Frame 1 (326 bytes on wire, 326 bytes captured) Arrival Time: Jan 8, 2010 17:24:27.358341000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaea [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xab49 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A65C32140914D216 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0xA65C32140914D216 Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 1e 2a d4 74 d9 00 0c 29 48 f8 2f 08 00 45 00 ..*.t...)H./..E. 0010 01 38 00 00 40 00 40 11 fa ea a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 86 01 f4 01 f4 01 24 ab 49 a6 5c 32 14 09 14 .......$.I.\2... 0030 d2 16 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 a6 5c 32 14 09 14 .....|.....\2... 0060 d2 16 03 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 2 (326 bytes on wire, 326 bytes captured) Arrival Time: Jan 8, 2010 17:24:27.358352000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 0.000011000 seconds] Frame Number: 2 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaea [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xab49 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A65C32140914D216 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0xA65C32140914D216 Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 1e 2a d4 74 d9 00 0c 29 48 f8 2f 08 00 45 00 ..*.t...)H./..E. 0010 01 38 00 00 40 00 40 11 fa ea a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 86 01 f4 01 f4 01 24 ab 49 a6 5c 32 14 09 14 .......$.I.\2... 0030 d2 16 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 a6 5c 32 14 09 14 .....|.....\2... 0060 d2 16 03 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 3 (174 bytes on wire, 174 bytes captured) Arrival Time: Jan 8, 2010 17:24:27.421888000 [Time delta from previous captured frame: 0.063536000 seconds] [Time delta from previous displayed frame: 0.063536000 seconds] [Time since reference or first frame: 0.063547000 seconds] Frame Number: 3 Frame Length: 174 bytes Capture Length: 174 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 160 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb82 [correct] [Good: True] [Bad : False] Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 140 Checksum: 0x9b73 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A65C32140914D216 Responder cookie: A7C9AF006BEE0998 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 132 Security Association payload Next payload: Vendor ID (13) Payload length: 64 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 52 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 1 SPI: 0x0000000000000000 Transform payload # 0 Next payload: NONE (0) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 48 f8 2f 00 1e 2a d4 74 d9 08 00 45 00 ..)H./..*.t...E. 0010 00 a0 00 00 40 00 40 11 fb 82 a5 e3 f9 86 a5 e3 ....@.@......... 0020 f9 7c 01 f4 01 f4 00 8c 9b 73 a6 5c 32 14 09 14 .|.......s.\2... 0030 d2 16 a7 c9 af 00 6b ee 09 98 01 10 02 00 00 00 ......k......... 0040 00 00 00 00 00 84 0d 00 00 40 00 00 00 01 00 00 .........@...... 0050 00 01 00 00 00 34 00 01 08 01 00 00 00 00 00 00 .....4.......... 0060 00 00 00 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 0d 00 00 14 3b 90 31 dc e4 fc ....p.....;.1... 0090 f8 8b 48 9a 92 39 63 dd 0c 49 00 00 00 14 70 03 ..H..9c..I....p. 00a0 cb c1 09 7d be 9c 26 00 ba 69 83 bc 8b 35 ...}..&..i...5 Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Jan 8, 2010 17:24:27.425751000 [Time delta from previous captured frame: 0.003863000 seconds] [Time delta from previous displayed frame: 0.003863000 seconds] [Time since reference or first frame: 0.067410000 seconds] Frame Number: 4 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb52 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x1fc8 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A65C32140914D216 Responder cookie: A7C9AF006BEE0998 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 1e 2a d4 74 d9 00 0c 29 48 f8 2f 08 00 45 00 ..*.t...)H./..E. 0010 00 d0 00 00 40 00 40 11 fb 52 a5 e3 f9 7c a5 e3 ....@.@..R...|.. 0020 f9 86 01 f4 01 f4 00 bc 1f c8 a6 5c 32 14 09 14 ...........\2... 0030 d2 16 a7 c9 af 00 6b ee 09 98 04 10 02 00 00 00 ......k......... 0040 00 00 00 00 00 b4 0a 00 00 84 c9 37 22 07 00 4f ...........7"..O 0050 d6 05 79 65 97 ff 0b 7f cf bc 01 44 98 cf 3f 07 ..ye.......D..?. 0060 e6 a3 4e 54 b3 dc 19 9a d0 a4 ce be 6c 74 80 73 ..NT........lt.s 0070 6e 80 97 cf 72 bc 21 f5 bb ac 30 be 79 b2 fc cd n...r.!...0.y... 0080 c7 07 13 00 26 1a ef 01 75 0e 75 c6 8a 6f a7 73 ....&...u.u..o.s 0090 19 5e 5f 8f 1a 8b 23 a0 3e d7 51 92 9e 5b aa e4 .^_...#.>.Q..[.. 00a0 3c 5b cc e1 c0 15 15 35 80 fd fc eb 34 00 c7 43 <[.....5....4..C 00b0 f2 82 ce 6e 60 c9 99 df a7 00 ef 68 b4 3f 23 07 ...n`......h.?#. 00c0 a8 8d c6 3b 2d 2e 72 af 82 d1 00 00 00 14 fd 9b ...;-.r......... 00d0 86 50 36 f6 ac 7f 76 a6 ca 8d ec b0 b2 5c .P6...v......\ Frame 5 (222 bytes on wire, 222 bytes captured) Arrival Time: Jan 8, 2010 17:24:27.425764000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 0.067423000 seconds] Frame Number: 5 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb52 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x1fc8 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A65C32140914D216 Responder cookie: A7C9AF006BEE0998 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 1e 2a d4 74 d9 00 0c 29 48 f8 2f 08 00 45 00 ..*.t...)H./..E. 0010 00 d0 00 00 40 00 40 11 fb 52 a5 e3 f9 7c a5 e3 ....@.@..R...|.. 0020 f9 86 01 f4 01 f4 00 bc 1f c8 a6 5c 32 14 09 14 ...........\2... 0030 d2 16 a7 c9 af 00 6b ee 09 98 04 10 02 00 00 00 ......k......... 0040 00 00 00 00 00 b4 0a 00 00 84 c9 37 22 07 00 4f ...........7"..O 0050 d6 05 79 65 97 ff 0b 7f cf bc 01 44 98 cf 3f 07 ..ye.......D..?. 0060 e6 a3 4e 54 b3 dc 19 9a d0 a4 ce be 6c 74 80 73 ..NT........lt.s 0070 6e 80 97 cf 72 bc 21 f5 bb ac 30 be 79 b2 fc cd n...r.!...0.y... 0080 c7 07 13 00 26 1a ef 01 75 0e 75 c6 8a 6f a7 73 ....&...u.u..o.s 0090 19 5e 5f 8f 1a 8b 23 a0 3e d7 51 92 9e 5b aa e4 .^_...#.>.Q..[.. 00a0 3c 5b cc e1 c0 15 15 35 80 fd fc eb 34 00 c7 43 <[.....5....4..C 00b0 f2 82 ce 6e 60 c9 99 df a7 00 ef 68 b4 3f 23 07 ...n`......h.?#. 00c0 a8 8d c6 3b 2d 2e 72 af 82 d1 00 00 00 14 fd 9b ...;-.r......... 00d0 86 50 36 f6 ac 7f 76 a6 ca 8d ec b0 b2 5c .P6...v......\ Frame 6 (242 bytes on wire, 242 bytes captured) Arrival Time: Jan 8, 2010 17:24:27.522073000 [Time delta from previous captured frame: 0.096309000 seconds] [Time delta from previous displayed frame: 0.096309000 seconds] [Time since reference or first frame: 0.163732000 seconds] Frame Number: 6 Frame Length: 242 bytes Capture Length: 242 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb3e [correct] [Good: True] [Bad : False] Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0x608c [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A65C32140914D216 Responder cookie: A7C9AF006BEE0998 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 20 Nonce Data Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 48 f8 2f 00 1e 2a d4 74 d9 08 00 45 00 ..)H./..*.t...E. 0010 00 e4 00 00 40 00 40 11 fb 3e a5 e3 f9 86 a5 e3 ....@.@..>...... 0020 f9 7c 01 f4 01 f4 00 d0 60 8c a6 5c 32 14 09 14 .|......`..\2... 0030 d2 16 a7 c9 af 00 6b ee 09 98 04 10 02 00 00 00 ......k......... 0040 00 00 00 00 00 c8 0a 00 00 84 3d 18 50 60 de 0a ..........=.P`.. 0050 01 e9 84 4f 24 a4 71 8e dc b4 b4 5d 7a 10 2e 1f ...O$.q....]z... 0060 71 ae c1 61 dc 3b 4f 50 6b 22 94 9d 08 c7 f4 59 q..a.;OPk".....Y 0070 c0 fe b2 e3 a8 0f 4a a0 b9 d7 35 78 c3 b0 d9 bf ......J...5x.... 0080 97 76 4b 4c 50 4e f6 80 60 f9 d1 37 0f 93 c9 d4 .vKLPN..`..7.... 0090 45 4f 84 f6 32 76 ce 90 40 e6 51 a5 3a 21 74 63 EO..2v..@.Q.:!tc 00a0 e7 7e c1 64 05 bc 67 74 d8 9f 18 98 c6 ab e8 ab .~.d..gt........ 00b0 69 15 1c 7b 61 aa fb f1 01 6f 3b ac 33 ae 5c 6a i..{a....o;.3.\j 00c0 a7 15 93 18 bb ee 59 9b 9e de 0d 00 00 14 d3 4b ......Y........K 00d0 04 e9 41 41 9d 5e d5 d4 8c d2 bf eb 48 d7 00 00 ..AA.^......H... 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 8, 2010 17:24:27.525613000 [Time delta from previous captured frame: 0.003540000 seconds] [Time delta from previous displayed frame: 0.003540000 seconds] [Time since reference or first frame: 0.167272000 seconds] Frame Number: 7 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbaa [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x3a8a [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A65C32140914D216 Responder cookie: A7C9AF006BEE0998 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 1e 2a d4 74 d9 00 0c 29 48 f8 2f 08 00 45 00 ..*.t...)H./..E. 0010 00 78 00 00 40 00 40 11 fb aa a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 86 01 f4 01 f4 00 64 3a 8a a6 5c 32 14 09 14 .......d:..\2... 0030 d2 16 a7 c9 af 00 6b ee 09 98 05 10 02 01 00 00 ......k......... 0040 00 00 00 00 00 5c a8 39 c5 e9 01 c7 a6 1c 0d 34 .....\.9.......4 0050 07 a6 20 04 78 90 eb e8 eb 03 d0 da 23 2c 97 df .. .x.......#,.. 0060 5d 63 52 03 c0 a1 71 68 2c c1 82 d8 a9 d2 28 2f ]cR...qh,.....(/ 0070 ad 6b d0 b1 e9 5e 50 32 26 04 82 67 17 09 e2 ae .k...^P2&..g.... 0080 a2 fc 4d f7 26 74 ..M.&t Frame 8 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 8, 2010 17:24:27.525626000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 0.167285000 seconds] Frame Number: 8 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbaa [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x3a8a [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A65C32140914D216 Responder cookie: A7C9AF006BEE0998 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 1e 2a d4 74 d9 00 0c 29 48 f8 2f 08 00 45 00 ..*.t...)H./..E. 0010 00 78 00 00 40 00 40 11 fb aa a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 86 01 f4 01 f4 00 64 3a 8a a6 5c 32 14 09 14 .......d:..\2... 0030 d2 16 a7 c9 af 00 6b ee 09 98 05 10 02 01 00 00 ......k......... 0040 00 00 00 00 00 5c a8 39 c5 e9 01 c7 a6 1c 0d 34 .....\.9.......4 0050 07 a6 20 04 78 90 eb e8 eb 03 d0 da 23 2c 97 df .. .x.......#,.. 0060 5d 63 52 03 c0 a1 71 68 2c c1 82 d8 a9 d2 28 2f ]cR...qh,.....(/ 0070 ad 6b d0 b1 e9 5e 50 32 26 04 82 67 17 09 e2 ae .k...^P2&..g.... 0080 a2 fc 4d f7 26 74 ..M.&t Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: Jan 8, 2010 17:24:27.659961000 [Time delta from previous captured frame: 0.134335000 seconds] [Time delta from previous displayed frame: 0.134335000 seconds] [Time since reference or first frame: 0.301620000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbba [correct] [Good: True] [Bad : False] Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xf9fd [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A65C32140914D216 Responder cookie: A7C9AF006BEE0998 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 48 f8 2f 00 1e 2a d4 74 d9 08 00 45 00 ..)H./..*.t...E. 0010 00 68 00 00 40 00 40 11 fb ba a5 e3 f9 86 a5 e3 .h..@.@......... 0020 f9 7c 01 f4 01 f4 00 54 f9 fd a6 5c 32 14 09 14 .|.....T...\2... 0030 d2 16 a7 c9 af 00 6b ee 09 98 05 10 02 01 00 00 ......k......... 0040 00 00 00 00 00 4c 49 27 0a c9 23 7a a8 62 a9 63 .....LI'..#z.b.c 0050 03 88 06 e6 00 37 af 65 7c d8 66 07 45 8c f5 5c .....7.e|.f.E..\ 0060 c7 c6 e1 2a 32 6a 77 37 08 b9 e6 f0 01 1c 88 e0 ...*2jw7........ 0070 9b 56 c9 76 69 40 .V.vi@ Frame 10 (518 bytes on wire, 518 bytes captured) Arrival Time: Jan 8, 2010 17:24:27.665256000 [Time delta from previous captured frame: 0.005295000 seconds] [Time delta from previous displayed frame: 0.005295000 seconds] [Time since reference or first frame: 0.306915000 seconds] Frame Number: 10 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa2a [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0x9e01 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A65C32140914D216 Responder cookie: A7C9AF006BEE0998 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x8a16390f Length: 476 Encrypted payload (448 bytes) 0000 00 1e 2a d4 74 d9 00 0c 29 48 f8 2f 08 00 45 00 ..*.t...)H./..E. 0010 01 f8 00 00 40 00 40 11 fa 2a a5 e3 f9 7c a5 e3 ....@.@..*...|.. 0020 f9 86 01 f4 01 f4 01 e4 9e 01 a6 5c 32 14 09 14 ...........\2... 0030 d2 16 a7 c9 af 00 6b ee 09 98 08 10 20 01 8a 16 ......k..... ... 0040 39 0f 00 00 01 dc 1e ce 2e 85 bb 6b 47 97 b8 1e 9..........kG... 0050 cb da 7b 6f 2f 85 e9 c9 78 07 42 23 20 e8 c0 a9 ..{o/...x.B# ... 0060 4b 66 68 25 7c d0 90 f8 09 96 5f 87 97 36 4f 47 Kfh%|....._..6OG 0070 b2 5c 34 73 2b 8a 09 59 77 03 0d 9f f7 d3 bd 1a .\4s+..Yw....... 0080 39 b6 f2 80 78 d8 49 79 59 c4 e5 1f 87 b2 af 32 9...x.IyY......2 0090 dc 8d ba ce c6 80 7b e2 00 66 11 a2 78 25 5a 2c ......{..f..x%Z, 00a0 16 bc 26 07 40 07 98 cb 59 5b 62 1a 07 88 56 a9 ..&.@...Y[b...V. 00b0 25 03 0f b6 c1 dd 7a ad d2 0b e4 52 95 fa 7b 25 %.....z....R..{% 00c0 20 9b aa db a6 75 03 ea 83 54 17 13 d4 34 2f 82 ....u...T...4/. 00d0 e8 17 90 44 c7 5f fd ce 42 65 43 1c d4 06 b9 51 ...D._..BeC....Q 00e0 cd 24 a8 7f f7 4d 95 b8 e4 8b 5e e7 2b 4d 3e ba .$...M....^.+M>. 00f0 a7 16 f4 0f a0 66 f9 cb 7d eb a5 b8 f2 de bf 6f .....f..}......o 0100 25 02 af e6 a4 90 be 86 ef 51 9d 6b 1c df c2 a4 %........Q.k.... 0110 3c ef a6 14 91 1b 5d 54 34 5e 65 32 b7 3b 66 6a <.....]T4^e2.;fj 0120 54 32 b8 b4 13 e2 9b f2 33 4f 84 00 fd 01 48 56 T2......3O....HV 0130 40 0c ab 79 49 a3 c4 f2 79 6a f3 cf cd 30 19 65 @..yI...yj...0.e 0140 19 0e 11 ff 4e 52 bb ae 46 ea 18 9c 02 07 96 f1 ....NR..F....... 0150 5b d0 02 ef 2c 27 b7 73 ae d5 5e 5d 25 83 b0 56 [...,'.s..^]%..V 0160 90 ff 05 16 9e e7 90 02 6e 2a 90 9b df 21 3f df ........n*...!?. 0170 3d 08 32 c2 f3 05 a5 58 5d 22 17 dc 70 53 ac f5 =.2....X]"..pS.. 0180 93 4f 62 2f 02 20 02 af 46 4e a2 ca 8b 02 18 c8 .Ob/. ..FN...... 0190 52 d9 68 39 af 20 5e c7 b8 62 a2 d3 2f 5b 48 03 R.h9. ^..b../[H. 01a0 96 9a 1a 1a 93 c2 96 53 ac ee 55 5a 97 69 e9 c9 .......S..UZ.i.. 01b0 80 9f a7 60 0f 7b ef 6d 9c 96 8e 9b 04 95 03 ef ...`.{.m........ 01c0 82 40 a6 2d 8e 82 5f 1e 85 26 93 70 a3 e0 63 38 .@.-.._..&.p..c8 01d0 d6 c7 f1 5b c1 b6 0a d0 7b f4 ed 8b 83 b3 7a 04 ...[....{.....z. 01e0 c7 c1 01 e3 72 9f 11 52 21 9e cf 6d f2 6e 28 fc ....r..R!..m.n(. 01f0 a8 e6 1e b4 8e 46 9c 0c f2 54 c1 f3 6b 94 95 22 .....F...T..k.." 0200 ac e5 47 7b 92 2c ..G{., Frame 11 (518 bytes on wire, 518 bytes captured) Arrival Time: Jan 8, 2010 17:24:27.665272000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 0.306931000 seconds] Frame Number: 11 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa2a [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0x9e01 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A65C32140914D216 Responder cookie: A7C9AF006BEE0998 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x8a16390f Length: 476 Encrypted payload (448 bytes) 0000 00 1e 2a d4 74 d9 00 0c 29 48 f8 2f 08 00 45 00 ..*.t...)H./..E. 0010 01 f8 00 00 40 00 40 11 fa 2a a5 e3 f9 7c a5 e3 ....@.@..*...|.. 0020 f9 86 01 f4 01 f4 01 e4 9e 01 a6 5c 32 14 09 14 ...........\2... 0030 d2 16 a7 c9 af 00 6b ee 09 98 08 10 20 01 8a 16 ......k..... ... 0040 39 0f 00 00 01 dc 1e ce 2e 85 bb 6b 47 97 b8 1e 9..........kG... 0050 cb da 7b 6f 2f 85 e9 c9 78 07 42 23 20 e8 c0 a9 ..{o/...x.B# ... 0060 4b 66 68 25 7c d0 90 f8 09 96 5f 87 97 36 4f 47 Kfh%|....._..6OG 0070 b2 5c 34 73 2b 8a 09 59 77 03 0d 9f f7 d3 bd 1a .\4s+..Yw....... 0080 39 b6 f2 80 78 d8 49 79 59 c4 e5 1f 87 b2 af 32 9...x.IyY......2 0090 dc 8d ba ce c6 80 7b e2 00 66 11 a2 78 25 5a 2c ......{..f..x%Z, 00a0 16 bc 26 07 40 07 98 cb 59 5b 62 1a 07 88 56 a9 ..&.@...Y[b...V. 00b0 25 03 0f b6 c1 dd 7a ad d2 0b e4 52 95 fa 7b 25 %.....z....R..{% 00c0 20 9b aa db a6 75 03 ea 83 54 17 13 d4 34 2f 82 ....u...T...4/. 00d0 e8 17 90 44 c7 5f fd ce 42 65 43 1c d4 06 b9 51 ...D._..BeC....Q 00e0 cd 24 a8 7f f7 4d 95 b8 e4 8b 5e e7 2b 4d 3e ba .$...M....^.+M>. 00f0 a7 16 f4 0f a0 66 f9 cb 7d eb a5 b8 f2 de bf 6f .....f..}......o 0100 25 02 af e6 a4 90 be 86 ef 51 9d 6b 1c df c2 a4 %........Q.k.... 0110 3c ef a6 14 91 1b 5d 54 34 5e 65 32 b7 3b 66 6a <.....]T4^e2.;fj 0120 54 32 b8 b4 13 e2 9b f2 33 4f 84 00 fd 01 48 56 T2......3O....HV 0130 40 0c ab 79 49 a3 c4 f2 79 6a f3 cf cd 30 19 65 @..yI...yj...0.e 0140 19 0e 11 ff 4e 52 bb ae 46 ea 18 9c 02 07 96 f1 ....NR..F....... 0150 5b d0 02 ef 2c 27 b7 73 ae d5 5e 5d 25 83 b0 56 [...,'.s..^]%..V 0160 90 ff 05 16 9e e7 90 02 6e 2a 90 9b df 21 3f df ........n*...!?. 0170 3d 08 32 c2 f3 05 a5 58 5d 22 17 dc 70 53 ac f5 =.2....X]"..pS.. 0180 93 4f 62 2f 02 20 02 af 46 4e a2 ca 8b 02 18 c8 .Ob/. ..FN...... 0190 52 d9 68 39 af 20 5e c7 b8 62 a2 d3 2f 5b 48 03 R.h9. ^..b../[H. 01a0 96 9a 1a 1a 93 c2 96 53 ac ee 55 5a 97 69 e9 c9 .......S..UZ.i.. 01b0 80 9f a7 60 0f 7b ef 6d 9c 96 8e 9b 04 95 03 ef ...`.{.m........ 01c0 82 40 a6 2d 8e 82 5f 1e 85 26 93 70 a3 e0 63 38 .@.-.._..&.p..c8 01d0 d6 c7 f1 5b c1 b6 0a d0 7b f4 ed 8b 83 b3 7a 04 ...[....{.....z. 01e0 c7 c1 01 e3 72 9f 11 52 21 9e cf 6d f2 6e 28 fc ....r..R!..m.n(. 01f0 a8 e6 1e b4 8e 46 9c 0c f2 54 c1 f3 6b 94 95 22 .....F...T..k.." 0200 ac e5 47 7b 92 2c ..G{., Frame 12 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 8, 2010 17:24:27.673344000 [Time delta from previous captured frame: 0.008072000 seconds] [Time delta from previous displayed frame: 0.008072000 seconds] [Time since reference or first frame: 0.315003000 seconds] Frame Number: 12 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbaa [correct] [Good: True] [Bad : False] Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x2f5f [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A65C32140914D216 Responder cookie: A7C9AF006BEE0998 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xda634c49 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 48 f8 2f 00 1e 2a d4 74 d9 08 00 45 00 ..)H./..*.t...E. 0010 00 78 00 00 40 00 40 11 fb aa a5 e3 f9 86 a5 e3 .x..@.@......... 0020 f9 7c 01 f4 01 f4 00 64 2f 5f a6 5c 32 14 09 14 .|.....d/_.\2... 0030 d2 16 a7 c9 af 00 6b ee 09 98 08 10 05 01 da 63 ......k........c 0040 4c 49 00 00 00 5c 6d 56 1e 99 34 2d 8c bb bf cd LI...\mV..4-.... 0050 5a 6f 46 23 93 c0 6b 43 38 ec 45 d7 24 ef 92 9e ZoF#..kC8.E.$... 0060 cb 67 5d 9b 5f c9 9e 74 32 20 03 77 90 b2 48 e3 .g]._..t2 .w..H. 0070 fc 02 16 ee 4a d6 84 86 1d d8 f2 54 06 6c 09 ae ....J......T.l.. 0080 1f 57 aa ec f3 38 .W...8 Frame 13 (342 bytes on wire, 342 bytes captured) Arrival Time: Jan 8, 2010 17:24:27.924995000 [Time delta from previous captured frame: 0.251651000 seconds] [Time delta from previous displayed frame: 0.251651000 seconds] [Time since reference or first frame: 0.566654000 seconds] Frame Number: 13 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfada [correct] [Good: True] [Bad : False] Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x3b4c [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A65C32140914D216 Responder cookie: A7C9AF006BEE0998 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x8a16390f Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 48 f8 2f 00 1e 2a d4 74 d9 08 00 45 00 ..)H./..*.t...E. 0010 01 48 00 00 40 00 40 11 fa da a5 e3 f9 86 a5 e3 .H..@.@......... 0020 f9 7c 01 f4 01 f4 01 34 3b 4c a6 5c 32 14 09 14 .|.....4;L.\2... 0030 d2 16 a7 c9 af 00 6b ee 09 98 08 10 20 01 8a 16 ......k..... ... 0040 39 0f 00 00 01 2c 46 95 41 e0 61 53 a3 32 22 91 9....,F.A.aS.2". 0050 9e 2d 61 81 aa 60 45 77 7d 8d 90 98 23 f2 c3 0e .-a..`Ew}...#... 0060 d1 43 61 8b 98 49 14 66 6f a3 2c 30 ea 2f 6c 88 .Ca..I.fo.,0./l. 0070 fa 81 78 fc c0 14 93 ce e2 f4 a3 54 03 3a 7b 8e ..x........T.:{. 0080 2f b8 ba 27 ee a4 34 16 55 4f 55 97 2a 41 9a 43 /..'..4.UOU.*A.C 0090 73 40 d8 ad 60 77 c7 2c be ee 05 fc 62 45 3e 51 s@..`w.,....bE>Q 00a0 3c 1d 53 95 e2 34 33 3f 76 99 ed fe 8f 83 28 a8 <.S..43?v.....(. 00b0 c9 98 21 25 42 9c ce 5d 28 b7 33 d5 8b 9c fe a5 ..!%B..](.3..... 00c0 21 b0 35 03 0e bd 9f a9 a9 3c 7f 5d 14 a3 6a 91 !.5......<.]..j. 00d0 e7 f3 2b b0 8e 48 30 7b 34 a9 ab a6 ea d6 c3 61 ..+..H0{4......a 00e0 8e fa 82 a4 22 16 b9 6a ef 47 70 8e 8f 31 c3 42 ...."..j.Gp..1.B 00f0 71 3b 4a 9b d2 03 33 88 4e c8 86 66 9a f7 d7 c7 q;J...3.N..f.... 0100 33 ff 41 90 fa 72 4b 79 c1 05 c5 b1 38 46 22 90 3.A..rKy....8F". 0110 a0 70 e2 6a 01 fc 2c dc 32 e9 2c 40 24 ed 96 67 .p.j..,.2.,@$..g 0120 79 bd bd d9 1f 73 5c fd 13 c5 97 fe 86 dd 94 d1 y....s\......... 0130 37 9b bd e2 92 6f 62 40 b7 f3 75 48 ca 1e 0b b6 7....ob@..uH.... 0140 c1 15 ca e9 04 1d d9 ca 90 f7 5a bb 69 eb c8 9b ..........Z.i... 0150 25 36 16 d4 9a 3d %6...= Frame 14 (102 bytes on wire, 102 bytes captured) Arrival Time: Jan 8, 2010 17:24:27.927721000 [Time delta from previous captured frame: 0.002726000 seconds] [Time delta from previous displayed frame: 0.002726000 seconds] [Time since reference or first frame: 0.569380000 seconds] Frame Number: 14 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbca [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xafda [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A65C32140914D216 Responder cookie: A7C9AF006BEE0998 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x8a16390f Length: 60 Encrypted payload (32 bytes) 0000 00 1e 2a d4 74 d9 00 0c 29 48 f8 2f 08 00 45 00 ..*.t...)H./..E. 0010 00 58 00 00 40 00 40 11 fb ca a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 86 01 f4 01 f4 00 44 af da a6 5c 32 14 09 14 .......D...\2... 0030 d2 16 a7 c9 af 00 6b ee 09 98 08 10 20 01 8a 16 ......k..... ... 0040 39 0f 00 00 00 3c 25 d7 c2 ea 5b b6 4b 93 1f c3 9....<%...[.K... 0050 6d f5 a8 8b 5c df b3 d0 76 d6 07 54 7b f7 6e ba m...\...v..T{.n. 0060 64 33 d1 90 2b d9 d3..+. Frame 15 (102 bytes on wire, 102 bytes captured) Arrival Time: Jan 8, 2010 17:24:27.927735000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 0.569394000 seconds] Frame Number: 15 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbca [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xafda [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A65C32140914D216 Responder cookie: A7C9AF006BEE0998 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x8a16390f Length: 60 Encrypted payload (32 bytes) 0000 00 1e 2a d4 74 d9 00 0c 29 48 f8 2f 08 00 45 00 ..*.t...)H./..E. 0010 00 58 00 00 40 00 40 11 fb ca a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 86 01 f4 01 f4 00 44 af da a6 5c 32 14 09 14 .......D...\2... 0030 d2 16 a7 c9 af 00 6b ee 09 98 08 10 20 01 8a 16 ......k..... ... 0040 39 0f 00 00 00 3c 25 d7 c2 ea 5b b6 4b 93 1f c3 9....<%...[.K... 0050 6d f5 a8 8b 5c df b3 d0 76 d6 07 54 7b f7 6e ba m...\...v..T{.n. 0060 64 33 d1 90 2b d9 d3..+. Frame 16 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 8, 2010 17:24:28.210179000 [Time delta from previous captured frame: 0.282444000 seconds] [Time delta from previous displayed frame: 0.282444000 seconds] [Time since reference or first frame: 0.851838000 seconds] Frame Number: 16 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0023 (35) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b66 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.134 (165.227.249.134) Encapsulating Security Payload ESP SPI: 0x0b530117 ESP Sequence: 1 0000 00 1e 2a d4 74 d9 00 0c 29 48 f8 2f 08 00 45 00 ..*.t...)H./..E. 0010 00 78 00 23 00 00 f0 32 8b 66 a5 e3 f9 7c a5 e3 .x.#...2.f...|.. 0020 f9 86 0b 53 01 17 00 00 00 01 a7 b8 32 af f7 e1 ...S........2... 0030 46 7d 9e 64 61 2f a7 16 4e 3d b5 08 c2 01 b5 e2 F}.da/..N=...... 0040 bc ae 4b 9d c2 61 84 3e f4 bb 6d 0d 9e ce 28 b0 ..K..a.>..m...(. 0050 93 ec 07 0e 15 97 7f 65 9f 82 f8 7a ae f4 e0 d2 .......e...z.... 0060 8c eb 65 32 31 41 fe 2d 3d 0e 99 6e 4e 3e 54 57 ..e21A.-=..nN>TW 0070 96 f3 f2 ea 20 2a f1 e5 d9 f4 d8 21 3c 7a 7a 1e .... *.....!..m...(. 0050 93 ec 07 0e 15 97 7f 65 9f 82 f8 7a ae f4 e0 d2 .......e...z.... 0060 8c eb 65 32 31 41 fe 2d 3d 0e 99 6e 4e 3e 54 57 ..e21A.-=..nN>TW 0070 96 f3 f2 ea 20 2a f1 e5 d9 f4 d8 21 3c 7a 7a 1e .... *.....!^dx...].~...' 0070 ac 5a 1a 4f d7 92 0c d9 9e 51 a9 a8 b4 f5 48 87 .Z.O.....Q....H. 0080 6a 8f 90 a4 49 13 j...I. Frame 22 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 8, 2010 17:24:29.338880000 [Time delta from previous captured frame: 0.997684000 seconds] [Time delta from previous displayed frame: 0.997684000 seconds] [Time since reference or first frame: 1.980539000 seconds] Frame Number: 22 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0025 (37) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b64 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.134 (165.227.249.134) Encapsulating Security Payload ESP SPI: 0x0b530117 ESP Sequence: 3 0000 00 1e 2a d4 74 d9 00 0c 29 48 f8 2f 08 00 45 00 ..*.t...)H./..E. 0010 00 78 00 25 00 00 f0 32 8b 64 a5 e3 f9 7c a5 e3 .x.%...2.d...|.. 0020 f9 86 0b 53 01 17 00 00 00 03 57 2a a2 9f cc 79 ...S......W*...y 0030 40 d9 c7 87 2f b4 6d d5 6a 15 6d f8 98 b3 18 82 @.../.m.j.m..... 0040 db a6 a5 bf f3 f3 29 c2 21 7d 54 83 49 5c ac 2d ......).!}T.I\.- 0050 f4 b4 f5 3b 02 c3 9d dd fb 92 de db 41 b2 f6 1d ...;........A... 0060 7f f4 5a 54 35 dd 2f c4 29 7a b4 a5 8b cc 06 50 ..ZT5./.)z.....P 0070 95 3f da e8 83 12 a3 06 18 36 1e f6 d3 5e 07 16 .?.......6...^.. 0080 fd d5 f2 8e 10 85 ...... Frame 23 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 8, 2010 17:24:29.338895000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 1.980554000 seconds] Frame Number: 23 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Destination: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0025 (37) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b64 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.134 (165.227.249.134) Encapsulating Security Payload ESP SPI: 0x0b530117 ESP Sequence: 3 0000 00 1e 2a d4 74 d9 00 0c 29 48 f8 2f 08 00 45 00 ..*.t...)H./..E. 0010 00 78 00 25 00 00 f0 32 8b 64 a5 e3 f9 7c a5 e3 .x.%...2.d...|.. 0020 f9 86 0b 53 01 17 00 00 00 03 57 2a a2 9f cc 79 ...S......W*...y 0030 40 d9 c7 87 2f b4 6d d5 6a 15 6d f8 98 b3 18 82 @.../.m.j.m..... 0040 db a6 a5 bf f3 f3 29 c2 21 7d 54 83 49 5c ac 2d ......).!}T.I\.- 0050 f4 b4 f5 3b 02 c3 9d dd fb 92 de db 41 b2 f6 1d ...;........A... 0060 7f f4 5a 54 35 dd 2f c4 29 7a b4 a5 8b cc 06 50 ..ZT5./.)z.....P 0070 95 3f da e8 83 12 a3 06 18 36 1e f6 d3 5e 07 16 .?.......6...^.. 0080 fd d5 f2 8e 10 85 ...... Frame 24 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 8, 2010 17:24:29.340196000 [Time delta from previous captured frame: 0.001301000 seconds] [Time delta from previous displayed frame: 0.001301000 seconds] [Time since reference or first frame: 1.981855000 seconds] Frame Number: 24 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) Address: 00:1e:2a:d4:74:d9 (00:1e:2a:d4:74:d9) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0xdbe2 (56290) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x5fa7 [correct] [Good: True] [Bad : False] Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0xdf611603 ESP Sequence: 3 0000 00 0c 29 48 f8 2f 00 1e 2a d4 74 d9 08 00 45 00 ..)H./..*.t...E. 0010 00 78 db e2 00 00 40 32 5f a7 a5 e3 f9 86 a5 e3 .x....@2_....... 0020 f9 7c df 61 16 03 00 00 00 03 95 7e 9e 8c b6 27 .|.a.......~...' 0030 ac 5a 1a 4f d7 92 0c d9 9e 51 08 ee 4c f2 96 82 .Z.O.....Q..L... 0040 0b 00 2d 40 05 87 e9 10 df f8 6c 54 2f 0c 9c de ..-@......lT/... 0050 30 3b 2a 98 41 80 b6 31 b1 f6 f4 27 e9 20 ab 39 0;*.A..1...'. .9 0060 6c ce 36 41 6c 44 40 0b 20 de 85 dd f9 8a a1 02 l.6AlD@. ....... 0070 0b 7e 69 e4 4a 06 92 86 1d 41 7b 6d e7 ed f9 21 .~i.J....A{m...! 0080 66 23 44 73 8b f4 f#Ds..