Security Association payload Next payload: Vendor ID (13) Payload length: 48 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 36 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 28 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE 0000 00 0c 29 96 68 b2 c8 4c 75 18 34 40 08 00 45 c0 ..).h..Lu.4@..E. 0010 00 7c 00 56 00 00 ff 11 7b a0 a5 e3 f9 76 a5 e3 .|.V....{....v.. 0020 f9 7c 01 f4 01 f4 00 68 91 6e b5 e1 a1 a3 3c 74 .|.....h.n.....!..98 00f0 da 73 45 0b 53 25 00 00 00 18 23 64 42 64 9b ec .sE.S%....#dBd.. 0100 91 ee b1 62 b3 9f e3 b1 87 87 d1 be 82 55 ...b.........U Frame 7 (270 bytes on wire, 270 bytes captured) Arrival Time: Nov 29, 2010 11:34:33.744429000 [Time delta from previous captured frame: 0.000029000 seconds] [Time delta from previous displayed frame: 0.000029000 seconds] [Time since reference or first frame: 2.621955000 seconds] Frame Number: 7 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb32 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0xe67e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: B5E1A1A33C74951D Responder cookie: 431D909BCF582C5A Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (RFC 3947) (20) Payload length: 20 Nonce Data NAT-D (RFC 3947) payload Next payload: NAT-D (RFC 3947) (20) Payload length: 24 Hash of address and port: 2F9446B296EF0B3E102114FC3938DA73450B5325 NAT-D (RFC 3947) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: 236442649BEC91EEB162B39FE3B18787D1BE8255 0000 c8 4c 75 18 34 40 00 0c 29 96 68 b2 08 00 45 00 .Lu.4@..).h...E. 0010 01 00 00 00 40 00 40 11 fb 32 a5 e3 f9 7c a5 e3 ....@.@..2...|.. 0020 f9 76 01 f4 01 f4 00 ec e6 7e b5 e1 a1 a3 3c 74 .v.......~.....!..98 00f0 da 73 45 0b 53 25 00 00 00 18 23 64 42 64 9b ec .sE.S%....#dBd.. 0100 91 ee b1 62 b3 9f e3 b1 87 87 d1 be 82 55 ...b.........U Frame 8 (346 bytes on wire, 346 bytes captured) Arrival Time: Nov 29, 2010 11:34:33.774052000 [Time delta from previous captured frame: 0.029623000 seconds] [Time delta from previous displayed frame: 0.029623000 seconds] [Time since reference or first frame: 2.651578000 seconds] Frame Number: 8 Frame Length: 346 bytes Capture Length: 346 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: c8:4c:75:18:34:40 (c8:4c:75:18:34:40), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.118 (165.227.249.118), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00) 1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x0057 (87) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7acf [correct] [Good: True] [Bad : False] Source: 165.227.249.118 (165.227.249.118) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0x78f3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: B5E1A1A33C74951D Responder cookie: 431D909BCF582C5A Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: CISCO-UNITY-1.0 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: CISCO-UNITY-1.0 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID: B6DA3786CF592C5A37388C2ADDF4FDA2 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: B6DA3786CF592C5A37388C2ADDF4FDA2 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NAT-D (RFC 3947) (20) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt NAT-D (RFC 3947) payload Next payload: NAT-D (RFC 3947) (20) Payload length: 24 Hash of address and port: 236442649BEC91EEB162B39FE3B18787D1BE8255 NAT-D (RFC 3947) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: 2F9446B296EF0B3E102114FC3938DA73450B5325 0000 00 0c 29 96 68 b2 c8 4c 75 18 34 40 08 00 45 c0 ..).h..Lu.4@..E. 0010 01 4c 00 57 00 00 ff 11 7a cf a5 e3 f9 76 a5 e3 .L.W....z....v.. 0020 f9 7c 01 f4 01 f4 01 38 78 f3 b5 e1 a1 a3 3c 74 .|.....8x......V.7m..} 00c0 f9 ae ad 40 0e 2a a4 6e 1e 22 0d 00 00 18 b8 6b ...@.*.n.".....k 00d0 b7 c2 35 34 f5 bf cd 02 6b 4d 31 7c 8a 9c 96 87 ..54....kM1|.... 00e0 7b 16 0d 00 00 14 12 f5 f2 8c 45 71 68 a9 70 2d {.........Eqh.p- 00f0 9f e2 74 cc 01 00 0d 00 00 14 af ca d7 13 68 a1 ..t...........h. 0100 f1 c9 6b 86 96 fc 77 57 01 00 0d 00 00 14 b6 da ..k...wW........ 0110 37 86 cf 59 2c 5a 37 38 8c 2a dd f4 fd a2 14 00 7..Y,Z78.*...... 0120 00 0c 09 00 26 89 df d6 b7 12 14 00 00 18 23 64 ....&.........#d 0130 42 64 9b ec 91 ee b1 62 b3 9f e3 b1 87 87 d1 be Bd.....b........ 0140 82 55 00 00 00 18 2f 94 46 b2 96 ef 0b 3e 10 21 .U..../.F....>.! 0150 14 fc 39 38 da 73 45 0b 53 25 ..98.sE.S% Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: Nov 29, 2010 11:34:33.777922000 [Time delta from previous captured frame: 0.003870000 seconds] [Time delta from previous displayed frame: 0.003870000 seconds] [Time since reference or first frame: 2.655448000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbca [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x9b9f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: B5E1A1A33C74951D Responder cookie: 431D909BCF582C5A Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 c8 4c 75 18 34 40 00 0c 29 96 68 b2 08 00 45 00 .Lu.4@..).h...E. 0010 00 68 00 00 40 00 40 11 fb ca a5 e3 f9 7c a5 e3 .h..@.@......|.. 0020 f9 76 01 f4 01 f4 00 54 9b 9f b5 e1 a1 a3 3c 74 .v.....T....... 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 19 (326 bytes on wire, 326 bytes captured) Arrival Time: Nov 29, 2010 11:34:41.746003000 [Time delta from previous captured frame: 0.000030000 seconds] [Time delta from previous displayed frame: 0.000030000 seconds] [Time since reference or first frame: 10.623529000 seconds] Frame Number: 19 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfafa [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x9d57 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: EF18C30DB03A583B Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0xEF18C30DB03A583B Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 c8 4c 75 18 34 40 00 0c 29 96 68 b2 08 00 45 00 .Lu.4@..).h...E. 0010 01 38 00 00 40 00 40 11 fa fa a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 76 01 f4 01 f4 01 24 9d 57 ef 18 c3 0d b0 3a .v.....$.W.....: 0030 58 3b 00 00 00 00 00 00 00 00 01 10 02 00 00 00 X;.............. 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 ef 18 c3 0d b0 3a .....|.........: 0060 58 3b 03 00 00 24 00 01 00 00 80 01 00 07 80 0e X;...$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 20 (146 bytes on wire, 146 bytes captured) Arrival Time: Nov 29, 2010 11:34:41.749209000 [Time delta from previous captured frame: 0.003206000 seconds] [Time delta from previous displayed frame: 0.003206000 seconds] [Time since reference or first frame: 10.626735000 seconds] Frame Number: 20 Frame Length: 146 bytes Capture Length: 146 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: c8:4c:75:18:34:40 (c8:4c:75:18:34:40), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.118 (165.227.249.118), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00) 1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x005c (92) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7b92 [correct] [Good: True] [Bad : False] Source: 165.227.249.118 (165.227.249.118) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0xcb50 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: EF18C30DB03A583B Responder cookie: 431D909B96A228DF Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE 0000 00 0c 29 96 68 b2 c8 4c 75 18 34 40 08 00 45 c0 ..).h..Lu.4@..E. 0010 00 84 00 5c 00 00 ff 11 7b 92 a5 e3 f9 76 a5 e3 ...\....{....v.. 0020 f9 7c 01 f4 01 f4 00 70 cb 50 ef 18 c3 0d b0 3a .|.....p.P.....: 0030 58 3b 43 1d 90 9b 96 a2 28 df 01 10 02 00 00 00 X;C.....(....... 0040 00 00 00 00 00 68 0d 00 00 38 00 00 00 01 00 00 .....h...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 70 80 00 00 ............p... 0080 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0090 45 2f E/ Frame 21 (270 bytes on wire, 270 bytes captured) Arrival Time: Nov 29, 2010 11:34:41.753050000 [Time delta from previous captured frame: 0.003841000 seconds] [Time delta from previous displayed frame: 0.003841000 seconds] [Time since reference or first frame: 10.630576000 seconds] Frame Number: 21 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb32 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x3f7a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: EF18C30DB03A583B Responder cookie: 431D909B96A228DF Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (RFC 3947) (20) Payload length: 20 Nonce Data NAT-D (RFC 3947) payload Next payload: NAT-D (RFC 3947) (20) Payload length: 24 Hash of address and port: F7E63EB782E55BED72B7226FBCD2BB0A0F08CB2B NAT-D (RFC 3947) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: 703FE8BA34AA6CAB5A89B0DE38FA280D55FD5B86 0000 c8 4c 75 18 34 40 00 0c 29 96 68 b2 08 00 45 00 .Lu.4@..).h...E. 0010 01 00 00 00 40 00 40 11 fb 32 a5 e3 f9 7c a5 e3 ....@.@..2...|.. 0020 f9 76 01 f4 01 f4 00 ec 3f 7a ef 18 c3 0d b0 3a .v......?z.....: 0030 58 3b 43 1d 90 9b 96 a2 28 df 04 10 02 00 00 00 X;C.....(....... 0040 00 00 00 00 00 e4 0a 00 00 84 1c a8 c0 16 a0 30 ...............0 0050 fa 49 b4 9a a2 1e 47 6c 57 68 d6 5d 6d 33 83 8b .I....GlWh.]m3.. 0060 83 01 b1 c2 93 01 ac a4 d9 97 51 9d 77 34 00 39 ..........Q.w4.9 0070 d9 5e f8 61 7f 36 78 7b 13 3e 6c ae 10 b5 44 eb .^.a.6x{.>l...D. 0080 da 50 3a c3 65 4e ef 12 17 fe 5e b7 64 e2 89 51 .P:.eN....^.d..Q 0090 b1 c4 95 ec c6 c4 20 e5 57 8f a1 fb a8 cf 35 4b ...... .W.....5K 00a0 cb d8 a7 ec 56 c8 97 df a2 9e 03 ae 7e 3f 42 32 ....V.......~?B2 00b0 0e c3 16 ab 31 58 c6 86 9b b8 38 8d 34 45 7b 94 ....1X....8.4E{. 00c0 11 73 e1 4a 3f ae 7f 19 94 ee 14 00 00 14 94 55 .s.J?..........U 00d0 f0 a1 42 e1 24 7f 86 e6 b9 4b 1c 8e 26 04 14 00 ..B.$....K..&... 00e0 00 18 f7 e6 3e b7 82 e5 5b ed 72 b7 22 6f bc d2 ....>...[.r."o.. 00f0 bb 0a 0f 08 cb 2b 00 00 00 18 70 3f e8 ba 34 aa .....+....p?..4. 0100 6c ab 5a 89 b0 de 38 fa 28 0d 55 fd 5b 86 l.Z...8.(.U.[. Frame 22 (270 bytes on wire, 270 bytes captured) Arrival Time: Nov 29, 2010 11:34:41.753076000 [Time delta from previous captured frame: 0.000026000 seconds] [Time delta from previous displayed frame: 0.000026000 seconds] [Time since reference or first frame: 10.630602000 seconds] Frame Number: 22 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb32 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x3f7a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: EF18C30DB03A583B Responder cookie: 431D909B96A228DF Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (RFC 3947) (20) Payload length: 20 Nonce Data NAT-D (RFC 3947) payload Next payload: NAT-D (RFC 3947) (20) Payload length: 24 Hash of address and port: F7E63EB782E55BED72B7226FBCD2BB0A0F08CB2B NAT-D (RFC 3947) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: 703FE8BA34AA6CAB5A89B0DE38FA280D55FD5B86 0000 c8 4c 75 18 34 40 00 0c 29 96 68 b2 08 00 45 00 .Lu.4@..).h...E. 0010 01 00 00 00 40 00 40 11 fb 32 a5 e3 f9 7c a5 e3 ....@.@..2...|.. 0020 f9 76 01 f4 01 f4 00 ec 3f 7a ef 18 c3 0d b0 3a .v......?z.....: 0030 58 3b 43 1d 90 9b 96 a2 28 df 04 10 02 00 00 00 X;C.....(....... 0040 00 00 00 00 00 e4 0a 00 00 84 1c a8 c0 16 a0 30 ...............0 0050 fa 49 b4 9a a2 1e 47 6c 57 68 d6 5d 6d 33 83 8b .I....GlWh.]m3.. 0060 83 01 b1 c2 93 01 ac a4 d9 97 51 9d 77 34 00 39 ..........Q.w4.9 0070 d9 5e f8 61 7f 36 78 7b 13 3e 6c ae 10 b5 44 eb .^.a.6x{.>l...D. 0080 da 50 3a c3 65 4e ef 12 17 fe 5e b7 64 e2 89 51 .P:.eN....^.d..Q 0090 b1 c4 95 ec c6 c4 20 e5 57 8f a1 fb a8 cf 35 4b ...... .W.....5K 00a0 cb d8 a7 ec 56 c8 97 df a2 9e 03 ae 7e 3f 42 32 ....V.......~?B2 00b0 0e c3 16 ab 31 58 c6 86 9b b8 38 8d 34 45 7b 94 ....1X....8.4E{. 00c0 11 73 e1 4a 3f ae 7f 19 94 ee 14 00 00 14 94 55 .s.J?..........U 00d0 f0 a1 42 e1 24 7f 86 e6 b9 4b 1c 8e 26 04 14 00 ..B.$....K..&... 00e0 00 18 f7 e6 3e b7 82 e5 5b ed 72 b7 22 6f bc d2 ....>...[.r."o.. 00f0 bb 0a 0f 08 cb 2b 00 00 00 18 70 3f e8 ba 34 aa .....+....p?..4. 0100 6c ab 5a 89 b0 de 38 fa 28 0d 55 fd 5b 86 l.Z...8.(.U.[. Frame 23 (346 bytes on wire, 346 bytes captured) Arrival Time: Nov 29, 2010 11:34:41.782633000 [Time delta from previous captured frame: 0.029557000 seconds] [Time delta from previous displayed frame: 0.029557000 seconds] [Time since reference or first frame: 10.660159000 seconds] Frame Number: 23 Frame Length: 346 bytes Capture Length: 346 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: c8:4c:75:18:34:40 (c8:4c:75:18:34:40), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.118 (165.227.249.118), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00) 1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x005d (93) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7ac9 [correct] [Good: True] [Bad : False] Source: 165.227.249.118 (165.227.249.118) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xa5d0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: EF18C30DB03A583B Responder cookie: 431D909B96A228DF Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 24 Nonce Data Vendor ID: CISCO-UNITY-1.0 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: CISCO-UNITY-1.0 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID: B6DA378696A328DF81AA9E0D5750D6C9 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: B6DA378696A328DF81AA9E0D5750D6C9 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NAT-D (RFC 3947) (20) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt NAT-D (RFC 3947) payload Next payload: NAT-D (RFC 3947) (20) Payload length: 24 Hash of address and port: 703FE8BA34AA6CAB5A89B0DE38FA280D55FD5B86 NAT-D (RFC 3947) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: F7E63EB782E55BED72B7226FBCD2BB0A0F08CB2B 0000 00 0c 29 96 68 b2 c8 4c 75 18 34 40 08 00 45 c0 ..).h..Lu.4@..E. 0010 01 4c 00 5d 00 00 ff 11 7a c9 a5 e3 f9 76 a5 e3 .L.]....z....v.. 0020 f9 7c 01 f4 01 f4 01 38 a5 d0 ef 18 c3 0d b0 3a .|.....8.......: 0030 58 3b 43 1d 90 9b 96 a2 28 df 04 10 02 00 00 00 X;C.....(....... 0040 00 00 00 00 01 30 0a 00 00 84 6a 77 05 c1 24 f5 .....0....jw..$. 0050 97 a5 a8 d9 61 b8 c4 c8 0d d5 be 08 67 57 79 7d ....a.......gWy} 0060 36 f0 f3 7a ee b6 d9 46 b9 92 9c 18 10 b7 09 be 6..z...F........ 0070 bb fd 1d 95 c4 00 65 11 9f 7b 46 d6 1d 8c 79 3e ......e..{F...y> 0080 8f c4 8a 6c b0 40 d5 4f 90 0b f8 be 7c 29 ff 75 ...l.@.O....|).u 0090 31 b8 5f d5 59 db 68 95 17 10 5c f5 b1 e6 df b5 1._.Y.h...\..... 00a0 19 20 a0 13 86 9c dd 0c cb 73 ba e5 2e 2d 6c 51 . .......s...-lQ 00b0 00 e2 44 ea a5 42 e2 38 62 93 75 46 7a 2e c2 82 ..D..B.8b.uFz... 00c0 64 29 22 81 f0 d1 e7 d4 85 f2 0d 00 00 18 d4 a2 d)"............. 00d0 40 78 68 91 ca 81 4b c8 df 33 d5 4c 74 24 5c 7a @xh...K..3.Lt$\z 00e0 45 53 0d 00 00 14 12 f5 f2 8c 45 71 68 a9 70 2d ES........Eqh.p- 00f0 9f e2 74 cc 01 00 0d 00 00 14 af ca d7 13 68 a1 ..t...........h. 0100 f1 c9 6b 86 96 fc 77 57 01 00 0d 00 00 14 b6 da ..k...wW........ 0110 37 86 96 a3 28 df 81 aa 9e 0d 57 50 d6 c9 14 00 7...(.....WP.... 0120 00 0c 09 00 26 89 df d6 b7 12 14 00 00 18 70 3f ....&.........p? 0130 e8 ba 34 aa 6c ab 5a 89 b0 de 38 fa 28 0d 55 fd ..4.l.Z...8.(.U. 0140 5b 86 00 00 00 18 f7 e6 3e b7 82 e5 5b ed 72 b7 [.......>...[.r. 0150 22 6f bc d2 bb 0a 0f 08 cb 2b "o.......+ Frame 24 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 29, 2010 11:34:41.786493000 [Time delta from previous captured frame: 0.003860000 seconds] [Time delta from previous displayed frame: 0.003860000 seconds] [Time since reference or first frame: 10.664019000 seconds] Frame Number: 24 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbba [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xa24e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: EF18C30DB03A583B Responder cookie: 431D909B96A228DF Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 c8 4c 75 18 34 40 00 0c 29 96 68 b2 08 00 45 00 .Lu.4@..).h...E. 0010 00 78 00 00 40 00 40 11 fb ba a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 76 01 f4 01 f4 00 64 a2 4e ef 18 c3 0d b0 3a .v.....d.N.....: 0030 58 3b 43 1d 90 9b 96 a2 28 df 05 10 02 01 00 00 X;C.....(....... 0040 00 00 00 00 00 5c 9c 6d c0 23 75 01 0c c7 75 d7 .....\.m.#u...u. 0050 07 16 09 64 b5 77 06 83 40 b1 97 a6 d0 39 d4 33 ...d.w..@....9.3 0060 9e 7e 13 21 a7 b2 40 e8 fe 6f 34 a2 f6 e3 6f 72 .~.!..@..o4...or 0070 d8 6c 9d 31 fb 46 ac f4 2f 1e 07 bd 97 a4 c5 c6 .l.1.F../....... 0080 ec 15 73 f1 e1 b9 ..s... Frame 25 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 29, 2010 11:34:41.786523000 [Time delta from previous captured frame: 0.000030000 seconds] [Time delta from previous displayed frame: 0.000030000 seconds] [Time since reference or first frame: 10.664049000 seconds] Frame Number: 25 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbba [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xa24e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: EF18C30DB03A583B Responder cookie: 431D909B96A228DF Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 c8 4c 75 18 34 40 00 0c 29 96 68 b2 08 00 45 00 .Lu.4@..).h...E. 0010 00 78 00 00 40 00 40 11 fb ba a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 76 01 f4 01 f4 00 64 a2 4e ef 18 c3 0d b0 3a .v.....d.N.....: 0030 58 3b 43 1d 90 9b 96 a2 28 df 05 10 02 01 00 00 X;C.....(....... 0040 00 00 00 00 00 5c 9c 6d c0 23 75 01 0c c7 75 d7 .....\.m.#u...u. 0050 07 16 09 64 b5 77 06 83 40 b1 97 a6 d0 39 d4 33 ...d.w..@....9.3 0060 9e 7e 13 21 a7 b2 40 e8 fe 6f 34 a2 f6 e3 6f 72 .~.!..@..o4...or 0070 d8 6c 9d 31 fb 46 ac f4 2f 1e 07 bd 97 a4 c5 c6 .l.1.F../....... 0080 ec 15 73 f1 e1 b9 ..s... Frame 26 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 29, 2010 11:34:41.788312000 [Time delta from previous captured frame: 0.001789000 seconds] [Time delta from previous displayed frame: 0.001789000 seconds] [Time since reference or first frame: 10.665838000 seconds] Frame Number: 26 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: c8:4c:75:18:34:40 (c8:4c:75:18:34:40), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.118 (165.227.249.118), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00) 1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x005e (94) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7b9c [correct] [Good: True] [Bad : False] Source: 165.227.249.118 (165.227.249.118) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x1b27 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: B5E1A1A33C74951D Responder cookie: 431D909BCF582C5A Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xfdc8e165 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 96 68 b2 c8 4c 75 18 34 40 08 00 45 c0 ..).h..Lu.4@..E. 0010 00 78 00 5e 00 00 ff 11 7b 9c a5 e3 f9 76 a5 e3 .x.^....{....v.. 0020 f9 7c 01 f4 01 f4 00 64 1b 27 b5 e1 a1 a3 3c 74 .|.....d.'.....p[..K.. 00a0 c0 4b 2e 14 8a fe 7f 06 3c a9 8f 9e a7 3d 22 80 .K......<....=". 00b0 53 2c d7 3f c5 fc 06 0c d5 7b ad 36 09 16 c0 c0 S,.?.....{.6.... 00c0 87 99 8a 48 2d 90 1b 49 70 ee 31 38 2b 8c b6 1e ...H-..Ip.18+... 00d0 91 60 fb ea a9 77 a5 ca 8c 5e a7 d2 12 c4 f5 97 .`...w...^...... 00e0 aa dc 1a 6d 61 b5 7d 01 e6 b1 c5 b1 ed e4 78 45 ...ma.}.......xE 00f0 4f 65 15 b9 08 26 48 8e c6 13 0e ac 91 cc 4d 15 Oe...&H.......M. 0100 6b b4 7a 71 e9 28 f4 1f 43 0c 18 f1 48 7e de 76 k.zq.(..C...H~.v 0110 a0 34 3e 22 79 8b 10 bb 61 f9 05 8c 13 cc 8c ef .4>"y...a....... 0120 7a 9b b3 0f 66 16 7d e1 da 07 68 05 28 f6 51 bf z...f.}...h.(.Q. 0130 5b 33 3a 4f 55 40 d3 dd 21 c8 50 67 d0 b8 50 1c [3:OU@..!.Pg..P. 0140 ba cb 72 c6 ac 79 4d ab ee 65 e4 f0 84 d4 8e 87 ..r..yM..e...... 0150 6f 22 69 82 67 45 0f 35 a2 9d 31 20 4e 5f 6d 5e o"i.gE.5..1 N_m^ 0160 e7 56 8c d5 76 68 a8 8f a5 ae d4 21 f6 80 09 fe .V..vh.....!.... 0170 50 44 77 10 8e 3f PDw..? Frame 31 (102 bytes on wire, 102 bytes captured) Arrival Time: Nov 29, 2010 11:34:41.915849000 [Time delta from previous captured frame: 0.019193000 seconds] [Time delta from previous displayed frame: 0.019193000 seconds] [Time since reference or first frame: 10.793375000 seconds] Frame Number: 31 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbda [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x8b08 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: EF18C30DB03A583B Responder cookie: 431D909B96A228DF Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x5df04bf3 Length: 60 Encrypted payload (32 bytes) 0000 c8 4c 75 18 34 40 00 0c 29 96 68 b2 08 00 45 00 .Lu.4@..).h...E. 0010 00 58 00 00 40 00 40 11 fb da a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 76 01 f4 01 f4 00 44 8b 08 ef 18 c3 0d b0 3a .v.....D.......: 0030 58 3b 43 1d 90 9b 96 a2 28 df 08 10 20 01 5d f0 X;C.....(... .]. 0040 4b f3 00 00 00 3c a8 f6 da 59 70 78 a4 1d b9 4b K....<...Ypx...K 0050 d9 bf 1e 92 ee 81 4b 41 1d 84 b3 8c d0 5d 0f d8 ......KA.....].. 0060 d2 6a 70 31 9a 88 .jp1.. Frame 32 (102 bytes on wire, 102 bytes captured) Arrival Time: Nov 29, 2010 11:34:41.915875000 [Time delta from previous captured frame: 0.000026000 seconds] [Time delta from previous displayed frame: 0.000026000 seconds] [Time since reference or first frame: 10.793401000 seconds] Frame Number: 32 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbda [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x8b08 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: EF18C30DB03A583B Responder cookie: 431D909B96A228DF Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x5df04bf3 Length: 60 Encrypted payload (32 bytes) 0000 c8 4c 75 18 34 40 00 0c 29 96 68 b2 08 00 45 00 .Lu.4@..).h...E. 0010 00 58 00 00 40 00 40 11 fb da a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 76 01 f4 01 f4 00 44 8b 08 ef 18 c3 0d b0 3a .v.....D.......: 0030 58 3b 43 1d 90 9b 96 a2 28 df 08 10 20 01 5d f0 X;C.....(... .]. 0040 4b f3 00 00 00 3c a8 f6 da 59 70 78 a4 1d b9 4b K....<...Ypx...K 0050 d9 bf 1e 92 ee 81 4b 41 1d 84 b3 8c d0 5d 0f d8 ......KA.....].. 0060 d2 6a 70 31 9a 88 .jp1.. Frame 33 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 29, 2010 11:34:42.175927000 [Time delta from previous captured frame: 0.260052000 seconds] [Time delta from previous displayed frame: 0.260052000 seconds] [Time since reference or first frame: 11.053453000 seconds] Frame Number: 33 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0004 (4) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b95 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) Encapsulating Security Payload ESP SPI: 0xef6c22eb ESP Sequence: 1 0000 c8 4c 75 18 34 40 00 0c 29 96 68 b2 08 00 45 00 .Lu.4@..).h...E. 0010 00 78 00 04 00 00 f0 32 8b 95 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 76 ef 6c 22 eb 00 00 00 01 36 6f 06 2b ed c9 .v.l".....6o.+.. 0030 e8 9d 03 eb 45 b4 9e 33 cf 03 46 b2 a5 d6 35 9d ....E..3..F...5. 0040 55 1e 2c 76 3e 58 cb d7 77 ee e2 19 ba 1e 0a 84 U.,v>X..w....... 0050 5f 64 a6 75 15 62 28 84 e9 1a ea fa 63 47 82 3f _d.u.b(.....cG.? 0060 0d 27 1b 80 3d 3f 13 1d d2 7a e3 d9 86 8f 03 d4 .'..=?...z...... 0070 37 fc 05 6a 59 fe 7e 40 6c 38 0d 7d fc 50 62 e1 7..jY.~@l8.}.Pb. 0080 e8 f5 34 80 dd 9e ..4... Frame 34 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 29, 2010 11:34:42.175951000 [Time delta from previous captured frame: 0.000024000 seconds] [Time delta from previous displayed frame: 0.000024000 seconds] [Time since reference or first frame: 11.053477000 seconds] Frame Number: 34 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0004 (4) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b95 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) Encapsulating Security Payload ESP SPI: 0xef6c22eb ESP Sequence: 1 0000 c8 4c 75 18 34 40 00 0c 29 96 68 b2 08 00 45 00 .Lu.4@..).h...E. 0010 00 78 00 04 00 00 f0 32 8b 95 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 76 ef 6c 22 eb 00 00 00 01 36 6f 06 2b ed c9 .v.l".....6o.+.. 0030 e8 9d 03 eb 45 b4 9e 33 cf 03 46 b2 a5 d6 35 9d ....E..3..F...5. 0040 55 1e 2c 76 3e 58 cb d7 77 ee e2 19 ba 1e 0a 84 U.,v>X..w....... 0050 5f 64 a6 75 15 62 28 84 e9 1a ea fa 63 47 82 3f _d.u.b(.....cG.? 0060 0d 27 1b 80 3d 3f 13 1d d2 7a e3 d9 86 8f 03 d4 .'..=?...z...... 0070 37 fc 05 6a 59 fe 7e 40 6c 38 0d 7d fc 50 62 e1 7..jY.~@l8.}.Pb. 0080 e8 f5 34 80 dd 9e ..4... Frame 35 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 29, 2010 11:34:42.178760000 [Time delta from previous captured frame: 0.002809000 seconds] [Time delta from previous displayed frame: 0.002809000 seconds] [Time since reference or first frame: 11.056286000 seconds] Frame Number: 35 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: c8:4c:75:18:34:40 (c8:4c:75:18:34:40), Dst: 00:0c:41:d5:fc:9e (00:0c:41:d5:fc:9e) Destination: 00:0c:41:d5:fc:9e (00:0c:41:d5:fc:9e) Address: 00:0c:41:d5:fc:9e (00:0c:41:d5:fc:9e) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.118 (165.227.249.118), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0061 (97) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7c38 [correct] [Good: True] [Bad : False] Source: 165.227.249.118 (165.227.249.118) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0x2156440d ESP Sequence: 1 0000 00 0c 41 d5 fc 9e c8 4c 75 18 34 40 08 00 45 00 ..A....Lu.4@..E. 0010 00 78 00 61 00 00 ff 32 7c 38 a5 e3 f9 76 a5 e3 .x.a...2|8...v.. 0020 f9 7c 21 56 44 0d 00 00 00 01 c6 8a bb b1 3f b2 .|!VD.........?. 0030 33 70 dd cc 64 ff 46 ae 6c 7a 2b fa eb 40 0e 8b 3p..d.F.lz+..@.. 0040 9c 38 13 9c e8 98 3e 3e fa f2 01 a4 53 ed e2 84 .8....>>....S... 0050 c8 c3 bb 7a 74 ab 79 f7 0a 76 5f 27 50 cd 13 16 ...zt.y..v_'P... 0060 ce 5b 28 e3 72 27 c2 c4 ad c9 e4 ce e1 24 29 91 .[(.r'.......$). 0070 8f 36 a5 3a 0a 5d 43 70 0d 35 0f 1c 7d c4 5e a3 .6.:.]Cp.5..}.^. 0080 da 65 50 54 bd b9 .ePT.. Frame 36 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 29, 2010 11:34:42.178780000 [Time delta from previous captured frame: 0.000020000 seconds] [Time delta from previous displayed frame: 0.000020000 seconds] [Time since reference or first frame: 11.056306000 seconds] Frame Number: 36 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:41:d5:fc:9e (00:0c:41:d5:fc:9e), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:41:d5:fc:9e (00:0c:41:d5:fc:9e) Address: 00:0c:41:d5:fc:9e (00:0c:41:d5:fc:9e) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.118 (165.227.249.118), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0061 (97) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 254 Protocol: ESP (0x32) Header checksum: 0x7d38 [correct] [Good: True] [Bad : False] Source: 165.227.249.118 (165.227.249.118) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0x2156440d ESP Sequence: 1 0000 00 0c 29 96 68 b2 00 0c 41 d5 fc 9e 08 00 45 00 ..).h...A.....E. 0010 00 78 00 61 00 00 fe 32 7d 38 a5 e3 f9 76 a5 e3 .x.a...2}8...v.. 0020 f9 7c 21 56 44 0d 00 00 00 01 c6 8a bb b1 3f b2 .|!VD.........?. 0030 33 70 dd cc 64 ff 46 ae 6c 7a 2b fa eb 40 0e 8b 3p..d.F.lz+..@.. 0040 9c 38 13 9c e8 98 3e 3e fa f2 01 a4 53 ed e2 84 .8....>>....S... 0050 c8 c3 bb 7a 74 ab 79 f7 0a 76 5f 27 50 cd 13 16 ...zt.y..v_'P... 0060 ce 5b 28 e3 72 27 c2 c4 ad c9 e4 ce e1 24 29 91 .[(.r'.......$). 0070 8f 36 a5 3a 0a 5d 43 70 0d 35 0f 1c 7d c4 5e a3 .6.:.]Cp.5..}.^. 0080 da 65 50 54 bd b9 .ePT.. Frame 37 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 29, 2010 11:34:42.741717000 [Time delta from previous captured frame: 0.562937000 seconds] [Time delta from previous displayed frame: 0.562937000 seconds] [Time since reference or first frame: 11.619243000 seconds] Frame Number: 37 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Destination: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) Address: c8:4c:75:18:34:40 (c8:4c:75:18:34:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0005 (5) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b94 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) Encapsulating Security Payload ESP SPI: 0xef6c22eb ESP Sequence: 2 0000 c8 4c 75 18 34 40 00 0c 29 96 68 b2 08 00 45 00 .Lu.4@..).h...E. 0010 00 78 00 05 00 00 f0 32 8b 94 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 76 ef 6c 22 eb 00 00 00 02 66 a9 7d 51 b3 90 .v.l".....f.}Q.. 0030 41 91 30 c6 77 fc 3e 4f 89 db d6 1f 5a 7d 33 09 A.0.w.>O....Z}3. 0040 cc 25 4e c3 cc 5c b3 f6 f1 19 f1 e0 a7 44 5e 1a .%N..\.......D^. 0050 c2 ed 30 a4 3c 61 39 47 9c 05 46 e8 d6 38 c4 9d ..0.O....Z}3. 0040 cc 25 4e c3 cc 5c b3 f6 f1 19 f1 e0 a7 44 5e 1a .%N..\.......D^. 0050 c2 ed 30 a4 3c 61 39 47 9c 05 46 e8 d6 38 c4 9d ..0....{ 0050 93 6e 9d db b3 19 60 74 3f 21 4a f7 31 9a f8 da .n....`t?!J.1... 0060 e7 eb 7e cc b8 23 03 31 c2 51 cc e7 56 da 6a 57 ..~..#.1.Q..V.jW 0070 2d 00 a0 1c 43 f4 85 0e 12 cd 48 67 92 60 f9 6f -...C.....Hg.`.o 0080 94 9c 60 28 8a 8c ..`(.. Frame 40 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 29, 2010 11:34:42.744329000 [Time delta from previous captured frame: 0.000026000 seconds] [Time delta from previous displayed frame: 0.000026000 seconds] [Time since reference or first frame: 11.621855000 seconds] Frame Number: 40 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:41:d5:fc:9e (00:0c:41:d5:fc:9e), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:41:d5:fc:9e (00:0c:41:d5:fc:9e) Address: 00:0c:41:d5:fc:9e (00:0c:41:d5:fc:9e) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.118 (165.227.249.118), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0062 (98) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 254 Protocol: ESP (0x32) Header checksum: 0x7d37 [correct] [Good: True] [Bad : False] Source: 165.227.249.118 (165.227.249.118) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0x2156440d ESP Sequence: 2 0000 00 0c 29 96 68 b2 00 0c 41 d5 fc 9e 08 00 45 00 ..).h...A.....E. 0010 00 78 00 62 00 00 fe 32 7d 37 a5 e3 f9 76 a5 e3 .x.b...2}7...v.. 0020 f9 7c 21 56 44 0d 00 00 00 02 2a dc 9e 35 a2 55 .|!VD.....*..5.U 0030 7b a7 8c ee c7 43 5d 6d 12 8a be a9 20 8c 1f 63 {....C]m.... ..c 0040 06 f9 aa 72 c6 af 64 66 fa 37 13 3e d8 a4 e6 7b ...r..df.7.>...{ 0050 93 6e 9d db b3 19 60 74 3f 21 4a f7 31 9a f8 da .n....`t?!J.1... 0060 e7 eb 7e cc b8 23 03 31 c2 51 cc e7 56 da 6a 57 ..~..#.1.Q..V.jW 0070 2d 00 a0 1c 43 f4 85 0e 12 cd 48 67 92 60 f9 6f -...C.....Hg.`.o 0080 94 9c 60 28 8a 8c ..`(..