Frame 1 (326 bytes on wire, 326 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.258055000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:00:00:00:00:12 (00:00:00:00:00:12) Destination: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.120 (165.227.249.120) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaf8 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.120 (165.227.249.120) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xb091 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 1EBD63AFF557393A Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0x1EBD63AFF557393A Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 00 00 00 00 12 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 01 38 00 00 40 00 40 11 fa f8 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 78 01 f4 01 f4 01 24 b0 91 1e bd 63 af f5 57 .x.....$....c..W 0030 39 3a 00 00 00 00 00 00 00 00 01 10 02 00 00 00 9:.............. 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 1e bd 63 af f5 57 .....|......c..W 0060 39 3a 03 00 00 24 00 01 00 00 80 01 00 07 80 0e 9:...$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 2 (326 bytes on wire, 326 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.258065000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 0.000010000 seconds] Frame Number: 2 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:00:00:00:00:12 (00:00:00:00:00:12) Destination: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.120 (165.227.249.120) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaf8 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.120 (165.227.249.120) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xb091 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 1EBD63AFF557393A Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0x1EBD63AFF557393A Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 00 00 00 00 12 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 01 38 00 00 40 00 40 11 fa f8 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 78 01 f4 01 f4 01 24 b0 91 1e bd 63 af f5 57 .x.....$....c..W 0030 39 3a 00 00 00 00 00 00 00 00 01 10 02 00 00 00 9:.............. 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 1e bd 63 af f5 57 .....|......c..W 0060 39 3a 03 00 00 24 00 01 00 00 80 01 00 07 80 0e 9:...$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 3 (174 bytes on wire, 174 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.300822000 [Time delta from previous captured frame: 0.042757000 seconds] [Time delta from previous displayed frame: 0.042757000 seconds] [Time since reference or first frame: 0.042767000 seconds] Frame Number: 3 Frame Length: 174 bytes Capture Length: 174 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:00:00:00:00:12 (00:00:00:00:00:12), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.120 (165.227.249.120), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 160 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb90 [correct] [Good: True] [Bad : False] Source: 165.227.249.120 (165.227.249.120) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 140 Checksum: 0xcaf3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 1EBD63AFF557393A Responder cookie: 3E2BD62E09A2BB4A Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 132 Security Association payload Next payload: Vendor ID (13) Payload length: 64 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 52 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 1 SPI: 0x0000000000000000 Transform payload # 0 Next payload: NONE (0) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 48 f8 2f 00 00 00 00 00 12 08 00 45 00 ..)H./........E. 0010 00 a0 00 00 40 00 40 11 fb 90 a5 e3 f9 78 a5 e3 ....@.@......x.. 0020 f9 7c 01 f4 01 f4 00 8c ca f3 1e bd 63 af f5 57 .|..........c..W 0030 39 3a 3e 2b d6 2e 09 a2 bb 4a 01 10 02 00 00 00 9:>+.....J...... 0040 00 00 00 00 00 84 0d 00 00 40 00 00 00 01 00 00 .........@...... 0050 00 01 00 00 00 34 00 01 08 01 00 00 00 00 00 00 .....4.......... 0060 00 00 00 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 0d 00 00 14 af ca d7 13 68 a1 ....p.........h. 0090 f1 c9 6b 86 96 fc 77 57 01 00 00 00 00 14 70 03 ..k...wW......p. 00a0 cb c1 09 7d be 9c 26 00 ba 69 83 bc 8b 35 ...}..&..i...5 Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.307165000 [Time delta from previous captured frame: 0.006343000 seconds] [Time delta from previous displayed frame: 0.006343000 seconds] [Time since reference or first frame: 0.049110000 seconds] Frame Number: 4 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:00:00:00:00:12 (00:00:00:00:00:12) Destination: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.120 (165.227.249.120) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb60 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.120 (165.227.249.120) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xe951 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 1EBD63AFF557393A Responder cookie: 3E2BD62E09A2BB4A Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 00 00 00 00 12 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 d0 00 00 40 00 40 11 fb 60 a5 e3 f9 7c a5 e3 ....@.@..`...|.. 0020 f9 78 01 f4 01 f4 00 bc e9 51 1e bd 63 af f5 57 .x.......Q..c..W 0030 39 3a 3e 2b d6 2e 09 a2 bb 4a 04 10 02 00 00 00 9:>+.....J...... 0040 00 00 00 00 00 b4 0a 00 00 84 d8 95 db 94 37 9a ..............7. 0050 20 7c 86 79 f3 23 dd 63 cd aa 24 4f 93 54 6b 86 |.y.#.c..$O.Tk. 0060 de 9a 32 b6 78 26 bb 0f 4e 87 96 40 a8 df 08 66 ..2.x&..N..@...f 0070 0a 99 62 f2 25 bc 51 32 54 0e 0c 12 32 50 f8 f3 ..b.%.Q2T...2P.. 0080 3f a9 1d 75 82 45 49 4c fc 57 3e ce e3 6e a9 c3 ?..u.EIL.W>..n.. 0090 44 87 88 38 b9 e0 c8 c1 67 11 68 b9 47 df df 5d D..8....g.h.G..] 00a0 3d e1 c0 8a f2 1b fc f6 e5 9d 72 1d 64 74 ad 0a =.........r.dt.. 00b0 60 45 30 88 33 a7 dc 8a a8 ca a6 05 f5 67 7e 37 `E0.3........g~7 00c0 5d fa 9c bf da 0c d8 dc 38 3b 00 00 00 14 4a 57 ].......8;....JW 00d0 4e 8c b7 e1 68 7a 13 35 e6 35 68 75 a5 b8 N...hz.5.5hu.. Frame 5 (222 bytes on wire, 222 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.307178000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 0.049123000 seconds] Frame Number: 5 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:00:00:00:00:12 (00:00:00:00:00:12) Destination: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.120 (165.227.249.120) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb60 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.120 (165.227.249.120) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xe951 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 1EBD63AFF557393A Responder cookie: 3E2BD62E09A2BB4A Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 00 00 00 00 12 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 d0 00 00 40 00 40 11 fb 60 a5 e3 f9 7c a5 e3 ....@.@..`...|.. 0020 f9 78 01 f4 01 f4 00 bc e9 51 1e bd 63 af f5 57 .x.......Q..c..W 0030 39 3a 3e 2b d6 2e 09 a2 bb 4a 04 10 02 00 00 00 9:>+.....J...... 0040 00 00 00 00 00 b4 0a 00 00 84 d8 95 db 94 37 9a ..............7. 0050 20 7c 86 79 f3 23 dd 63 cd aa 24 4f 93 54 6b 86 |.y.#.c..$O.Tk. 0060 de 9a 32 b6 78 26 bb 0f 4e 87 96 40 a8 df 08 66 ..2.x&..N..@...f 0070 0a 99 62 f2 25 bc 51 32 54 0e 0c 12 32 50 f8 f3 ..b.%.Q2T...2P.. 0080 3f a9 1d 75 82 45 49 4c fc 57 3e ce e3 6e a9 c3 ?..u.EIL.W>..n.. 0090 44 87 88 38 b9 e0 c8 c1 67 11 68 b9 47 df df 5d D..8....g.h.G..] 00a0 3d e1 c0 8a f2 1b fc f6 e5 9d 72 1d 64 74 ad 0a =.........r.dt.. 00b0 60 45 30 88 33 a7 dc 8a a8 ca a6 05 f5 67 7e 37 `E0.3........g~7 00c0 5d fa 9c bf da 0c d8 dc 38 3b 00 00 00 14 4a 57 ].......8;....JW 00d0 4e 8c b7 e1 68 7a 13 35 e6 35 68 75 a5 b8 N...hz.5.5hu.. Frame 6 (242 bytes on wire, 242 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.372778000 [Time delta from previous captured frame: 0.065600000 seconds] [Time delta from previous displayed frame: 0.065600000 seconds] [Time since reference or first frame: 0.114723000 seconds] Frame Number: 6 Frame Length: 242 bytes Capture Length: 242 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:00:00:00:00:12 (00:00:00:00:00:12), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.120 (165.227.249.120), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb4c [correct] [Good: True] [Bad : False] Source: 165.227.249.120 (165.227.249.120) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0xa44e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 1EBD63AFF557393A Responder cookie: 3E2BD62E09A2BB4A Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 20 Nonce Data Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 48 f8 2f 00 00 00 00 00 12 08 00 45 00 ..)H./........E. 0010 00 e4 00 00 40 00 40 11 fb 4c a5 e3 f9 78 a5 e3 ....@.@..L...x.. 0020 f9 7c 01 f4 01 f4 00 d0 a4 4e 1e bd 63 af f5 57 .|.......N..c..W 0030 39 3a 3e 2b d6 2e 09 a2 bb 4a 04 10 02 00 00 00 9:>+.....J...... 0040 00 00 00 00 00 c8 0a 00 00 84 8c 9b 20 a7 87 ca ............ ... 0050 3c 21 62 ec 53 c5 d1 ef 84 99 02 30 1c 4c 2f a5 +.....J...... 0040 00 00 00 00 00 5c fb d0 8c c3 66 00 f6 a5 66 66 .....\....f...ff 0050 70 4b 22 00 6a b7 9f ae b6 50 a2 7e 9a 01 f2 34 pK".j....P.~...4 0060 02 3a fb aa 0e 34 5c 86 22 c3 fb 3e 9b 33 12 23 .:...4\."..>.3.# 0070 5e 5e 8d 79 71 57 9a 28 7a 7c cd fb db dd 6c f0 ^^.yqW.(z|....l. 0080 46 c1 93 83 28 46 F...(F Frame 8 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.377892000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 0.119837000 seconds] Frame Number: 8 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:00:00:00:00:12 (00:00:00:00:00:12) Destination: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.120 (165.227.249.120) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb8 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.120 (165.227.249.120) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x9e54 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 1EBD63AFF557393A Responder cookie: 3E2BD62E09A2BB4A Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 00 00 00 00 12 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 78 00 00 40 00 40 11 fb b8 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 78 01 f4 01 f4 00 64 9e 54 1e bd 63 af f5 57 .x.....d.T..c..W 0030 39 3a 3e 2b d6 2e 09 a2 bb 4a 05 10 02 01 00 00 9:>+.....J...... 0040 00 00 00 00 00 5c fb d0 8c c3 66 00 f6 a5 66 66 .....\....f...ff 0050 70 4b 22 00 6a b7 9f ae b6 50 a2 7e 9a 01 f2 34 pK".j....P.~...4 0060 02 3a fb aa 0e 34 5c 86 22 c3 fb 3e 9b 33 12 23 .:...4\."..>.3.# 0070 5e 5e 8d 79 71 57 9a 28 7a 7c cd fb db dd 6c f0 ^^.yqW.(z|....l. 0080 46 c1 93 83 28 46 F...(F Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.472776000 [Time delta from previous captured frame: 0.094884000 seconds] [Time delta from previous displayed frame: 0.094884000 seconds] [Time since reference or first frame: 0.214721000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:00:00:00:00:12 (00:00:00:00:00:12), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.120 (165.227.249.120), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc8 [correct] [Good: True] [Bad : False] Source: 165.227.249.120 (165.227.249.120) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x2334 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 1EBD63AFF557393A Responder cookie: 3E2BD62E09A2BB4A Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 48 f8 2f 00 00 00 00 00 12 08 00 45 00 ..)H./........E. 0010 00 68 00 00 40 00 40 11 fb c8 a5 e3 f9 78 a5 e3 .h..@.@......x.. 0020 f9 7c 01 f4 01 f4 00 54 23 34 1e bd 63 af f5 57 .|.....T#4..c..W 0030 39 3a 3e 2b d6 2e 09 a2 bb 4a 05 10 02 01 00 00 9:>+.....J...... 0040 00 00 00 00 00 4c 4f e7 fa 90 83 87 2c 64 68 47 .....LO.....,dhG 0050 0b c5 57 fc 04 44 80 1e af b9 54 24 85 dd 1e 06 ..W..D....T$.... 0060 de 8b 3e 33 94 8f 02 f1 f9 99 9d b9 83 e0 a4 8b ..>3............ 0070 a6 bc 22 84 d7 f9 .."... Frame 10 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.482856000 [Time delta from previous captured frame: 0.010080000 seconds] [Time delta from previous displayed frame: 0.010080000 seconds] [Time since reference or first frame: 0.224801000 seconds] Frame Number: 10 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:00:00:00:00:12 (00:00:00:00:00:12), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.120 (165.227.249.120), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb8 [correct] [Good: True] [Bad : False] Source: 165.227.249.120 (165.227.249.120) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x73ae [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 1EBD63AFF557393A Responder cookie: 3E2BD62E09A2BB4A Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xeb46891c Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 48 f8 2f 00 00 00 00 00 12 08 00 45 00 ..)H./........E. 0010 00 78 00 00 40 00 40 11 fb b8 a5 e3 f9 78 a5 e3 .x..@.@......x.. 0020 f9 7c 01 f4 01 f4 00 64 73 ae 1e bd 63 af f5 57 .|.....ds...c..W 0030 39 3a 3e 2b d6 2e 09 a2 bb 4a 08 10 05 01 eb 46 9:>+.....J.....F 0040 89 1c 00 00 00 5c 23 b0 65 51 fc ff 60 af ab e5 .....\#.eQ..`... 0050 de 88 69 c9 97 19 d9 96 84 23 72 3a dd f9 bf 3b ..i......#r:...; 0060 2c 3b 70 f0 53 2a 71 de fe 18 ae 16 31 0b 4e 2c ,;p.S*q.....1.N, 0070 dd 19 e4 51 f0 90 7c f0 f1 65 57 f7 92 11 f0 0c ...Q..|..eW..... 0080 51 90 a2 70 e1 8a Q..p.. Frame 11 (518 bytes on wire, 518 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.497469000 [Time delta from previous captured frame: 0.014613000 seconds] [Time delta from previous displayed frame: 0.014613000 seconds] [Time since reference or first frame: 0.239414000 seconds] Frame Number: 11 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:00:00:00:00:12 (00:00:00:00:00:12) Destination: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.120 (165.227.249.120) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa38 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.120 (165.227.249.120) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0x4f44 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 1EBD63AFF557393A Responder cookie: 3E2BD62E09A2BB4A Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x4c17ffe2 Length: 476 Encrypted payload (448 bytes) 0000 00 00 00 00 00 12 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 01 f8 00 00 40 00 40 11 fa 38 a5 e3 f9 7c a5 e3 ....@.@..8...|.. 0020 f9 78 01 f4 01 f4 01 e4 4f 44 1e bd 63 af f5 57 .x......OD..c..W 0030 39 3a 3e 2b d6 2e 09 a2 bb 4a 08 10 20 01 4c 17 9:>+.....J.. .L. 0040 ff e2 00 00 01 dc 66 cb ca 68 1b ac c4 70 e1 46 ......f..h...p.F 0050 32 4d b5 90 0f 8b 07 24 a2 a4 21 2c 85 84 a0 c5 2M.....$..!,.... 0060 1c f7 ab 38 ee 17 77 90 a1 48 d4 ad aa 0b c9 f4 ...8..w..H...... 0070 82 ce 00 67 20 f4 73 8f 35 09 cf da e2 c2 27 e0 ...g .s.5.....'. 0080 89 82 fe 32 6f b9 fe 3d f4 3a bb c5 50 d5 93 a2 ...2o..=.:..P... 0090 58 97 0a 5f 9d 09 95 b5 8c 0d fd 8e fa 01 4d 10 X.._..........M. 00a0 90 aa 5c b8 33 c0 4d ee 73 7c 67 10 47 76 45 aa ..\.3.M.s|g.GvE. 00b0 7b af d2 87 a4 fc 61 69 67 0b 65 69 d6 33 b9 f2 {.....aig.ei.3.. 00c0 b1 f3 32 22 12 17 00 65 4e 0d fa ee 96 31 02 7c ..2"...eN....1.| 00d0 6c d2 e7 2e 6c 06 05 f5 7d 58 0d 59 67 1a 85 2e l...l...}X.Yg... 00e0 78 7d c8 fd 51 35 80 d0 9c 16 6d f8 bd 29 ca 7f x}..Q5....m..).. 00f0 b4 40 de 50 4b 87 a0 c7 10 c1 63 b5 d1 af 16 d0 .@.PK.....c..... 0100 e8 b6 75 75 9e 48 0f f2 38 07 83 57 ca a2 6f 96 ..uu.H..8..W..o. 0110 6d 02 08 b8 8a e0 d6 3b 7e 63 bf b0 60 40 14 63 m......;~c..`@.c 0120 d7 b0 1b c4 cc 32 02 c3 e0 e2 bc f1 9c 2d d4 cd .....2.......-.. 0130 2e 93 ad 7d 0f 3c 4d e2 41 9a 7d 5f 6e 91 cb 8b ...}..zp.... 0170 4e f0 49 a3 28 b3 6e 3b 38 f8 b5 2f de 24 79 cc N.I.(.n;8../.$y. 0180 e4 a2 ce 54 65 1f 24 9e 9f 41 e3 fa 47 b3 da ae ...Te.$..A..G... 0190 92 d7 a8 39 6b 05 8f 27 7c 8a fc f1 2c a6 14 18 ...9k..'|...,... 01a0 eb 33 ab a9 b7 be b6 08 6e 2a d7 69 85 c5 ee 66 .3......n*.i...f 01b0 8d 6f 41 ac 4a 31 f2 79 6f ed a1 0a 45 65 b3 5a .oA.J1.yo...Ee.Z 01c0 ae 35 b8 2d 5f 33 52 0a c6 f6 8d 2b 33 36 80 4d .5.-_3R....+36.M 01d0 a5 b5 78 fa 29 bb 84 f8 8c 37 64 bd 88 c1 6c e0 ..x.)....7d...l. 01e0 d0 3a 75 9c 9d ec 46 07 64 10 33 5f 48 c4 7d 28 .:u...F.d.3_H.}( 01f0 b5 c8 42 60 30 54 36 2e d2 62 63 3f 11 17 d2 a3 ..B`0T6..bc?.... 0200 09 3e b7 15 24 09 .>..$. Frame 12 (518 bytes on wire, 518 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.497482000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 0.239427000 seconds] Frame Number: 12 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:00:00:00:00:12 (00:00:00:00:00:12) Destination: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.120 (165.227.249.120) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa38 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.120 (165.227.249.120) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0x4f44 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 1EBD63AFF557393A Responder cookie: 3E2BD62E09A2BB4A Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x4c17ffe2 Length: 476 Encrypted payload (448 bytes) 0000 00 00 00 00 00 12 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 01 f8 00 00 40 00 40 11 fa 38 a5 e3 f9 7c a5 e3 ....@.@..8...|.. 0020 f9 78 01 f4 01 f4 01 e4 4f 44 1e bd 63 af f5 57 .x......OD..c..W 0030 39 3a 3e 2b d6 2e 09 a2 bb 4a 08 10 20 01 4c 17 9:>+.....J.. .L. 0040 ff e2 00 00 01 dc 66 cb ca 68 1b ac c4 70 e1 46 ......f..h...p.F 0050 32 4d b5 90 0f 8b 07 24 a2 a4 21 2c 85 84 a0 c5 2M.....$..!,.... 0060 1c f7 ab 38 ee 17 77 90 a1 48 d4 ad aa 0b c9 f4 ...8..w..H...... 0070 82 ce 00 67 20 f4 73 8f 35 09 cf da e2 c2 27 e0 ...g .s.5.....'. 0080 89 82 fe 32 6f b9 fe 3d f4 3a bb c5 50 d5 93 a2 ...2o..=.:..P... 0090 58 97 0a 5f 9d 09 95 b5 8c 0d fd 8e fa 01 4d 10 X.._..........M. 00a0 90 aa 5c b8 33 c0 4d ee 73 7c 67 10 47 76 45 aa ..\.3.M.s|g.GvE. 00b0 7b af d2 87 a4 fc 61 69 67 0b 65 69 d6 33 b9 f2 {.....aig.ei.3.. 00c0 b1 f3 32 22 12 17 00 65 4e 0d fa ee 96 31 02 7c ..2"...eN....1.| 00d0 6c d2 e7 2e 6c 06 05 f5 7d 58 0d 59 67 1a 85 2e l...l...}X.Yg... 00e0 78 7d c8 fd 51 35 80 d0 9c 16 6d f8 bd 29 ca 7f x}..Q5....m..).. 00f0 b4 40 de 50 4b 87 a0 c7 10 c1 63 b5 d1 af 16 d0 .@.PK.....c..... 0100 e8 b6 75 75 9e 48 0f f2 38 07 83 57 ca a2 6f 96 ..uu.H..8..W..o. 0110 6d 02 08 b8 8a e0 d6 3b 7e 63 bf b0 60 40 14 63 m......;~c..`@.c 0120 d7 b0 1b c4 cc 32 02 c3 e0 e2 bc f1 9c 2d d4 cd .....2.......-.. 0130 2e 93 ad 7d 0f 3c 4d e2 41 9a 7d 5f 6e 91 cb 8b ...}..zp.... 0170 4e f0 49 a3 28 b3 6e 3b 38 f8 b5 2f de 24 79 cc N.I.(.n;8../.$y. 0180 e4 a2 ce 54 65 1f 24 9e 9f 41 e3 fa 47 b3 da ae ...Te.$..A..G... 0190 92 d7 a8 39 6b 05 8f 27 7c 8a fc f1 2c a6 14 18 ...9k..'|...,... 01a0 eb 33 ab a9 b7 be b6 08 6e 2a d7 69 85 c5 ee 66 .3......n*.i...f 01b0 8d 6f 41 ac 4a 31 f2 79 6f ed a1 0a 45 65 b3 5a .oA.J1.yo...Ee.Z 01c0 ae 35 b8 2d 5f 33 52 0a c6 f6 8d 2b 33 36 80 4d .5.-_3R....+36.M 01d0 a5 b5 78 fa 29 bb 84 f8 8c 37 64 bd 88 c1 6c e0 ..x.)....7d...l. 01e0 d0 3a 75 9c 9d ec 46 07 64 10 33 5f 48 c4 7d 28 .:u...F.d.3_H.}( 01f0 b5 c8 42 60 30 54 36 2e d2 62 63 3f 11 17 d2 a3 ..B`0T6..bc?.... 0200 09 3e b7 15 24 09 .>..$. Frame 13 (342 bytes on wire, 342 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.665627000 [Time delta from previous captured frame: 0.168145000 seconds] [Time delta from previous displayed frame: 0.168145000 seconds] [Time since reference or first frame: 0.407572000 seconds] Frame Number: 13 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:00:00:00:00:12 (00:00:00:00:00:12), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.120 (165.227.249.120), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfae8 [correct] [Good: True] [Bad : False] Source: 165.227.249.120 (165.227.249.120) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xbe2b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 1EBD63AFF557393A Responder cookie: 3E2BD62E09A2BB4A Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x4c17ffe2 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 48 f8 2f 00 00 00 00 00 12 08 00 45 00 ..)H./........E. 0010 01 48 00 00 40 00 40 11 fa e8 a5 e3 f9 78 a5 e3 .H..@.@......x.. 0020 f9 7c 01 f4 01 f4 01 34 be 2b 1e bd 63 af f5 57 .|.....4.+..c..W 0030 39 3a 3e 2b d6 2e 09 a2 bb 4a 08 10 20 01 4c 17 9:>+.....J.. .L. 0040 ff e2 00 00 01 2c 9d ec 3b 40 a1 05 4d 0e 47 83 .....,..;@..M.G. 0050 18 a3 5d c4 14 29 2a 85 8b 26 77 c8 8c a9 52 1c ..]..)*..&w...R. 0060 36 0c 96 7d 69 ff d5 81 55 ab 57 7b 8d 9b 32 3c 6..}i...U.W{..2< 0070 eb d6 c5 ab 6f 4f 29 7a 4e 90 a7 41 a2 9f 73 77 ....oO)zN..A..sw 0080 fe c6 58 d1 e0 f2 76 02 68 8a 37 ba 48 7d 77 b7 ..X...v.h.7.H}w. 0090 58 4a 8d e6 ec c6 53 af 91 4c 09 73 07 9b 36 18 XJ....S..L.s..6. 00a0 44 08 10 f1 b9 9e c7 a7 bc d4 f8 04 98 42 b0 f2 D............B.. 00b0 c7 b4 f1 b9 be 12 7d d7 00 83 d5 a8 34 1f 2d e7 ......}.....4.-. 00c0 92 6a f6 a9 dd 3b d8 44 69 5d 0e 56 55 e9 52 6c .j...;.Di].VU.Rl 00d0 c9 82 b6 c7 09 d7 d7 62 e9 5a 9f cc 44 e7 c1 a2 .......b.Z..D... 00e0 d0 c2 c2 4b 44 6e dc 26 00 04 1d 45 a7 f8 46 37 ...KDn.&...E..F7 00f0 d4 4a 6b 6c 08 28 9a a3 21 f2 c3 9d 4c 43 de 86 .Jkl.(..!...LC.. 0100 d2 3e 5f 06 01 ad 27 65 c0 87 a2 9c 1d 87 1f 84 .>_...'e........ 0110 0f 7a cc 06 ba c3 ef 5a 3f 6b 06 77 88 24 d5 fa .z.....Z?k.w.$.. 0120 57 48 cf 84 f6 8a 69 9a 52 ae 02 8c 1b ac 0c 3d WH....i.R......= 0130 df 4c 6f 94 a0 42 c9 47 e7 3d eb 93 3a da 98 b1 .Lo..B.G.=..:... 0140 fc 27 72 55 e7 ea c8 e6 fa d7 0d 02 1c f9 40 55 .'rU..........@U 0150 64 62 06 f5 ff cb db.... Frame 14 (102 bytes on wire, 102 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.670139000 [Time delta from previous captured frame: 0.004512000 seconds] [Time delta from previous displayed frame: 0.004512000 seconds] [Time since reference or first frame: 0.412084000 seconds] Frame Number: 14 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:00:00:00:00:12 (00:00:00:00:00:12) Destination: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.120 (165.227.249.120) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbd8 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.120 (165.227.249.120) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xccd0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 1EBD63AFF557393A Responder cookie: 3E2BD62E09A2BB4A Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x4c17ffe2 Length: 60 Encrypted payload (32 bytes) 0000 00 00 00 00 00 12 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 58 00 00 40 00 40 11 fb d8 a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 78 01 f4 01 f4 00 44 cc d0 1e bd 63 af f5 57 .x.....D....c..W 0030 39 3a 3e 2b d6 2e 09 a2 bb 4a 08 10 20 01 4c 17 9:>+.....J.. .L. 0040 ff e2 00 00 00 3c e1 72 01 98 0e a2 57 8b aa ce .....<.r....W... 0050 57 2d c4 a8 a7 83 bf 72 45 c2 05 96 89 39 7f b5 W-.....rE....9.. 0060 df 9e eb 4f 5b 5a ...O[Z Frame 15 (102 bytes on wire, 102 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.670152000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 0.412097000 seconds] Frame Number: 15 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:00:00:00:00:12 (00:00:00:00:00:12) Destination: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.120 (165.227.249.120) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbd8 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.120 (165.227.249.120) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xccd0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 1EBD63AFF557393A Responder cookie: 3E2BD62E09A2BB4A Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x4c17ffe2 Length: 60 Encrypted payload (32 bytes) 0000 00 00 00 00 00 12 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 58 00 00 40 00 40 11 fb d8 a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 78 01 f4 01 f4 00 44 cc d0 1e bd 63 af f5 57 .x.....D....c..W 0030 39 3a 3e 2b d6 2e 09 a2 bb 4a 08 10 20 01 4c 17 9:>+.....J.. .L. 0040 ff e2 00 00 00 3c e1 72 01 98 0e a2 57 8b aa ce .....<.r....W... 0050 57 2d c4 a8 a7 83 bf 72 45 c2 05 96 89 39 7f b5 W-.....rE....9.. 0060 df 9e eb 4f 5b 5a ...O[Z Frame 16 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.962307000 [Time delta from previous captured frame: 0.292155000 seconds] [Time delta from previous displayed frame: 0.292155000 seconds] [Time since reference or first frame: 0.704252000 seconds] Frame Number: 16 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:00:00:00:00:12 (00:00:00:00:00:12) Destination: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.120 (165.227.249.120) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0026 (38) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b71 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.120 (165.227.249.120) Encapsulating Security Payload ESP SPI: 0x04f59108 ESP Sequence: 1 0000 00 00 00 00 00 12 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 78 00 26 00 00 f0 32 8b 71 a5 e3 f9 7c a5 e3 .x.&...2.q...|.. 0020 f9 78 04 f5 91 08 00 00 00 01 80 56 c5 5c d6 67 .x.........V.\.g 0030 ad fd 9f f9 f6 89 50 e5 c7 a6 5b 2a 14 fc 55 09 ......P...[*..U. 0040 6c 11 95 c9 ed 8d 9c aa 94 9c 41 2f 66 ba 21 12 l.........A/f.!. 0050 0b 74 54 b1 09 28 0c 4c 6d 65 85 61 bd 52 c2 f4 .tT..(.Lme.a.R.. 0060 4b a8 90 db 31 75 bb aa 32 2b 39 6c 98 c6 36 2e K...1u..2+9l..6. 0070 3c 1d 46 d9 2c 14 4d e7 58 30 62 69 cd 76 53 da <.F.,.M.X0bi.vS. 0080 d7 d9 fb 7e ac 07 ...~.. Frame 17 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.962322000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 0.704267000 seconds] Frame Number: 17 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:00:00:00:00:12 (00:00:00:00:00:12) Destination: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.120 (165.227.249.120) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0026 (38) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b71 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.120 (165.227.249.120) Encapsulating Security Payload ESP SPI: 0x04f59108 ESP Sequence: 1 0000 00 00 00 00 00 12 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 78 00 26 00 00 f0 32 8b 71 a5 e3 f9 7c a5 e3 .x.&...2.q...|.. 0020 f9 78 04 f5 91 08 00 00 00 01 80 56 c5 5c d6 67 .x.........V.\.g 0030 ad fd 9f f9 f6 89 50 e5 c7 a6 5b 2a 14 fc 55 09 ......P...[*..U. 0040 6c 11 95 c9 ed 8d 9c aa 94 9c 41 2f 66 ba 21 12 l.........A/f.!. 0050 0b 74 54 b1 09 28 0c 4c 6d 65 85 61 bd 52 c2 f4 .tT..(.Lme.a.R.. 0060 4b a8 90 db 31 75 bb aa 32 2b 39 6c 98 c6 36 2e K...1u..2+9l..6. 0070 3c 1d 46 d9 2c 14 4d e7 58 30 62 69 cd 76 53 da <.F.,.M.X0bi.vS. 0080 d7 d9 fb 7e ac 07 ...~.. Frame 18 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 15, 2010 14:30:27.963849000 [Time delta from previous captured frame: 0.001527000 seconds] [Time delta from previous displayed frame: 0.001527000 seconds] [Time since reference or first frame: 0.705794000 seconds] Frame Number: 18 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:00:00:00:00:12 (00:00:00:00:00:12), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.120 (165.227.249.120), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x49e9 (18921) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xf1ae [correct] [Good: True] [Bad : False] Source: 165.227.249.120 (165.227.249.120) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0xa48ffa46 ESP Sequence: 1 0000 00 0c 29 48 f8 2f 00 00 00 00 00 12 08 00 45 00 ..)H./........E. 0010 00 78 49 e9 00 00 40 32 f1 ae a5 e3 f9 78 a5 e3 .xI...@2.....x.. 0020 f9 7c a4 8f fa 46 00 00 00 01 58 17 e8 4d c9 19 .|...F....X..M.. 0030 95 82 7d 58 1e 8f 46 11 3c be 39 2a a0 b1 bd 42 ..}X..F.<.9*...B 0040 24 aa 24 ae 6e db cf 23 67 eb 3d 2d 7c 4e c5 14 $.$.n..#g.=-|N.. 0050 5a 3e 36 01 12 00 80 a8 7a fa 16 73 19 f1 dd 64 Z>6.....z..s...d 0060 c3 d6 8e 1e 7f 07 ce 13 76 ab 85 1b f1 57 97 22 ........v....W." 0070 d4 4e db 42 cc f2 e0 97 9b d3 db 61 3a 6d aa b4 .N.B.......a:m.. 0080 35 98 99 8b 55 60 5...U` Frame 19 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 15, 2010 14:30:28.258880000 [Time delta from previous captured frame: 0.295031000 seconds] [Time delta from previous displayed frame: 0.295031000 seconds] [Time since reference or first frame: 1.000825000 seconds] Frame Number: 19 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:00:00:00:00:12 (00:00:00:00:00:12) Destination: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.120 (165.227.249.120) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0027 (39) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b70 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.120 (165.227.249.120) Encapsulating Security Payload ESP SPI: 0x04f59108 ESP Sequence: 2 0000 00 00 00 00 00 12 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 78 00 27 00 00 f0 32 8b 70 a5 e3 f9 7c a5 e3 .x.'...2.p...|.. 0020 f9 78 04 f5 91 08 00 00 00 02 6c 08 c2 36 8e 68 .x........l..6.h 0030 4b f7 a4 9a 46 19 d7 5a 61 5d 20 22 f5 a0 01 e5 K...F..Za] ".... 0040 f5 cb d7 83 95 59 ff 6c 83 5f 6f fc 9c 7a ed 60 .....Y.l._o..z.` 0050 41 85 19 a1 1d e2 f3 15 ae f5 19 43 43 d7 26 1e A..........CC.&. 0060 76 7c 5e 80 72 e9 b7 1e 80 66 ec f4 53 aa da 18 v|^.r....f..S... 0070 21 bb b0 7b c9 5b 9a 69 bc 34 6b 0b 41 46 95 68 !..{.[.i.4k.AF.h 0080 9c 16 3f e3 d9 f4 ..?... Frame 20 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 15, 2010 14:30:28.258891000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 1.000836000 seconds] Frame Number: 20 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:00:00:00:00:12 (00:00:00:00:00:12) Destination: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.120 (165.227.249.120) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0027 (39) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b70 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.120 (165.227.249.120) Encapsulating Security Payload ESP SPI: 0x04f59108 ESP Sequence: 2 0000 00 00 00 00 00 12 00 0c 29 48 f8 2f 08 00 45 00 ........)H./..E. 0010 00 78 00 27 00 00 f0 32 8b 70 a5 e3 f9 7c a5 e3 .x.'...2.p...|.. 0020 f9 78 04 f5 91 08 00 00 00 02 6c 08 c2 36 8e 68 .x........l..6.h 0030 4b f7 a4 9a 46 19 d7 5a 61 5d 20 22 f5 a0 01 e5 K...F..Za] ".... 0040 f5 cb d7 83 95 59 ff 6c 83 5f 6f fc 9c 7a ed 60 .....Y.l._o..z.` 0050 41 85 19 a1 1d e2 f3 15 ae f5 19 43 43 d7 26 1e A..........CC.&. 0060 76 7c 5e 80 72 e9 b7 1e 80 66 ec f4 53 aa da 18 v|^.r....f..S... 0070 21 bb b0 7b c9 5b 9a 69 bc 34 6b 0b 41 46 95 68 !..{.[.i.4k.AF.h 0080 9c 16 3f e3 d9 f4 ..?... Frame 21 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 15, 2010 14:30:28.262462000 [Time delta from previous captured frame: 0.003571000 seconds] [Time delta from previous displayed frame: 0.003571000 seconds] [Time since reference or first frame: 1.004407000 seconds] Frame Number: 21 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:00:00:00:00:12 (00:00:00:00:00:12), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:00:00:00:00:12 (00:00:00:00:00:12) Address: 00:00:00:00:00:12 (00:00:00:00:00:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.120 (165.227.249.120), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0xa0c5 (41157) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x9ad2 [correct] [Good: True] [Bad : False] Source: 165.227.249.120 (165.227.249.120) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0xa48ffa46 ESP Sequence: 2 0000 00 0c 29 48 f8 2f 00 00 00 00 00 12 08 00 45 00 ..)H./........E. 0010 00 78 a0 c5 00 00 40 32 9a d2 a5 e3 f9 78 a5 e3 .x....@2.....x.. 0020 f9 7c a4 8f fa 46 00 00 00 02 85 1b f1 57 97 22 .|...F.......W." 0030 d4 4e db 42 cc f2 e0 97 9b d3 30 a7 8b 67 91 54 .N.B......0..g.T 0040 06 15 2b e6 77 6a 24 76 f1 56 ba d4 16 eb f9 b1 ..+.wj$v.V...... 0050 95 88 91 89 9c 96 42 4b 05 6b d4 a0 3d ef 32 66 ......BK.k..=.2f 0060 26 dd 45 6d ba 70 f6 f1 44 f2 18 b5 4d af df eb &.Em.p..D...M... 0070 a7 ac 2a 43 25 f3 ec 28 11 a7 84 fd d9 f5 2c 0b ..*C%..(......,. 0080 61 45 23 9b f5 6b aE#..k