Frame 1 (326 bytes on wire, 326 bytes captured) Arrival Time: Oct 27, 2009 10:12:34.124279000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Address: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaf1 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.127 (165.227.249.127) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xc031 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A889D48AD227D9EE Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0xA889D48AD227D9EE Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 19 e1 68 8e 01 00 0c 29 48 f8 2f 08 00 45 00 ...h....)H./..E. 0010 01 38 00 00 40 00 40 11 fa f1 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 7f 01 f4 01 f4 01 24 c0 31 a8 89 d4 8a d2 27 .......$.1.....' 0030 d9 ee 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 a8 89 d4 8a d2 27 .....|.........' 0060 d9 ee 03 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 2 (326 bytes on wire, 326 bytes captured) Arrival Time: Oct 27, 2009 10:12:34.124288000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 0.000009000 seconds] Frame Number: 2 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Address: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaf1 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.127 (165.227.249.127) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xc031 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A889D48AD227D9EE Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0xA889D48AD227D9EE Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 19 e1 68 8e 01 00 0c 29 48 f8 2f 08 00 45 00 ...h....)H./..E. 0010 01 38 00 00 40 00 40 11 fa f1 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 7f 01 f4 01 f4 01 24 c0 31 a8 89 d4 8a d2 27 .......$.1.....' 0030 d9 ee 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 a8 89 d4 8a d2 27 .....|.........' 0060 d9 ee 03 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 3 (174 bytes on wire, 174 bytes captured) Arrival Time: Oct 27, 2009 10:12:34.124898000 [Time delta from previous captured frame: 0.000610000 seconds] [Time delta from previous displayed frame: 0.000610000 seconds] [Time since reference or first frame: 0.000619000 seconds] Frame Number: 3 Frame Length: 174 bytes Capture Length: 174 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Address: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.127 (165.227.249.127), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 160 Identification: 0x01df (479) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x39ab [correct] [Good: True] [Bad : False] Source: 165.227.249.127 (165.227.249.127) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 140 Checksum: 0x33cd [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A889D48AD227D9EE Responder cookie: B0988D72A20F372D Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 132 Security Association payload Next payload: Vendor ID (13) Payload length: 64 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 52 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 1 SPI: 0xA889D48AD227D9EE Transform payload # 0 Next payload: NONE (0) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 48 f8 2f 00 19 e1 68 8e 01 08 00 45 00 ..)H./...h....E. 0010 00 a0 01 df 00 00 40 11 39 ab a5 e3 f9 7f a5 e3 ......@.9....... 0020 f9 7c 01 f4 01 f4 00 8c 33 cd a8 89 d4 8a d2 27 .|......3......' 0030 d9 ee b0 98 8d 72 a2 0f 37 2d 01 10 02 00 00 00 .....r..7-...... 0040 00 00 00 00 00 84 0d 00 00 40 00 00 00 01 00 00 .........@...... 0050 00 01 00 00 00 34 00 01 08 01 a8 89 d4 8a d2 27 .....4.........' 0060 d9 ee 00 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 0d 00 00 14 90 cb 80 91 3e bb ....p.........>. 0090 69 6e 08 63 81 b5 ec 42 7b 1f 00 00 00 14 af ca in.c...B{....... 00a0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 4 (270 bytes on wire, 270 bytes captured) Arrival Time: Oct 27, 2009 10:12:34.127813000 [Time delta from previous captured frame: 0.002915000 seconds] [Time delta from previous displayed frame: 0.002915000 seconds] [Time since reference or first frame: 0.003534000 seconds] Frame Number: 4 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Address: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb29 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.127 (165.227.249.127) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0xb9c2 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A889D48AD227D9EE Responder cookie: B0988D72A20F372D Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: 4214A1530015F19D5CD7892956D4D0F762AFBF15 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: 81610B197C76757D462C82DC3A9494E8B194D64A 0000 00 19 e1 68 8e 01 00 0c 29 48 f8 2f 08 00 45 00 ...h....)H./..E. 0010 01 00 00 00 40 00 40 11 fb 29 a5 e3 f9 7c a5 e3 ....@.@..)...|.. 0020 f9 7f 01 f4 01 f4 00 ec b9 c2 a8 89 d4 8a d2 27 ...............' 0030 d9 ee b0 98 8d 72 a2 0f 37 2d 04 10 02 00 00 00 .....r..7-...... 0040 00 00 00 00 00 e4 0a 00 00 84 88 99 f9 41 65 02 .............Ae. 0050 eb f1 3d 0d a9 18 32 a7 9b 64 3e 0c c0 ca 4c 3e ..=...2..d>...L> 0060 8a 47 d3 d2 51 fd a5 00 5d c7 fe e8 ee 4d 74 00 .G..Q...]....Mt. 0070 15 c9 7c 12 55 4f 0c 38 fe 95 cd 93 c4 d9 eb 75 ..|.UO.8.......u 0080 23 de 15 ce 39 89 ac 50 e9 21 ce 3d 58 18 17 bf #...9..P.!.=X... 0090 a4 26 6b 0e 99 31 be cb 1f ee 7f 7f 81 30 7a b5 .&k..1.......0z. 00a0 76 10 26 91 6c 3a 4c d4 0b 88 f8 0e 7d d6 34 5b v.&.l:L.....}.4[ 00b0 08 9a 51 0f c0 d7 72 ef 04 20 d6 5f 59 f4 f5 86 ..Q...r.. ._Y... 00c0 08 97 a6 f8 5a 59 15 bd b3 29 82 00 00 14 ca 90 ....ZY...)...... 00d0 53 7e 68 ea 55 30 f1 36 0d 85 1c 50 db be 82 00 S~h.U0.6...P.... 00e0 00 18 42 14 a1 53 00 15 f1 9d 5c d7 89 29 56 d4 ..B..S....\..)V. 00f0 d0 f7 62 af bf 15 00 00 00 18 81 61 0b 19 7c 76 ..b........a..|v 0100 75 7d 46 2c 82 dc 3a 94 94 e8 b1 94 d6 4a u}F,..:......J Frame 5 (270 bytes on wire, 270 bytes captured) Arrival Time: Oct 27, 2009 10:12:34.127833000 [Time delta from previous captured frame: 0.000020000 seconds] [Time delta from previous displayed frame: 0.000020000 seconds] [Time since reference or first frame: 0.003554000 seconds] Frame Number: 5 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Address: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb29 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.127 (165.227.249.127) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0xb9c2 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A889D48AD227D9EE Responder cookie: B0988D72A20F372D Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: 4214A1530015F19D5CD7892956D4D0F762AFBF15 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: 81610B197C76757D462C82DC3A9494E8B194D64A 0000 00 19 e1 68 8e 01 00 0c 29 48 f8 2f 08 00 45 00 ...h....)H./..E. 0010 01 00 00 00 40 00 40 11 fb 29 a5 e3 f9 7c a5 e3 ....@.@..)...|.. 0020 f9 7f 01 f4 01 f4 00 ec b9 c2 a8 89 d4 8a d2 27 ...............' 0030 d9 ee b0 98 8d 72 a2 0f 37 2d 04 10 02 00 00 00 .....r..7-...... 0040 00 00 00 00 00 e4 0a 00 00 84 88 99 f9 41 65 02 .............Ae. 0050 eb f1 3d 0d a9 18 32 a7 9b 64 3e 0c c0 ca 4c 3e ..=...2..d>...L> 0060 8a 47 d3 d2 51 fd a5 00 5d c7 fe e8 ee 4d 74 00 .G..Q...]....Mt. 0070 15 c9 7c 12 55 4f 0c 38 fe 95 cd 93 c4 d9 eb 75 ..|.UO.8.......u 0080 23 de 15 ce 39 89 ac 50 e9 21 ce 3d 58 18 17 bf #...9..P.!.=X... 0090 a4 26 6b 0e 99 31 be cb 1f ee 7f 7f 81 30 7a b5 .&k..1.......0z. 00a0 76 10 26 91 6c 3a 4c d4 0b 88 f8 0e 7d d6 34 5b v.&.l:L.....}.4[ 00b0 08 9a 51 0f c0 d7 72 ef 04 20 d6 5f 59 f4 f5 86 ..Q...r.. ._Y... 00c0 08 97 a6 f8 5a 59 15 bd b3 29 82 00 00 14 ca 90 ....ZY...)...... 00d0 53 7e 68 ea 55 30 f1 36 0d 85 1c 50 db be 82 00 S~h.U0.6...P.... 00e0 00 18 42 14 a1 53 00 15 f1 9d 5c d7 89 29 56 d4 ..B..S....\..)V. 00f0 d0 f7 62 af bf 15 00 00 00 18 81 61 0b 19 7c 76 ..b........a..|v 0100 75 7d 46 2c 82 dc 3a 94 94 e8 b1 94 d6 4a u}F,..:......J Frame 6 (262 bytes on wire, 262 bytes captured) Arrival Time: Oct 27, 2009 10:12:34.385529000 [Time delta from previous captured frame: 0.257696000 seconds] [Time delta from previous displayed frame: 0.257696000 seconds] [Time since reference or first frame: 0.261250000 seconds] Frame Number: 6 Frame Length: 262 bytes Capture Length: 262 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Address: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.127 (165.227.249.127), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 248 Identification: 0x01e0 (480) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3952 [correct] [Good: True] [Bad : False] Source: 165.227.249.127 (165.227.249.127) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 228 Checksum: 0x9776 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A889D48AD227D9EE Responder cookie: B0988D72A20F372D Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 220 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 12 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: 81610B197C76757D462C82DC3A9494E8B194D64A NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: 4214A1530015F19D5CD7892956D4D0F762AFBF15 0000 00 0c 29 48 f8 2f 00 19 e1 68 8e 01 08 00 45 00 ..)H./...h....E. 0010 00 f8 01 e0 00 00 40 11 39 52 a5 e3 f9 7f a5 e3 ......@.9R...... 0020 f9 7c 01 f4 01 f4 00 e4 97 76 a8 89 d4 8a d2 27 .|.......v.....' 0030 d9 ee b0 98 8d 72 a2 0f 37 2d 04 10 02 00 00 00 .....r..7-...... 0040 00 00 00 00 00 dc 0a 00 00 84 2b 94 d7 01 9f 07 ..........+..... 0050 5d e5 51 c6 8d 69 f1 52 52 fd 4f 3f 0e e0 83 61 ].Q..i.RR.O?...a 0060 6b 01 d8 69 85 9e d2 21 74 64 6f d3 63 f3 60 e0 k..i...!tdo.c.`. 0070 3c b8 90 2f b8 3c 78 24 bb c4 a3 9b c1 2d 89 97 <../..,4$..^ 0120 51 f0 ce bf 46 cc 4b ec 38 b6 10 3d 96 53 73 0b Q...F.K.8..=.Ss. 0130 d1 e1 75 af 71 8d 1a 7a f9 33 36 25 41 cc 07 bd ..u.q..z.36%A... 0140 1e c0 f7 af a6 2a 3d 3d 10 6a 62 83 12 59 bf b6 .....*==.jb..Y.. 0150 1f 05 f0 04 48 6f 98 29 1a 85 fe 84 55 cd 8b ac ....Ho.)....U... 0160 3a cb e9 d0 f9 f1 7e 01 4b 77 32 f5 3a 97 25 9c :.....~.Kw2.:.%. 0170 14 ae cf 73 17 36 a6 51 51 7c 2e 42 aa 41 bc d1 ...s.6.QQ|.B.A.. 0180 82 d5 5e f4 0c 0f 3c d8 52 bc bf 94 ca 91 45 60 ..^...<.R.....E` 0190 9f 71 61 d7 e8 ed b4 c1 18 4b b8 a7 a8 bb b1 22 .qa......K....." 01a0 a4 10 38 a1 3e 1a 4c ea f1 c3 8c 5c a6 47 e0 1c ..8.>.L....\.G.. 01b0 da b3 5a a7 db ba 79 4b 42 37 d8 8e ba 54 b1 71 ..Z...yKB7...T.q 01c0 ea 3e 7a 6a 66 78 50 03 63 65 3e 3f 6e b6 3f 0f .>zjfxP.ce>?n.?. 01d0 e1 eb 25 dd 63 32 c6 8e 01 a2 aa 5f c6 e0 a1 84 ..%.c2....._.... 01e0 90 e5 51 9d 3e ab d9 b7 19 29 f3 97 77 d9 15 3c ..Q.>....)..w..< 01f0 a8 10 ae a1 4d fe b9 85 60 6b d0 9e 2e 31 e6 ed ....M...`k...1.. 0200 b8 5a 43 74 5d 21 .ZCt]! Frame 11 (518 bytes on wire, 518 bytes captured) Arrival Time: Oct 27, 2009 10:12:34.704357000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 0.580078000 seconds] Frame Number: 11 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Address: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa31 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.127 (165.227.249.127) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0x6330 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A889D48AD227D9EE Responder cookie: B0988D72A20F372D Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xd707b8d4 Length: 476 Encrypted payload (448 bytes) 0000 00 19 e1 68 8e 01 00 0c 29 48 f8 2f 08 00 45 00 ...h....)H./..E. 0010 01 f8 00 00 40 00 40 11 fa 31 a5 e3 f9 7c a5 e3 ....@.@..1...|.. 0020 f9 7f 01 f4 01 f4 01 e4 63 30 a8 89 d4 8a d2 27 ........c0.....' 0030 d9 ee b0 98 8d 72 a2 0f 37 2d 08 10 20 01 d7 07 .....r..7-.. ... 0040 b8 d4 00 00 01 dc fa 43 f7 e2 6f fe 70 8d 32 e9 .......C..o.p.2. 0050 bd 10 a1 38 b6 82 7a 7b fe 17 4d 62 f0 9c f7 b9 ...8..z{..Mb.... 0060 4c 03 59 ed 86 df 01 3a b5 c1 3c 7f 3d b3 35 86 L.Y....:..<.=.5. 0070 fc 90 c7 49 81 18 b1 35 26 05 40 29 55 99 1e 0d ...I...5&.@)U... 0080 5a d7 35 6b c0 98 de f4 5b 29 ad b6 6b 98 9e cf Z.5k....[)..k... 0090 2d 6e 51 13 3b d1 4a 14 59 cf 79 27 6f ca 29 27 -nQ.;.J.Y.y'o.)' 00a0 77 ac e6 9e 40 02 ad 91 ca e2 86 91 9d 5a e9 04 w...@........Z.. 00b0 93 93 b2 7b 3d 9e 4f 34 6e 12 82 b5 b0 65 3a ee ...{=.O4n....e:. 00c0 c2 f4 6c aa d0 aa 31 49 bd 8c 6d 4f aa 47 a3 42 ..l...1I..mO.G.B 00d0 25 4a 79 97 37 b7 cc b5 db 52 9d 27 a1 d8 3f 93 %Jy.7....R.'..?. 00e0 31 be 7d bc 7e 07 4c d6 9d 40 41 31 4f dc 47 d9 1.}.~.L..@A1O.G. 00f0 6a 2c a4 22 19 05 18 5a 34 3d e4 18 04 73 ab 5e j,."...Z4=...s.^ 0100 8e b8 bc 87 a1 b3 16 a1 a8 f8 63 37 db 0a e8 d5 ..........c7.... 0110 15 a0 d2 a9 ae fd 12 c0 3e b2 2c 34 24 f4 a7 5e ........>.,4$..^ 0120 51 f0 ce bf 46 cc 4b ec 38 b6 10 3d 96 53 73 0b Q...F.K.8..=.Ss. 0130 d1 e1 75 af 71 8d 1a 7a f9 33 36 25 41 cc 07 bd ..u.q..z.36%A... 0140 1e c0 f7 af a6 2a 3d 3d 10 6a 62 83 12 59 bf b6 .....*==.jb..Y.. 0150 1f 05 f0 04 48 6f 98 29 1a 85 fe 84 55 cd 8b ac ....Ho.)....U... 0160 3a cb e9 d0 f9 f1 7e 01 4b 77 32 f5 3a 97 25 9c :.....~.Kw2.:.%. 0170 14 ae cf 73 17 36 a6 51 51 7c 2e 42 aa 41 bc d1 ...s.6.QQ|.B.A.. 0180 82 d5 5e f4 0c 0f 3c d8 52 bc bf 94 ca 91 45 60 ..^...<.R.....E` 0190 9f 71 61 d7 e8 ed b4 c1 18 4b b8 a7 a8 bb b1 22 .qa......K....." 01a0 a4 10 38 a1 3e 1a 4c ea f1 c3 8c 5c a6 47 e0 1c ..8.>.L....\.G.. 01b0 da b3 5a a7 db ba 79 4b 42 37 d8 8e ba 54 b1 71 ..Z...yKB7...T.q 01c0 ea 3e 7a 6a 66 78 50 03 63 65 3e 3f 6e b6 3f 0f .>zjfxP.ce>?n.?. 01d0 e1 eb 25 dd 63 32 c6 8e 01 a2 aa 5f c6 e0 a1 84 ..%.c2....._.... 01e0 90 e5 51 9d 3e ab d9 b7 19 29 f3 97 77 d9 15 3c ..Q.>....)..w..< 01f0 a8 10 ae a1 4d fe b9 85 60 6b d0 9e 2e 31 e6 ed ....M...`k...1.. 0200 b8 5a 43 74 5d 21 .ZCt]! Frame 12 (326 bytes on wire, 326 bytes captured) Arrival Time: Oct 27, 2009 10:12:34.979633000 [Time delta from previous captured frame: 0.275276000 seconds] [Time delta from previous displayed frame: 0.275276000 seconds] [Time since reference or first frame: 0.855354000 seconds] Frame Number: 12 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Address: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.127 (165.227.249.127), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x01e6 (486) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x390c [correct] [Good: True] [Bad : False] Source: 165.227.249.127 (165.227.249.127) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x2249 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A889D48AD227D9EE Responder cookie: B0988D72A20F372D Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xd707b8d4 Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 48 f8 2f 00 19 e1 68 8e 01 08 00 45 00 ..)H./...h....E. 0010 01 38 01 e6 00 00 40 11 39 0c a5 e3 f9 7f a5 e3 .8....@.9....... 0020 f9 7c 01 f4 01 f4 01 24 22 49 a8 89 d4 8a d2 27 .|.....$"I.....' 0030 d9 ee b0 98 8d 72 a2 0f 37 2d 08 10 20 01 d7 07 .....r..7-.. ... 0040 b8 d4 00 00 01 1c 3f c8 f4 0f 9e 25 33 1b fd 0b ......?....%3... 0050 c4 41 29 46 6d a9 d2 0f 51 cc 18 42 09 7c b3 49 .A)Fm...Q..B.|.I 0060 1c 63 64 78 97 c7 e9 c8 5d b2 dd 62 28 b6 1e c3 .cdx....]..b(... 0070 4f ac e0 87 98 5c 3a af cf bd 9d 66 58 40 74 cb O....\:....fX@t. 0080 4a 3c ae df 12 39 c2 1f 86 fc a3 44 dd 3d fe 0f J<...9.....D.=.. 0090 32 50 dc 14 c0 48 41 2c d3 4f 33 d9 ab f6 e8 ad 2P...HA,.O3..... 00a0 8b 78 93 bf 48 ef 67 e0 8c c8 28 00 99 0c 44 b6 .x..H.g...(...D. 00b0 2d 5a a6 27 ea ce 13 d7 3e 72 62 83 7d 5c 9a 1b -Z.'....>rb.}\.. 00c0 64 0c 8f f1 3a 1e 06 17 c1 93 b2 c5 a1 47 d3 93 d...:........G.. 00d0 86 d1 a0 8f 51 47 6c bb 8b c3 3c 54 a6 69 93 ea ....QGl...... 0070 ea 9c a4 9c a1 e9 e3 90 29 6b d1 3e 35 75 af bd ........)k.>5u.. 0080 e3 f8 34 5f 8a e6 ..4_.. Frame 18 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 27, 2009 10:12:39.280805000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 5.156526000 seconds] Frame Number: 18 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Address: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x000d (13) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b83 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.127 (165.227.249.127) Encapsulating Security Payload ESP SPI: 0xc5a39935 ESP Sequence: 2 0000 00 19 e1 68 8e 01 00 0c 29 48 f8 2f 08 00 45 00 ...h....)H./..E. 0010 00 78 00 0d 00 00 f0 32 8b 83 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 7f c5 a3 99 35 00 00 00 02 ee 25 12 42 f1 4a .....5.....%.B.J 0030 9f c4 a6 39 07 0a a7 0a 39 ba ac 2d a6 5b 8a 4a ...9....9..-.[.J 0040 88 13 89 2e 45 e8 37 56 5d 5a a0 e8 82 38 14 8c ....E.7V]Z...8.. 0050 00 27 16 44 22 cb 8a a5 e3 27 f2 75 f9 95 9c 5b .'.D"....'.u...[ 0060 83 d3 e3 5a 00 ba fb ad 5c 99 11 84 3e e9 c6 a6 ...Z....\...>... 0070 ea 9c a4 9c a1 e9 e3 90 29 6b d1 3e 35 75 af bd ........)k.>5u.. 0080 e3 f8 34 5f 8a e6 ..4_.. Frame 19 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 27, 2009 10:12:39.285449000 [Time delta from previous captured frame: 0.004644000 seconds] [Time delta from previous displayed frame: 0.004644000 seconds] [Time since reference or first frame: 5.161170000 seconds] Frame Number: 19 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Address: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.127 (165.227.249.127), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x7cc5 (31941) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 29 Protocol: ESP (0x32) Header checksum: 0xe1cb [correct] [Good: True] [Bad : False] Source: 165.227.249.127 (165.227.249.127) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0x9772ffe7 ESP Sequence: 1 0000 00 0c 29 48 f8 2f 00 19 e1 68 8e 01 08 00 45 00 ..)H./...h....E. 0010 00 78 7c c5 00 00 1d 32 e1 cb a5 e3 f9 7f a5 e3 .x|....2........ 0020 f9 7c 97 72 ff e7 00 00 00 01 ff fe ff ff ff bf .|.r............ 0030 ff fe ff ff ff d7 ff ff bf ff 9a 8c cf fd 3e fa ..............>. 0040 14 19 77 49 f7 23 53 d1 10 d6 55 71 ac c1 48 87 ..wI.#S...Uq..H. 0050 8b 91 17 b9 2f f7 2b 04 bd 65 4d e7 3b 3b 01 f0 ..../.+..eM.;;.. 0060 59 b0 d0 ab df cc 59 ae 82 75 0d 7e 93 c5 af bc Y.....Y..u.~.... 0070 3a 2e 87 e0 f7 27 34 4c cb 29 ad 8c 9a 69 3c 99 :....'4L.)...i<. 0080 5b cc db 7d 55 c7 [..}U. Frame 20 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 27, 2009 10:12:40.280931000 [Time delta from previous captured frame: 0.995482000 seconds] [Time delta from previous displayed frame: 0.995482000 seconds] [Time since reference or first frame: 6.156652000 seconds] Frame Number: 20 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Address: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x000e (14) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b82 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.127 (165.227.249.127) Encapsulating Security Payload ESP SPI: 0xc5a39935 ESP Sequence: 3 0000 00 19 e1 68 8e 01 00 0c 29 48 f8 2f 08 00 45 00 ...h....)H./..E. 0010 00 78 00 0e 00 00 f0 32 8b 82 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 7f c5 a3 99 35 00 00 00 03 38 da 27 f0 c0 c4 .....5....8.'... 0030 a1 68 1f 70 38 03 1c 1b af 1b 03 0d 7a 05 55 93 .h.p8.......z.U. 0040 26 a5 8a 13 53 d9 21 45 07 75 e7 52 c5 03 e0 b5 &...S.!E.u.R.... 0050 e7 b7 e2 2c fd 3c f8 7a bc 8c f7 ff 9a 8b 6d 89 ...,.<.z......m. 0060 8c 74 29 42 46 24 82 d6 2b e7 1b 50 f2 ba 63 38 .t)BF$..+..P..c8 0070 42 d0 da 88 0c 01 54 bc 45 b1 8b 04 0b 5c de 60 B.....T.E....\.` 0080 fe ad f2 ce f2 4e .....N Frame 21 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 27, 2009 10:12:40.280946000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 6.156667000 seconds] Frame Number: 21 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Address: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x000e (14) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b82 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.127 (165.227.249.127) Encapsulating Security Payload ESP SPI: 0xc5a39935 ESP Sequence: 3 0000 00 19 e1 68 8e 01 00 0c 29 48 f8 2f 08 00 45 00 ...h....)H./..E. 0010 00 78 00 0e 00 00 f0 32 8b 82 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 7f c5 a3 99 35 00 00 00 03 38 da 27 f0 c0 c4 .....5....8.'... 0030 a1 68 1f 70 38 03 1c 1b af 1b 03 0d 7a 05 55 93 .h.p8.......z.U. 0040 26 a5 8a 13 53 d9 21 45 07 75 e7 52 c5 03 e0 b5 &...S.!E.u.R.... 0050 e7 b7 e2 2c fd 3c f8 7a bc 8c f7 ff 9a 8b 6d 89 ...,.<.z......m. 0060 8c 74 29 42 46 24 82 d6 2b e7 1b 50 f2 ba 63 38 .t)BF$..+..P..c8 0070 42 d0 da 88 0c 01 54 bc 45 b1 8b 04 0b 5c de 60 B.....T.E....\.` 0080 fe ad f2 ce f2 4e .....N Frame 22 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 27, 2009 10:12:40.282264000 [Time delta from previous captured frame: 0.001318000 seconds] [Time delta from previous displayed frame: 0.001318000 seconds] [Time since reference or first frame: 6.157985000 seconds] Frame Number: 22 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Address: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.127 (165.227.249.127), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x7cc6 (31942) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 29 Protocol: ESP (0x32) Header checksum: 0xe1ca [correct] [Good: True] [Bad : False] Source: 165.227.249.127 (165.227.249.127) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0x9772ffe7 ESP Sequence: 2 0000 00 0c 29 48 f8 2f 00 19 e1 68 8e 01 08 00 45 00 ..)H./...h....E. 0010 00 78 7c c6 00 00 1d 32 e1 ca a5 e3 f9 7f a5 e3 .x|....2........ 0020 f9 7c 97 72 ff e7 00 00 00 02 0d 7e 93 c5 af bc .|.r.......~.... 0030 3a 2e 87 e0 f7 27 34 4c cb 29 5a 26 69 0d d9 bb :....'4L.)Z&i... 0040 f4 e5 75 19 ec 1a 12 8e 23 1c 4b 02 12 b4 9a 76 ..u.....#.K....v 0050 61 76 3f b7 12 63 7f 53 bf e4 16 4b b8 e5 97 5b av?..c.S...K...[ 0060 08 97 0c 18 59 fd 93 0a 79 d3 4f 0b eb 92 3f 41 ....Y...y.O...?A 0070 b8 01 47 40 85 fd 9e 17 81 34 e2 f9 33 94 9b 63 ..G@.....4..3..c 0080 26 9b 72 4c 66 4b &.rLfK