Frame 1 (326 bytes on wire, 326 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.101659000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Destination: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaf2 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x1a96 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BE042C9D2E1D633A Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0xBE042C9D2E1D633A Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 e0 91 f5 99 a5 34 00 0c 29 96 68 b2 08 00 45 00 .....4..).h...E. 0010 01 38 00 00 40 00 40 11 fa f2 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 7e 01 f4 01 f4 01 24 1a 96 be 04 2c 9d 2e 1d .~.....$....,... 0030 63 3a 00 00 00 00 00 00 00 00 01 10 02 00 00 00 c:.............. 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 be 04 2c 9d 2e 1d .....|......,... 0060 63 3a 03 00 00 24 00 01 00 00 80 01 00 07 80 0e c:...$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 2 (326 bytes on wire, 326 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.101681000 [Time delta from previous captured frame: 0.000022000 seconds] [Time delta from previous displayed frame: 0.000022000 seconds] [Time since reference or first frame: 0.000022000 seconds] Frame Number: 2 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Destination: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaf2 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x1a96 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BE042C9D2E1D633A Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0xBE042C9D2E1D633A Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 e0 91 f5 99 a5 34 00 0c 29 96 68 b2 08 00 45 00 .....4..).h...E. 0010 01 38 00 00 40 00 40 11 fa f2 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 7e 01 f4 01 f4 01 24 1a 96 be 04 2c 9d 2e 1d .~.....$....,... 0030 63 3a 00 00 00 00 00 00 00 00 01 10 02 00 00 00 c:.............. 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 be 04 2c 9d 2e 1d .....|......,... 0060 63 3a 03 00 00 24 00 01 00 00 80 01 00 07 80 0e c:...$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 3 (174 bytes on wire, 174 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.120872000 [Time delta from previous captured frame: 0.019191000 seconds] [Time delta from previous displayed frame: 0.019191000 seconds] [Time since reference or first frame: 0.019213000 seconds] Frame Number: 3 Frame Length: 174 bytes Capture Length: 174 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.126 (165.227.249.126), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 160 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb8a [correct] [Good: True] [Bad : False] Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 140 Checksum: 0xb8bd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BE042C9D2E1D633A Responder cookie: 9E2BC32D57C06762 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 132 Security Association payload Next payload: Vendor ID (13) Payload length: 64 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 52 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 1 SPI: 0x0000000000000000 Transform payload # 0 Next payload: NONE (0) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 96 68 b2 e0 91 f5 99 a5 34 08 00 45 00 ..).h......4..E. 0010 00 a0 00 00 40 00 40 11 fb 8a a5 e3 f9 7e a5 e3 ....@.@......~.. 0020 f9 7c 01 f4 01 f4 00 8c b8 bd be 04 2c 9d 2e 1d .|..........,... 0030 63 3a 9e 2b c3 2d 57 c0 67 62 01 10 02 00 00 00 c:.+.-W.gb...... 0040 00 00 00 00 00 84 0d 00 00 40 00 00 00 01 00 00 .........@...... 0050 00 01 00 00 00 34 00 01 08 01 00 00 00 00 00 00 .....4.......... 0060 00 00 00 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 0d 00 00 14 af ca d7 13 68 a1 ....p.........h. 0090 f1 c9 6b 86 96 fc 77 57 01 00 00 00 00 14 70 03 ..k...wW......p. 00a0 cb c1 09 7d be 9c 26 00 ba 69 83 bc 8b 35 ...}..&..i...5 Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.124710000 [Time delta from previous captured frame: 0.003838000 seconds] [Time delta from previous displayed frame: 0.003838000 seconds] [Time since reference or first frame: 0.023051000 seconds] Frame Number: 4 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Destination: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb5a [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xa1ee [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BE042C9D2E1D633A Responder cookie: 9E2BC32D57C06762 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 e0 91 f5 99 a5 34 00 0c 29 96 68 b2 08 00 45 00 .....4..).h...E. 0010 00 d0 00 00 40 00 40 11 fb 5a a5 e3 f9 7c a5 e3 ....@.@..Z...|.. 0020 f9 7e 01 f4 01 f4 00 bc a1 ee be 04 2c 9d 2e 1d .~..........,... 0030 63 3a 9e 2b c3 2d 57 c0 67 62 04 10 02 00 00 00 c:.+.-W.gb...... 0040 00 00 00 00 00 b4 0a 00 00 84 56 73 cc 59 a2 ec ..........Vs.Y.. 0050 7b 1a a0 fe e3 2b 95 a9 ac eb db 2d 61 6d 32 48 {....+.....-am2H 0060 8f ae e4 78 81 0f bf c0 ed 33 5a 49 f2 58 dc 22 ...x.....3ZI.X." 0070 e2 14 57 85 66 55 8e a6 83 25 28 56 d5 4c d8 82 ..W.fU...%(V.L.. 0080 67 7f a1 a7 5d 77 04 93 df d3 15 6a 6a 9b f2 31 g...]w.....jj..1 0090 db 6f 94 2d b1 6e b9 cf 4f 20 b6 4d b5 bd 5b a6 .o.-.n..O .M..[. 00a0 50 24 8f 86 b2 02 06 a9 09 5a 6b 7e 17 40 f9 eb P$.......Zk~.@.. 00b0 22 2d 21 3b b1 21 19 86 1a 9d f6 5f 1f 3d 41 02 "-!;.!....._.=A. 00c0 4a b3 9a 18 6f f3 6a 0d d5 b5 00 00 00 14 30 65 J...o.j.......0e 00d0 3b aa 6d 7e d9 cc f9 da 23 64 17 65 d9 ad ;.m~....#d.e.. Frame 5 (222 bytes on wire, 222 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.124734000 [Time delta from previous captured frame: 0.000024000 seconds] [Time delta from previous displayed frame: 0.000024000 seconds] [Time since reference or first frame: 0.023075000 seconds] Frame Number: 5 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Destination: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb5a [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xa1ee [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BE042C9D2E1D633A Responder cookie: 9E2BC32D57C06762 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 e0 91 f5 99 a5 34 00 0c 29 96 68 b2 08 00 45 00 .....4..).h...E. 0010 00 d0 00 00 40 00 40 11 fb 5a a5 e3 f9 7c a5 e3 ....@.@..Z...|.. 0020 f9 7e 01 f4 01 f4 00 bc a1 ee be 04 2c 9d 2e 1d .~..........,... 0030 63 3a 9e 2b c3 2d 57 c0 67 62 04 10 02 00 00 00 c:.+.-W.gb...... 0040 00 00 00 00 00 b4 0a 00 00 84 56 73 cc 59 a2 ec ..........Vs.Y.. 0050 7b 1a a0 fe e3 2b 95 a9 ac eb db 2d 61 6d 32 48 {....+.....-am2H 0060 8f ae e4 78 81 0f bf c0 ed 33 5a 49 f2 58 dc 22 ...x.....3ZI.X." 0070 e2 14 57 85 66 55 8e a6 83 25 28 56 d5 4c d8 82 ..W.fU...%(V.L.. 0080 67 7f a1 a7 5d 77 04 93 df d3 15 6a 6a 9b f2 31 g...]w.....jj..1 0090 db 6f 94 2d b1 6e b9 cf 4f 20 b6 4d b5 bd 5b a6 .o.-.n..O .M..[. 00a0 50 24 8f 86 b2 02 06 a9 09 5a 6b 7e 17 40 f9 eb P$.......Zk~.@.. 00b0 22 2d 21 3b b1 21 19 86 1a 9d f6 5f 1f 3d 41 02 "-!;.!....._.=A. 00c0 4a b3 9a 18 6f f3 6a 0d d5 b5 00 00 00 14 30 65 J...o.j.......0e 00d0 3b aa 6d 7e d9 cc f9 da 23 64 17 65 d9 ad ;.m~....#d.e.. Frame 6 (242 bytes on wire, 242 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.184438000 [Time delta from previous captured frame: 0.059704000 seconds] [Time delta from previous displayed frame: 0.059704000 seconds] [Time since reference or first frame: 0.082779000 seconds] Frame Number: 6 Frame Length: 242 bytes Capture Length: 242 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.126 (165.227.249.126), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb46 [correct] [Good: True] [Bad : False] Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0x8ea6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BE042C9D2E1D633A Responder cookie: 9E2BC32D57C06762 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 20 Nonce Data Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 96 68 b2 e0 91 f5 99 a5 34 08 00 45 00 ..).h......4..E. 0010 00 e4 00 00 40 00 40 11 fb 46 a5 e3 f9 7e a5 e3 ....@.@..F...~.. 0020 f9 7c 01 f4 01 f4 00 d0 8e a6 be 04 2c 9d 2e 1d .|..........,... 0030 63 3a 9e 2b c3 2d 57 c0 67 62 04 10 02 00 00 00 c:.+.-W.gb...... 0040 00 00 00 00 00 c8 0a 00 00 84 ac 57 ee 3e 6f d2 ...........W.>o. 0050 c3 27 6c c1 07 f3 0e 7a 43 87 9c a8 c2 6a 0b 17 .'l....zC....j.. 0060 8e 6e 4b e3 cc e2 2e d5 6e e6 d2 a6 66 83 11 e3 .nK.....n...f... 0070 f0 cd 36 0e 5d ab be d3 8a d8 96 15 2a 42 2e d2 ..6.].......*B.. 0080 39 d6 ba e7 a5 7d 7c f9 88 5d 8f f1 97 06 40 01 9....}|..]....@. 0090 5b 9c fc 59 56 39 2a d5 81 58 a0 b2 c8 f0 cd e5 [..YV9*..X...... 00a0 8f 5c 59 f0 fa 3f 7c 0c 4d de 78 ee f9 90 f6 3e .\Y..?|.M.x....> 00b0 f4 00 8c ee 26 46 d4 1b b8 b6 ed 6f b3 69 5e 4a ....&F.....o.i^J 00c0 56 2a 5e 77 c0 62 d6 be 58 56 0d 00 00 14 d3 d9 V*^w.b..XV...... 00d0 f3 3d 15 e6 c9 0a fa 2e ba 7f 72 97 df be 00 00 .=........r..... 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.188453000 [Time delta from previous captured frame: 0.004015000 seconds] [Time delta from previous displayed frame: 0.004015000 seconds] [Time since reference or first frame: 0.086794000 seconds] Frame Number: 7 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Destination: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb2 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xd676 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BE042C9D2E1D633A Responder cookie: 9E2BC32D57C06762 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 e0 91 f5 99 a5 34 00 0c 29 96 68 b2 08 00 45 00 .....4..).h...E. 0010 00 78 00 00 40 00 40 11 fb b2 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 7e 01 f4 01 f4 00 64 d6 76 be 04 2c 9d 2e 1d .~.....d.v..,... 0030 63 3a 9e 2b c3 2d 57 c0 67 62 05 10 02 01 00 00 c:.+.-W.gb...... 0040 00 00 00 00 00 5c c0 1e ee 5b 59 1a 8f d0 76 a3 .....\...[Y...v. 0050 63 26 f8 c2 60 dc 0b 7b 57 9a 3a f9 83 67 6f 11 c&..`..{W.:..go. 0060 7a 14 9e 23 7f 56 ec 52 6f 35 5d 86 e8 99 72 00 z..#.V.Ro5]...r. 0070 1f 82 b4 29 d4 94 f8 89 87 f5 08 1a b3 c4 b9 62 ...)...........b 0080 2d a2 86 3a e9 b5 -..:.. Frame 8 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.188473000 [Time delta from previous captured frame: 0.000020000 seconds] [Time delta from previous displayed frame: 0.000020000 seconds] [Time since reference or first frame: 0.086814000 seconds] Frame Number: 8 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Destination: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb2 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xd676 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BE042C9D2E1D633A Responder cookie: 9E2BC32D57C06762 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 e0 91 f5 99 a5 34 00 0c 29 96 68 b2 08 00 45 00 .....4..).h...E. 0010 00 78 00 00 40 00 40 11 fb b2 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 7e 01 f4 01 f4 00 64 d6 76 be 04 2c 9d 2e 1d .~.....d.v..,... 0030 63 3a 9e 2b c3 2d 57 c0 67 62 05 10 02 01 00 00 c:.+.-W.gb...... 0040 00 00 00 00 00 5c c0 1e ee 5b 59 1a 8f d0 76 a3 .....\...[Y...v. 0050 63 26 f8 c2 60 dc 0b 7b 57 9a 3a f9 83 67 6f 11 c&..`..{W.:..go. 0060 7a 14 9e 23 7f 56 ec 52 6f 35 5d 86 e8 99 72 00 z..#.V.Ro5]...r. 0070 1f 82 b4 29 d4 94 f8 89 87 f5 08 1a b3 c4 b9 62 ...)...........b 0080 2d a2 86 3a e9 b5 -..:.. Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.257734000 [Time delta from previous captured frame: 0.069261000 seconds] [Time delta from previous displayed frame: 0.069261000 seconds] [Time since reference or first frame: 0.156075000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.126 (165.227.249.126), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc2 [correct] [Good: True] [Bad : False] Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x6556 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BE042C9D2E1D633A Responder cookie: 9E2BC32D57C06762 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 96 68 b2 e0 91 f5 99 a5 34 08 00 45 00 ..).h......4..E. 0010 00 68 00 00 40 00 40 11 fb c2 a5 e3 f9 7e a5 e3 .h..@.@......~.. 0020 f9 7c 01 f4 01 f4 00 54 65 56 be 04 2c 9d 2e 1d .|.....TeV..,... 0030 63 3a 9e 2b c3 2d 57 c0 67 62 05 10 02 01 00 00 c:.+.-W.gb...... 0040 00 00 00 00 00 4c 73 08 b1 75 a4 cc 98 37 f1 90 .....Ls..u...7.. 0050 33 5e ee 81 4c fb c9 0b 88 fc 6c 69 3d 3b b0 14 3^..L.....li=;.. 0060 91 35 e2 36 19 6c 5d 58 8d 7b 3e 68 d6 54 c2 e9 .5.6.l]X.{>h.T.. 0070 b1 16 c7 7a 7d dd ...z}. Frame 10 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.263076000 [Time delta from previous captured frame: 0.005342000 seconds] [Time delta from previous displayed frame: 0.005342000 seconds] [Time since reference or first frame: 0.161417000 seconds] Frame Number: 10 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.126 (165.227.249.126), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb2 [correct] [Good: True] [Bad : False] Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xce71 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BE042C9D2E1D633A Responder cookie: 9E2BC32D57C06762 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xde2dcde2 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 96 68 b2 e0 91 f5 99 a5 34 08 00 45 00 ..).h......4..E. 0010 00 78 00 00 40 00 40 11 fb b2 a5 e3 f9 7e a5 e3 .x..@.@......~.. 0020 f9 7c 01 f4 01 f4 00 64 ce 71 be 04 2c 9d 2e 1d .|.....d.q..,... 0030 63 3a 9e 2b c3 2d 57 c0 67 62 08 10 05 01 de 2d c:.+.-W.gb.....- 0040 cd e2 00 00 00 5c 65 15 a7 e1 0d 4f 0f 9b ed 92 .....\e....O.... 0050 bf b3 9e b1 e3 70 68 d7 83 78 61 71 7c 8a 99 9e .....ph..xaq|... 0060 eb 3d 8a 36 30 e7 bd d3 1d 09 de 4b 67 d6 7a c3 .=.60......Kg.z. 0070 f2 22 18 28 c6 f4 92 44 96 65 fb 65 aa ce f8 32 .".(...D.e.e...2 0080 25 69 d4 50 06 b8 %i.P.. Frame 11 (518 bytes on wire, 518 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.283451000 [Time delta from previous captured frame: 0.020375000 seconds] [Time delta from previous displayed frame: 0.020375000 seconds] [Time since reference or first frame: 0.181792000 seconds] Frame Number: 11 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Destination: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa32 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0x312f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BE042C9D2E1D633A Responder cookie: 9E2BC32D57C06762 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x731cf7ca Length: 476 Encrypted payload (448 bytes) 0000 e0 91 f5 99 a5 34 00 0c 29 96 68 b2 08 00 45 00 .....4..).h...E. 0010 01 f8 00 00 40 00 40 11 fa 32 a5 e3 f9 7c a5 e3 ....@.@..2...|.. 0020 f9 7e 01 f4 01 f4 01 e4 31 2f be 04 2c 9d 2e 1d .~......1/..,... 0030 63 3a 9e 2b c3 2d 57 c0 67 62 08 10 20 01 73 1c c:.+.-W.gb.. .s. 0040 f7 ca 00 00 01 dc dd 3c 8b c6 8b 62 dc 40 75 ff .......<...b.@u. 0050 aa b3 ae d9 9d c7 12 e4 b3 0f ab 96 4e e1 ac d2 ............N... 0060 24 51 ac 97 ab b3 f8 fb ce 93 eb 8a 14 f0 33 7c $Q............3| 0070 33 99 1c 77 28 c8 e5 35 47 c4 30 4e 8b 78 e2 5e 3..w(..5G.0N.x.^ 0080 19 22 79 4c 5a fe 25 1a f4 72 ce 5f 05 6d aa 18 ."yLZ.%..r._.m.. 0090 10 ce 7b a9 ca cb a0 43 37 4f fb f1 ab 97 5f b2 ..{....C7O...._. 00a0 da 52 62 ba 22 1e fa 2b 78 75 9d bd 49 a0 6e 24 .Rb."..+xu..I.n$ 00b0 6a d6 74 0b 2f 5a af f2 22 1e c4 8f 99 9d 2a e3 j.t./Z..".....*. 00c0 e6 19 42 e6 f0 59 5b 67 4a e3 c4 a9 bd f0 cf 8d ..B..Y[gJ....... 00d0 c8 d6 67 5d 86 67 94 9a 9b 90 61 ac 40 11 93 3e ..g].g....a.@..> 00e0 63 cd 14 73 4f 13 2a 02 73 17 39 05 9a af 04 1b c..sO.*.s.9..... 00f0 76 b4 ae bb 7c 02 4e b9 b4 53 fa 36 c6 9f f7 de v...|.N..S.6.... 0100 f3 96 9f 5c 3f 9f f3 5b ae 39 28 a1 d7 82 f2 24 ...\?..[.9(....$ 0110 b8 47 e6 50 26 ad 07 06 7f da 39 36 d7 fa 0a e3 .G.P&.....96.... 0120 07 1c 81 3b 6f e3 c7 3d ed c1 6a 7e 9e 56 87 e8 ...;o..=..j~.V.. 0130 0f 40 b6 d5 89 c0 d2 9d ed b4 0c e6 a6 fe 19 47 .@.............G 0140 d0 1b 65 69 96 99 dc 8e 62 21 57 8d 7a da 31 be ..ei....b!W.z.1. 0150 8e ab 68 97 aa d6 12 7a 33 1e c6 8a 6b 47 0f 70 ..h....z3...kG.p 0160 59 b9 55 34 ef e8 19 71 2e 23 df f2 93 09 16 cb Y.U4...q.#...... 0170 9e 3c d3 ee 04 ee 49 ac c3 07 87 b8 77 00 0a 2d .<....I.....w..- 0180 e9 b8 f3 23 8c 47 33 c8 83 e7 a1 29 cd 1c 33 8a ...#.G3....)..3. 0190 91 9f 9a 6f 50 a5 ae 8a 87 27 95 06 8b 00 75 42 ...oP....'....uB 01a0 95 3e ba f4 80 ca 35 7b 24 e9 29 42 e5 5f 1b bd .>....5{$.)B._.. 01b0 f4 d3 78 8c c4 5c f5 d6 74 99 72 0d 20 c9 08 f7 ..x..\..t.r. ... 01c0 ac 6c b3 1d 6e a7 73 87 83 1c 60 08 2c 1f df 1d .l..n.s...`.,... 01d0 84 8b 05 71 20 ec 28 54 3e 4d c7 20 2d 2d 53 45 ...q .(T>M. --SE 01e0 b1 b9 00 df 42 4d b0 6e e4 bf 58 da ba f1 fa cc ....BM.n..X..... 01f0 7b 5c 3d 38 99 96 e7 14 7d 7c 5a cd f3 9c 3a 7e {\=8....}|Z...:~ 0200 e5 f9 47 ff 96 ad ..G... Frame 12 (518 bytes on wire, 518 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.283478000 [Time delta from previous captured frame: 0.000027000 seconds] [Time delta from previous displayed frame: 0.000027000 seconds] [Time since reference or first frame: 0.181819000 seconds] Frame Number: 12 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Destination: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa32 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0x312f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BE042C9D2E1D633A Responder cookie: 9E2BC32D57C06762 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x731cf7ca Length: 476 Encrypted payload (448 bytes) 0000 e0 91 f5 99 a5 34 00 0c 29 96 68 b2 08 00 45 00 .....4..).h...E. 0010 01 f8 00 00 40 00 40 11 fa 32 a5 e3 f9 7c a5 e3 ....@.@..2...|.. 0020 f9 7e 01 f4 01 f4 01 e4 31 2f be 04 2c 9d 2e 1d .~......1/..,... 0030 63 3a 9e 2b c3 2d 57 c0 67 62 08 10 20 01 73 1c c:.+.-W.gb.. .s. 0040 f7 ca 00 00 01 dc dd 3c 8b c6 8b 62 dc 40 75 ff .......<...b.@u. 0050 aa b3 ae d9 9d c7 12 e4 b3 0f ab 96 4e e1 ac d2 ............N... 0060 24 51 ac 97 ab b3 f8 fb ce 93 eb 8a 14 f0 33 7c $Q............3| 0070 33 99 1c 77 28 c8 e5 35 47 c4 30 4e 8b 78 e2 5e 3..w(..5G.0N.x.^ 0080 19 22 79 4c 5a fe 25 1a f4 72 ce 5f 05 6d aa 18 ."yLZ.%..r._.m.. 0090 10 ce 7b a9 ca cb a0 43 37 4f fb f1 ab 97 5f b2 ..{....C7O...._. 00a0 da 52 62 ba 22 1e fa 2b 78 75 9d bd 49 a0 6e 24 .Rb."..+xu..I.n$ 00b0 6a d6 74 0b 2f 5a af f2 22 1e c4 8f 99 9d 2a e3 j.t./Z..".....*. 00c0 e6 19 42 e6 f0 59 5b 67 4a e3 c4 a9 bd f0 cf 8d ..B..Y[gJ....... 00d0 c8 d6 67 5d 86 67 94 9a 9b 90 61 ac 40 11 93 3e ..g].g....a.@..> 00e0 63 cd 14 73 4f 13 2a 02 73 17 39 05 9a af 04 1b c..sO.*.s.9..... 00f0 76 b4 ae bb 7c 02 4e b9 b4 53 fa 36 c6 9f f7 de v...|.N..S.6.... 0100 f3 96 9f 5c 3f 9f f3 5b ae 39 28 a1 d7 82 f2 24 ...\?..[.9(....$ 0110 b8 47 e6 50 26 ad 07 06 7f da 39 36 d7 fa 0a e3 .G.P&.....96.... 0120 07 1c 81 3b 6f e3 c7 3d ed c1 6a 7e 9e 56 87 e8 ...;o..=..j~.V.. 0130 0f 40 b6 d5 89 c0 d2 9d ed b4 0c e6 a6 fe 19 47 .@.............G 0140 d0 1b 65 69 96 99 dc 8e 62 21 57 8d 7a da 31 be ..ei....b!W.z.1. 0150 8e ab 68 97 aa d6 12 7a 33 1e c6 8a 6b 47 0f 70 ..h....z3...kG.p 0160 59 b9 55 34 ef e8 19 71 2e 23 df f2 93 09 16 cb Y.U4...q.#...... 0170 9e 3c d3 ee 04 ee 49 ac c3 07 87 b8 77 00 0a 2d .<....I.....w..- 0180 e9 b8 f3 23 8c 47 33 c8 83 e7 a1 29 cd 1c 33 8a ...#.G3....)..3. 0190 91 9f 9a 6f 50 a5 ae 8a 87 27 95 06 8b 00 75 42 ...oP....'....uB 01a0 95 3e ba f4 80 ca 35 7b 24 e9 29 42 e5 5f 1b bd .>....5{$.)B._.. 01b0 f4 d3 78 8c c4 5c f5 d6 74 99 72 0d 20 c9 08 f7 ..x..\..t.r. ... 01c0 ac 6c b3 1d 6e a7 73 87 83 1c 60 08 2c 1f df 1d .l..n.s...`.,... 01d0 84 8b 05 71 20 ec 28 54 3e 4d c7 20 2d 2d 53 45 ...q .(T>M. --SE 01e0 b1 b9 00 df 42 4d b0 6e e4 bf 58 da ba f1 fa cc ....BM.n..X..... 01f0 7b 5c 3d 38 99 96 e7 14 7d 7c 5a cd f3 9c 3a 7e {\=8....}|Z...:~ 0200 e5 f9 47 ff 96 ad ..G... Frame 13 (342 bytes on wire, 342 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.384641000 [Time delta from previous captured frame: 0.101163000 seconds] [Time delta from previous displayed frame: 0.101163000 seconds] [Time since reference or first frame: 0.282982000 seconds] Frame Number: 13 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.126 (165.227.249.126), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfae2 [correct] [Good: True] [Bad : False] Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xb643 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BE042C9D2E1D633A Responder cookie: 9E2BC32D57C06762 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x731cf7ca Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 96 68 b2 e0 91 f5 99 a5 34 08 00 45 00 ..).h......4..E. 0010 01 48 00 00 40 00 40 11 fa e2 a5 e3 f9 7e a5 e3 .H..@.@......~.. 0020 f9 7c 01 f4 01 f4 01 34 b6 43 be 04 2c 9d 2e 1d .|.....4.C..,... 0030 63 3a 9e 2b c3 2d 57 c0 67 62 08 10 20 01 73 1c c:.+.-W.gb.. .s. 0040 f7 ca 00 00 01 2c c2 98 f1 05 86 f7 00 e1 1b f1 .....,.......... 0050 66 b8 01 52 c8 cc 84 36 9c 38 b2 ca 7f fd 2a 41 f..R...6.8....*A 0060 08 f7 5b d2 3b b2 44 fa 33 13 48 ef 97 cb 56 66 ..[.;.D.3.H...Vf 0070 e9 85 12 06 88 17 06 17 fb d3 91 8d 03 93 be 62 ...............b 0080 a9 19 2c 10 1a d7 e8 35 12 30 a0 51 5c 89 12 13 ..,....5.0.Q\... 0090 81 ed a1 ed a0 5a bc 3e 58 78 f4 6d c3 29 c6 41 .....Z.>Xx.m.).A 00a0 88 e4 c6 b4 43 ec b1 c9 2f 68 ac 2b 54 21 8c 84 ....C.../h.+T!.. 00b0 6e ff 34 c8 b3 67 58 c4 8f c3 f1 f6 1b dc 2a cd n.4..gX.......*. 00c0 e9 b9 a8 2b 12 db e6 fc 4b a3 99 cf c7 44 6c d4 ...+....K....Dl. 00d0 a5 23 82 ed 4e 39 7d 9c 6c fe db 69 5b 61 79 9e .#..N9}.l..i[ay. 00e0 57 89 b3 99 f6 f5 ce c2 66 6a 22 14 66 0a d1 25 W.......fj".f..% 00f0 2f db 16 89 44 b0 85 58 81 79 76 14 ff 3e 62 57 /...D..X.yv..>bW 0100 cc ad c7 9f 47 35 79 e9 b4 ca 80 63 ca 13 75 10 ....G5y....c..u. 0110 38 c3 fc 57 5c 73 45 83 c2 c8 c9 9c 95 b1 7c b2 8..W\sE.......|. 0120 bb 24 b3 ba 4d 7c fd ea d2 a5 e6 e1 dc 72 8f 5b .$..M|.......r.[ 0130 09 d6 97 5c 1c 24 c1 9d 4a 7d 69 c3 45 7d e3 e4 ...\.$..J}i.E}.. 0140 34 6b 82 8e e6 a7 28 a9 f5 e7 5e fc 00 1f cc 07 4k....(...^..... 0150 1a 6a 55 a7 57 a3 .jU.W. Frame 14 (102 bytes on wire, 102 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.388687000 [Time delta from previous captured frame: 0.004046000 seconds] [Time delta from previous displayed frame: 0.004046000 seconds] [Time since reference or first frame: 0.287028000 seconds] Frame Number: 14 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Destination: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbd2 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xfa2c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BE042C9D2E1D633A Responder cookie: 9E2BC32D57C06762 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x731cf7ca Length: 60 Encrypted payload (32 bytes) 0000 e0 91 f5 99 a5 34 00 0c 29 96 68 b2 08 00 45 00 .....4..).h...E. 0010 00 58 00 00 40 00 40 11 fb d2 a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 7e 01 f4 01 f4 00 44 fa 2c be 04 2c 9d 2e 1d .~.....D.,..,... 0030 63 3a 9e 2b c3 2d 57 c0 67 62 08 10 20 01 73 1c c:.+.-W.gb.. .s. 0040 f7 ca 00 00 00 3c f0 7f db 36 eb c7 63 0e 3b c2 .....<...6..c.;. 0050 5f 8e 15 87 8b 8a 57 7b 97 91 88 fa 3f ce 2a 3a _.....W{....?.*: 0060 d2 b1 dc a2 aa 90 ...... Frame 15 (102 bytes on wire, 102 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.388718000 [Time delta from previous captured frame: 0.000031000 seconds] [Time delta from previous displayed frame: 0.000031000 seconds] [Time since reference or first frame: 0.287059000 seconds] Frame Number: 15 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Destination: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbd2 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xfa2c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BE042C9D2E1D633A Responder cookie: 9E2BC32D57C06762 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x731cf7ca Length: 60 Encrypted payload (32 bytes) 0000 e0 91 f5 99 a5 34 00 0c 29 96 68 b2 08 00 45 00 .....4..).h...E. 0010 00 58 00 00 40 00 40 11 fb d2 a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 7e 01 f4 01 f4 00 44 fa 2c be 04 2c 9d 2e 1d .~.....D.,..,... 0030 63 3a 9e 2b c3 2d 57 c0 67 62 08 10 20 01 73 1c c:.+.-W.gb.. .s. 0040 f7 ca 00 00 00 3c f0 7f db 36 eb c7 63 0e 3b c2 .....<...6..c.;. 0050 5f 8e 15 87 8b 8a 57 7b 97 91 88 fa 3f ce 2a 3a _.....W{....?.*: 0060 d2 b1 dc a2 aa 90 ...... Frame 16 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.669984000 [Time delta from previous captured frame: 0.281266000 seconds] [Time delta from previous displayed frame: 0.281266000 seconds] [Time since reference or first frame: 0.568325000 seconds] Frame Number: 16 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Destination: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0005 (5) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b8c [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) Encapsulating Security Payload ESP SPI: 0x0ae9db99 ESP Sequence: 1 0000 e0 91 f5 99 a5 34 00 0c 29 96 68 b2 08 00 45 00 .....4..).h...E. 0010 00 78 00 05 00 00 f0 32 8b 8c a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 7e 0a e9 db 99 00 00 00 01 48 fa 4e b0 55 d6 .~........H.N.U. 0030 82 ca a5 2c df 38 e7 7e 77 28 c2 94 2c 4b 9e 1e ...,.8.~w(..,K.. 0040 3d aa 9c a7 35 d3 e2 55 33 bb 10 83 d2 22 c0 43 =...5..U3....".C 0050 ca 75 f6 fe 03 07 0d 09 02 cd 1b 5f bf f7 e1 57 .u........._...W 0060 55 81 69 20 3f f9 3d cd a3 8d b9 17 c0 86 21 fd U.i ?.=.......!. 0070 be 21 a3 06 73 3f ae c4 22 60 d5 8a 39 5e 62 8b .!..s?.."`..9^b. 0080 77 db e0 e3 9e 36 w....6 Frame 17 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.670011000 [Time delta from previous captured frame: 0.000027000 seconds] [Time delta from previous displayed frame: 0.000027000 seconds] [Time since reference or first frame: 0.568352000 seconds] Frame Number: 17 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Destination: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0005 (5) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b8c [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) Encapsulating Security Payload ESP SPI: 0x0ae9db99 ESP Sequence: 1 0000 e0 91 f5 99 a5 34 00 0c 29 96 68 b2 08 00 45 00 .....4..).h...E. 0010 00 78 00 05 00 00 f0 32 8b 8c a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 7e 0a e9 db 99 00 00 00 01 48 fa 4e b0 55 d6 .~........H.N.U. 0030 82 ca a5 2c df 38 e7 7e 77 28 c2 94 2c 4b 9e 1e ...,.8.~w(..,K.. 0040 3d aa 9c a7 35 d3 e2 55 33 bb 10 83 d2 22 c0 43 =...5..U3....".C 0050 ca 75 f6 fe 03 07 0d 09 02 cd 1b 5f bf f7 e1 57 .u........._...W 0060 55 81 69 20 3f f9 3d cd a3 8d b9 17 c0 86 21 fd U.i ?.=.......!. 0070 be 21 a3 06 73 3f ae c4 22 60 d5 8a 39 5e 62 8b .!..s?.."`..9^b. 0080 77 db e0 e3 9e 36 w....6 Frame 18 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 21, 2011 13:55:38.672977000 [Time delta from previous captured frame: 0.002966000 seconds] [Time delta from previous displayed frame: 0.002966000 seconds] [Time since reference or first frame: 0.571318000 seconds] Frame Number: 18 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.126 (165.227.249.126), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0xb782 (46978) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x840f [correct] [Good: True] [Bad : False] Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0xd9b2a26f ESP Sequence: 1 0000 00 0c 29 96 68 b2 e0 91 f5 99 a5 34 08 00 45 00 ..).h......4..E. 0010 00 78 b7 82 00 00 40 32 84 0f a5 e3 f9 7e a5 e3 .x....@2.....~.. 0020 f9 7c d9 b2 a2 6f 00 00 00 01 9a eb d2 63 33 b5 .|...o.......c3. 0030 ff 6c bc 97 98 ca a6 3a 74 01 4c 26 3e de 1a 07 .l.....:t.L&>... 0040 63 8a c7 75 33 62 7f 66 8f 13 d2 13 ff 2b 20 a5 c..u3b.f.....+ . 0050 a9 c0 12 c4 6e 20 b0 c6 6b da 04 f9 90 9e cc f7 ....n ..k....... 0060 92 f6 56 c3 68 bf 51 79 d4 2a f0 f7 f6 80 62 6e ..V.h.Qy.*....bn 0070 c0 33 00 17 e9 65 b1 95 b4 d5 e3 45 b1 0e 60 0a .3...e.....E..`. 0080 a7 f0 bd 83 05 bd ...... Frame 19 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 21, 2011 13:55:39.098618000 [Time delta from previous captured frame: 0.425641000 seconds] [Time delta from previous displayed frame: 0.425641000 seconds] [Time since reference or first frame: 0.996959000 seconds] Frame Number: 19 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Destination: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0006 (6) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b8b [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) Encapsulating Security Payload ESP SPI: 0x0ae9db99 ESP Sequence: 2 0000 e0 91 f5 99 a5 34 00 0c 29 96 68 b2 08 00 45 00 .....4..).h...E. 0010 00 78 00 06 00 00 f0 32 8b 8b a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 7e 0a e9 db 99 00 00 00 02 0b 71 7b ab d9 c7 .~.........q{... 0030 ac c6 93 18 89 dc a5 1a 66 f2 c3 ef e5 c5 05 15 ........f....... 0040 96 e0 8e 58 61 49 58 0d 83 69 30 fb f9 3a 68 1c ...XaIX..i0..:h. 0050 47 8c 11 f0 71 da 3f 4d 65 f5 e2 94 26 81 ae 42 G...q.?Me...&..B 0060 9a ac 5e 50 07 27 5e 65 4c 9d 28 4c 08 8f b1 14 ..^P.'^eL.(L.... 0070 2f b8 c5 26 0e fa d2 88 d9 2f 31 c8 b3 21 03 94 /..&...../1..!.. 0080 cc 36 dc 54 ee d1 .6.T.. Frame 20 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 21, 2011 13:55:39.098647000 [Time delta from previous captured frame: 0.000029000 seconds] [Time delta from previous displayed frame: 0.000029000 seconds] [Time since reference or first frame: 0.996988000 seconds] Frame Number: 20 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Destination: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0006 (6) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b8b [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) Encapsulating Security Payload ESP SPI: 0x0ae9db99 ESP Sequence: 2 0000 e0 91 f5 99 a5 34 00 0c 29 96 68 b2 08 00 45 00 .....4..).h...E. 0010 00 78 00 06 00 00 f0 32 8b 8b a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 7e 0a e9 db 99 00 00 00 02 0b 71 7b ab d9 c7 .~.........q{... 0030 ac c6 93 18 89 dc a5 1a 66 f2 c3 ef e5 c5 05 15 ........f....... 0040 96 e0 8e 58 61 49 58 0d 83 69 30 fb f9 3a 68 1c ...XaIX..i0..:h. 0050 47 8c 11 f0 71 da 3f 4d 65 f5 e2 94 26 81 ae 42 G...q.?Me...&..B 0060 9a ac 5e 50 07 27 5e 65 4c 9d 28 4c 08 8f b1 14 ..^P.'^eL.(L.... 0070 2f b8 c5 26 0e fa d2 88 d9 2f 31 c8 b3 21 03 94 /..&...../1..!.. 0080 cc 36 dc 54 ee d1 .6.T.. Frame 21 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 21, 2011 13:55:39.101229000 [Time delta from previous captured frame: 0.002582000 seconds] [Time delta from previous displayed frame: 0.002582000 seconds] [Time since reference or first frame: 0.999570000 seconds] Frame Number: 21 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.126 (165.227.249.126), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0xdac8 (56008) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x60c9 [correct] [Good: True] [Bad : False] Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0xd9b2a26f ESP Sequence: 2 0000 00 0c 29 96 68 b2 e0 91 f5 99 a5 34 08 00 45 00 ..).h......4..E. 0010 00 78 da c8 00 00 40 32 60 c9 a5 e3 f9 7e a5 e3 .x....@2`....~.. 0020 f9 7c d9 b2 a2 6f 00 00 00 02 f0 f7 f6 80 62 6e .|...o........bn 0030 c0 33 00 17 e9 65 b1 95 b4 d5 6e bd c3 40 b5 50 .3...e....n..@.P 0040 32 e0 96 4e 34 ba 95 52 65 78 72 a8 5c 92 58 b1 2..N4..Rexr.\.X. 0050 7c 44 02 74 16 3d fb dd ad d1 41 b4 97 b7 b7 e8 |D.t.=....A..... 0060 72 44 97 a6 a4 8b 5a 48 d3 32 8f ba 74 49 aa 9a rD....ZH.2..tI.. 0070 01 1d cd 4a 3a b9 73 e6 ed 8f 1e f7 c5 de fa 11 ...J:.s......... 0080 8a 56 ed 6e ae 4a .V.n.J Frame 22 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 21, 2011 13:55:40.097794000 [Time delta from previous captured frame: 0.996565000 seconds] [Time delta from previous displayed frame: 0.996565000 seconds] [Time since reference or first frame: 1.996135000 seconds] Frame Number: 22 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Destination: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0007 (7) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b8a [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) Encapsulating Security Payload ESP SPI: 0x0ae9db99 ESP Sequence: 3 0000 e0 91 f5 99 a5 34 00 0c 29 96 68 b2 08 00 45 00 .....4..).h...E. 0010 00 78 00 07 00 00 f0 32 8b 8a a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 7e 0a e9 db 99 00 00 00 03 4b e8 82 e2 a6 29 .~........K....) 0030 03 ca 88 56 af 99 ef 61 cb fa 8e 21 76 fb 0e 6e ...V...a...!v..n 0040 c6 a0 0d 24 1e 0a 8e f1 7d dd f5 df d8 6e 33 58 ...$....}....n3X 0050 d5 54 fb 32 e0 9e 08 17 d0 e8 b5 4d 93 6e 0c 11 .T.2.......M.n.. 0060 b8 2b 33 29 90 c7 e3 d5 22 99 7f 81 98 6a c5 8c .+3)...."....j.. 0070 06 b8 fa 8b fe e0 a9 18 c6 57 51 09 72 a5 0a a8 .........WQ.r... 0080 96 fb b1 54 32 dc ...T2. Frame 23 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 21, 2011 13:55:40.097822000 [Time delta from previous captured frame: 0.000028000 seconds] [Time delta from previous displayed frame: 0.000028000 seconds] [Time since reference or first frame: 1.996163000 seconds] Frame Number: 23 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Destination: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0007 (7) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b8a [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) Encapsulating Security Payload ESP SPI: 0x0ae9db99 ESP Sequence: 3 0000 e0 91 f5 99 a5 34 00 0c 29 96 68 b2 08 00 45 00 .....4..).h...E. 0010 00 78 00 07 00 00 f0 32 8b 8a a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 7e 0a e9 db 99 00 00 00 03 4b e8 82 e2 a6 29 .~........K....) 0030 03 ca 88 56 af 99 ef 61 cb fa 8e 21 76 fb 0e 6e ...V...a...!v..n 0040 c6 a0 0d 24 1e 0a 8e f1 7d dd f5 df d8 6e 33 58 ...$....}....n3X 0050 d5 54 fb 32 e0 9e 08 17 d0 e8 b5 4d 93 6e 0c 11 .T.2.......M.n.. 0060 b8 2b 33 29 90 c7 e3 d5 22 99 7f 81 98 6a c5 8c .+3)...."....j.. 0070 06 b8 fa 8b fe e0 a9 18 c6 57 51 09 72 a5 0a a8 .........WQ.r... 0080 96 fb b1 54 32 dc ...T2. Frame 24 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 21, 2011 13:55:40.100255000 [Time delta from previous captured frame: 0.002433000 seconds] [Time delta from previous displayed frame: 0.002433000 seconds] [Time since reference or first frame: 1.998596000 seconds] Frame Number: 24 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) Address: e0:91:f5:99:a5:34 (e0:91:f5:99:a5:34) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.126 (165.227.249.126), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x8ed8 (36568) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xacb9 [correct] [Good: True] [Bad : False] Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0xd9b2a26f ESP Sequence: 3 0000 00 0c 29 96 68 b2 e0 91 f5 99 a5 34 08 00 45 00 ..).h......4..E. 0010 00 78 8e d8 00 00 40 32 ac b9 a5 e3 f9 7e a5 e3 .x....@2.....~.. 0020 f9 7c d9 b2 a2 6f 00 00 00 03 8f ba 74 49 aa 9a .|...o......tI.. 0030 01 1d cd 4a 3a b9 73 e6 ed 8f 02 60 8a 3c 19 8b ...J:.s....`.<.. 0040 9a d4 9e a7 55 c0 4c cf 1e 3e db 0a 8a 29 c8 66 ....U.L..>...).f 0050 0d d7 79 ec 79 a6 db 72 ad e6 92 22 d6 d9 a7 20 ..y.y..r..."... 0060 19 46 6b c2 25 e3 d8 58 a8 ef 8d 5b 3d d0 69 58 .Fk.%..X...[=.iX 0070 4a 40 74 7e 5c 00 78 88 4c c1 55 f8 da 1b d4 8a J@t~\.x.L.U..... 0080 64 8d 2e 7c 58 89 d..|X.