Frame 1 (326 bytes on wire, 326 bytes captured) Arrival Time: Oct 26, 2009 14:38:17.965147000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfae2 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xe748 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 67A47BE1A4F98D18 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0x67A47BE1A4F98D18 Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0f 3d 55 af ff 00 0c 29 48 f8 2f 08 00 45 00 ..=U....)H./..E. 0010 01 38 00 00 40 00 40 11 fa e2 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 8e 01 f4 01 f4 01 24 e7 48 67 a4 7b e1 a4 f9 .......$.Hg.{... 0030 8d 18 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 67 a4 7b e1 a4 f9 .....|....g.{... 0060 8d 18 03 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 2 (326 bytes on wire, 326 bytes captured) Arrival Time: Oct 26, 2009 14:38:17.965154000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 0.000007000 seconds] Frame Number: 2 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfae2 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xe748 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 67A47BE1A4F98D18 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0x67A47BE1A4F98D18 Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0f 3d 55 af ff 00 0c 29 48 f8 2f 08 00 45 00 ..=U....)H./..E. 0010 01 38 00 00 40 00 40 11 fa e2 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 8e 01 f4 01 f4 01 24 e7 48 67 a4 7b e1 a4 f9 .......$.Hg.{... 0030 8d 18 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 67 a4 7b e1 a4 f9 .....|....g.{... 0060 8d 18 03 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 3 (146 bytes on wire, 146 bytes captured) Arrival Time: Oct 26, 2009 14:38:17.969694000 [Time delta from previous captured frame: 0.004540000 seconds] [Time delta from previous displayed frame: 0.004540000 seconds] [Time since reference or first frame: 0.004547000 seconds] Frame Number: 3 Frame Length: 146 bytes Capture Length: 146 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.142 (165.227.249.142), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0xba4c (47692) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0xc249 [correct] [Good: True] [Bad : False] Source: 165.227.249.142 (165.227.249.142) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0x644c [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 67A47BE1A4F98D18 Responder cookie: DD3CF4A81684FB87 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 44 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 0 Next payload: NONE (0) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 48 f8 2f 00 0f 3d 55 af ff 08 00 45 00 ..)H./..=U....E. 0010 00 84 ba 4c 00 00 ff 11 c2 49 a5 e3 f9 8e a5 e3 ...L.....I...... 0020 f9 7c 01 f4 01 f4 00 70 64 4c 67 a4 7b e1 a4 f9 .|.....pdLg.{... 0030 8d 18 dd 3c f4 a8 16 84 fb 87 01 10 02 00 00 00 ...<............ 0040 00 00 00 00 00 68 0d 00 00 38 00 00 00 01 00 00 .....h...8...... 0050 00 01 00 00 00 2c 00 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 00 00 ............p... 0080 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 0090 01 00 .. Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Oct 26, 2009 14:38:17.972423000 [Time delta from previous captured frame: 0.002729000 seconds] [Time delta from previous displayed frame: 0.002729000 seconds] [Time since reference or first frame: 0.007276000 seconds] Frame Number: 4 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb4a [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x240f [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 67A47BE1A4F98D18 Responder cookie: DD3CF4A81684FB87 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 0f 3d 55 af ff 00 0c 29 48 f8 2f 08 00 45 00 ..=U....)H./..E. 0010 00 d0 00 00 40 00 40 11 fb 4a a5 e3 f9 7c a5 e3 ....@.@..J...|.. 0020 f9 8e 01 f4 01 f4 00 bc 24 0f 67 a4 7b e1 a4 f9 ........$.g.{... 0030 8d 18 dd 3c f4 a8 16 84 fb 87 04 10 02 00 00 00 ...<............ 0040 00 00 00 00 00 b4 0a 00 00 84 f7 24 8d 23 5b 3d ...........$.#[= 0050 d8 f1 a4 03 34 77 b0 09 2b e9 40 73 0e 9b 8f 76 ....4w..+.@s...v 0060 42 7a 5f 4c 32 b6 5a 6e 73 d3 16 dc 9c 85 e7 90 Bz_L2.Zns....... 0070 f0 84 d5 3a d0 35 b9 d7 c0 09 a8 75 84 c7 f8 56 ...:.5.....u...V 0080 ae 95 51 b2 88 77 c1 21 d4 e5 cb 6d 10 d0 c0 7d ..Q..w.!...m...} 0090 63 49 b0 75 a2 49 12 33 a6 05 58 2d 9f b2 45 2f cI.u.I.3..X-..E/ 00a0 f6 59 5e 9d 4a 65 02 e5 23 34 b7 02 d0 28 96 9f .Y^.Je..#4...(.. 00b0 a5 6d cd de ab e7 a0 b7 8c 5e 5d ba 28 01 c6 70 .m.......^].(..p 00c0 72 b8 4b 73 b3 7a a9 9c a3 9c 00 00 00 14 11 5c r.Ks.z.........\ 00d0 99 53 b6 ad 35 e4 90 b7 a6 41 e1 83 7d 16 .S..5....A..}. Frame 5 (222 bytes on wire, 222 bytes captured) Arrival Time: Oct 26, 2009 14:38:17.972431000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 0.007284000 seconds] Frame Number: 5 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb4a [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x240f [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 67A47BE1A4F98D18 Responder cookie: DD3CF4A81684FB87 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 0f 3d 55 af ff 00 0c 29 48 f8 2f 08 00 45 00 ..=U....)H./..E. 0010 00 d0 00 00 40 00 40 11 fb 4a a5 e3 f9 7c a5 e3 ....@.@..J...|.. 0020 f9 8e 01 f4 01 f4 00 bc 24 0f 67 a4 7b e1 a4 f9 ........$.g.{... 0030 8d 18 dd 3c f4 a8 16 84 fb 87 04 10 02 00 00 00 ...<............ 0040 00 00 00 00 00 b4 0a 00 00 84 f7 24 8d 23 5b 3d ...........$.#[= 0050 d8 f1 a4 03 34 77 b0 09 2b e9 40 73 0e 9b 8f 76 ....4w..+.@s...v 0060 42 7a 5f 4c 32 b6 5a 6e 73 d3 16 dc 9c 85 e7 90 Bz_L2.Zns....... 0070 f0 84 d5 3a d0 35 b9 d7 c0 09 a8 75 84 c7 f8 56 ...:.5.....u...V 0080 ae 95 51 b2 88 77 c1 21 d4 e5 cb 6d 10 d0 c0 7d ..Q..w.!...m...} 0090 63 49 b0 75 a2 49 12 33 a6 05 58 2d 9f b2 45 2f cI.u.I.3..X-..E/ 00a0 f6 59 5e 9d 4a 65 02 e5 23 34 b7 02 d0 28 96 9f .Y^.Je..#4...(.. 00b0 a5 6d cd de ab e7 a0 b7 8c 5e 5d ba 28 01 c6 70 .m.......^].(..p 00c0 72 b8 4b 73 b3 7a a9 9c a3 9c 00 00 00 14 11 5c r.Ks.z.........\ 00d0 99 53 b6 ad 35 e4 90 b7 a6 41 e1 83 7d 16 .S..5....A..}. Frame 6 (222 bytes on wire, 222 bytes captured) Arrival Time: Oct 26, 2009 14:38:18.269874000 [Time delta from previous captured frame: 0.297443000 seconds] [Time delta from previous displayed frame: 0.297443000 seconds] [Time since reference or first frame: 0.304727000 seconds] Frame Number: 6 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.142 (165.227.249.142), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x534b (21323) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x28ff [correct] [Good: True] [Bad : False] Source: 165.227.249.142 (165.227.249.142) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x1f67 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 67A47BE1A4F98D18 Responder cookie: DD3CF4A81684FB87 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 0c 29 48 f8 2f 00 0f 3d 55 af ff 08 00 45 00 ..)H./..=U....E. 0010 00 d0 53 4b 00 00 ff 11 28 ff a5 e3 f9 8e a5 e3 ..SK....(....... 0020 f9 7c 01 f4 01 f4 00 bc 1f 67 67 a4 7b e1 a4 f9 .|.......gg.{... 0030 8d 18 dd 3c f4 a8 16 84 fb 87 04 10 02 00 00 00 ...<............ 0040 00 00 00 00 00 b4 0a 00 00 84 b9 de 09 4f 60 a2 .............O`. 0050 46 00 91 c8 ba c1 d8 31 3f 60 5b dd 09 3c ad 1f F......1?`[..<.. 0060 36 87 af e5 90 9a e7 22 5d 23 46 f9 c9 ec da 88 6......"]#F..... 0070 a8 0f d9 42 05 19 55 bc 1e 9f 22 7e 18 0b c7 23 ...B..U..."~...# 0080 d6 ff f5 69 3e 04 1d 29 39 74 3f d7 b8 49 65 78 ...i>..)9t?..Iex 0090 db 85 2d a0 d9 77 45 dd f3 7f 56 49 a5 fa cd d1 ..-..wE...VI.... 00a0 8d 2f ca 43 2d 8b 26 36 c9 e3 63 a3 35 2d 0a d2 ./.C-.&6..c.5-.. 00b0 90 22 83 40 9f 3a 35 5a 7d 0e bb 15 21 ff 38 3d .".@.:5Z}...!.8= 00c0 ab 81 96 69 ce 44 9e 14 e5 64 00 00 00 14 ff 32 ...i.D...d.....2 00d0 1c 59 09 a9 7d e1 5d a4 78 6a b2 7d 17 02 .Y..}.].xj.}.. Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 14:38:18.274519000 [Time delta from previous captured frame: 0.004645000 seconds] [Time delta from previous displayed frame: 0.004645000 seconds] [Time since reference or first frame: 0.309372000 seconds] Frame Number: 7 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba2 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xc228 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 67A47BE1A4F98D18 Responder cookie: DD3CF4A81684FB87 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0f 3d 55 af ff 00 0c 29 48 f8 2f 08 00 45 00 ..=U....)H./..E. 0010 00 78 00 00 40 00 40 11 fb a2 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 8e 01 f4 01 f4 00 64 c2 28 67 a4 7b e1 a4 f9 .......d.(g.{... 0030 8d 18 dd 3c f4 a8 16 84 fb 87 05 10 02 01 00 00 ...<............ 0040 00 00 00 00 00 5c 0f de 76 ea f3 34 b9 1c e7 27 .....\..v..4...' 0050 18 33 3d 5a 21 d9 95 56 6b 1a 8c ca 2c 0d cd f5 .3=Z!..Vk...,... 0060 d7 6b 78 4c 89 84 a2 14 69 ed 79 a7 3d 28 78 9a .kxL....i.y.=(x. 0070 d7 97 ba 6c d3 d4 a5 6b 08 af 9c c0 28 ba b6 a3 ...l...k....(... 0080 55 7e cb c3 1a 67 U~...g Frame 8 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 14:38:18.274541000 [Time delta from previous captured frame: 0.000022000 seconds] [Time delta from previous displayed frame: 0.000022000 seconds] [Time since reference or first frame: 0.309394000 seconds] Frame Number: 8 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba2 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xc228 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 67A47BE1A4F98D18 Responder cookie: DD3CF4A81684FB87 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0f 3d 55 af ff 00 0c 29 48 f8 2f 08 00 45 00 ..=U....)H./..E. 0010 00 78 00 00 40 00 40 11 fb a2 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 8e 01 f4 01 f4 00 64 c2 28 67 a4 7b e1 a4 f9 .......d.(g.{... 0030 8d 18 dd 3c f4 a8 16 84 fb 87 05 10 02 01 00 00 ...<............ 0040 00 00 00 00 00 5c 0f de 76 ea f3 34 b9 1c e7 27 .....\..v..4...' 0050 18 33 3d 5a 21 d9 95 56 6b 1a 8c ca 2c 0d cd f5 .3=Z!..Vk...,... 0060 d7 6b 78 4c 89 84 a2 14 69 ed 79 a7 3d 28 78 9a .kxL....i.y.=(x. 0070 d7 97 ba 6c d3 d4 a5 6b 08 af 9c c0 28 ba b6 a3 ...l...k....(... 0080 55 7e cb c3 1a 67 U~...g Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: Oct 26, 2009 14:38:18.282747000 [Time delta from previous captured frame: 0.008206000 seconds] [Time delta from previous displayed frame: 0.008206000 seconds] [Time since reference or first frame: 0.317600000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.142 (165.227.249.142), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x1f4c (8012) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x5d66 [correct] [Good: True] [Bad : False] Source: 165.227.249.142 (165.227.249.142) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x4ef2 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 67A47BE1A4F98D18 Responder cookie: DD3CF4A81684FB87 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 48 f8 2f 00 0f 3d 55 af ff 08 00 45 00 ..)H./..=U....E. 0010 00 68 1f 4c 00 00 ff 11 5d 66 a5 e3 f9 8e a5 e3 .h.L....]f...... 0020 f9 7c 01 f4 01 f4 00 54 4e f2 67 a4 7b e1 a4 f9 .|.....TN.g.{... 0030 8d 18 dd 3c f4 a8 16 84 fb 87 05 10 02 01 00 00 ...<............ 0040 00 00 00 00 00 4c e1 0d c7 b9 4b a4 0f 12 9e 45 .....L....K....E 0050 7d 62 0b 94 17 89 3d ed 89 80 dc 57 23 ca 33 fa }b....=....W#.3. 0060 ed 1c 4e 32 77 81 6d 50 1b 64 f2 ba 29 1a 49 be ..N2w.mP.d..).I. 0070 86 2f 63 b1 a3 eb ./c... Frame 10 (518 bytes on wire, 518 bytes captured) Arrival Time: Oct 26, 2009 14:38:18.292560000 [Time delta from previous captured frame: 0.009813000 seconds] [Time delta from previous displayed frame: 0.009813000 seconds] [Time since reference or first frame: 0.327413000 seconds] Frame Number: 10 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa22 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0xfefd [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 67A47BE1A4F98D18 Responder cookie: DD3CF4A81684FB87 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x0a0df1de Length: 476 Encrypted payload (448 bytes) 0000 00 0f 3d 55 af ff 00 0c 29 48 f8 2f 08 00 45 00 ..=U....)H./..E. 0010 01 f8 00 00 40 00 40 11 fa 22 a5 e3 f9 7c a5 e3 ....@.@.."...|.. 0020 f9 8e 01 f4 01 f4 01 e4 fe fd 67 a4 7b e1 a4 f9 ..........g.{... 0030 8d 18 dd 3c f4 a8 16 84 fb 87 08 10 20 01 0a 0d ...<........ ... 0040 f1 de 00 00 01 dc 60 d9 23 45 50 e5 11 cc 77 30 ......`.#EP...w0 0050 15 33 98 f6 85 88 d8 fe f0 e5 2f c7 38 12 c4 0c .3......../.8... 0060 b6 5a e8 28 ae 63 e1 25 30 7c a7 da c2 a2 d3 a9 .Z.(.c.%0|...... 0070 87 a9 28 c0 34 52 a9 28 64 60 39 99 74 a3 33 f0 ..(.4R.(d`9.t.3. 0080 1e 6f c7 41 c5 63 86 71 5a 80 af 7b 23 f0 df a3 .o.A.c.qZ..{#... 0090 9e 69 15 b0 34 4b 3a 0b 47 d4 df 15 76 49 31 56 .i..4K:.G...vI1V 00a0 b3 26 49 9f b2 6d 25 25 5f 3d e2 12 e9 44 4b ee .&I..m%%_=...DK. 00b0 b4 31 4a 45 a5 e3 c5 ae f6 4a cf 08 55 cc a5 62 .1JE.....J..U..b 00c0 2a 3a f1 74 55 0e 18 14 a6 2e 5b f8 ff 81 56 93 *:.tU.....[...V. 00d0 4f e7 51 b6 61 f7 6d a0 5f e6 7d 8f 2d 41 2f d0 O.Q.a.m._.}.-A/. 00e0 43 d8 d7 5d 2f a1 e2 00 ff 05 85 6e ee af 12 17 C..]/......n.... 00f0 e5 37 df f7 9e c8 f0 28 4a bf 8f e2 3a ea c6 73 .7.....(J...:..s 0100 95 31 21 a6 57 6b cf b4 e4 8e 01 52 03 da f7 d5 .1!.Wk.....R.... 0110 f4 09 b6 0b e0 9d f4 01 d6 64 81 9f 4c 8a 09 88 .........d..L... 0120 11 7f 6e a8 7a f6 77 89 e0 74 fa c4 7a 0f a2 b3 ..n.z.w..t..z... 0130 19 a5 fd 00 28 cf 6b 14 3e 8e df a7 38 c0 bc 49 ....(.k.>...8..I 0140 91 2c 30 f7 81 22 cb 25 92 b7 4b db 3b f0 a9 21 .,0..".%..K.;..! 0150 01 1d 4c 15 57 af c8 51 3f cb e9 a3 76 f5 af 57 ..L.W..Q?...v..W 0160 9e c2 a4 98 db a6 97 14 4a 5a 62 52 fb 9a 5d 36 ........JZbR..]6 0170 bb 65 8b ae d9 3a ca 34 c7 97 fa 15 0f 00 6b 9b .e...:.4......k. 0180 c0 67 2f 85 10 13 7d 8f 0c 3f 03 56 ce 95 c6 e2 .g/...}..?.V.... 0190 3e aa 70 da 7c d2 ac 2c 04 48 bc 52 43 59 f3 ae >.p.|..,.H.RCY.. 01a0 ce f2 4f 8b 38 b3 a5 c2 c8 76 93 e5 7d 87 af c3 ..O.8....v..}... 01b0 cf 71 e0 8f 70 c8 ad 22 66 2a b6 dd 59 f8 60 da .q..p.."f*..Y.`. 01c0 3e db 13 10 cd bd 84 f6 a4 e4 e0 37 ba bd 9d fc >..........7.... 01d0 ee de 39 27 f2 70 76 f4 e8 79 5e a5 5e 21 b5 94 ..9'.pv..y^.^!.. 01e0 e2 52 e5 e2 ad 35 a2 fb 5d 7a 03 4f 74 26 9e 47 .R...5..]z.Ot&.G 01f0 82 ad 12 c5 ba 16 96 b3 c3 f9 c4 dd 76 31 7c ea ............v1|. 0200 89 bd 94 68 6d f9 ...hm. Frame 11 (518 bytes on wire, 518 bytes captured) Arrival Time: Oct 26, 2009 14:38:18.292573000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 0.327426000 seconds] Frame Number: 11 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa22 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0xfefd [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 67A47BE1A4F98D18 Responder cookie: DD3CF4A81684FB87 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x0a0df1de Length: 476 Encrypted payload (448 bytes) 0000 00 0f 3d 55 af ff 00 0c 29 48 f8 2f 08 00 45 00 ..=U....)H./..E. 0010 01 f8 00 00 40 00 40 11 fa 22 a5 e3 f9 7c a5 e3 ....@.@.."...|.. 0020 f9 8e 01 f4 01 f4 01 e4 fe fd 67 a4 7b e1 a4 f9 ..........g.{... 0030 8d 18 dd 3c f4 a8 16 84 fb 87 08 10 20 01 0a 0d ...<........ ... 0040 f1 de 00 00 01 dc 60 d9 23 45 50 e5 11 cc 77 30 ......`.#EP...w0 0050 15 33 98 f6 85 88 d8 fe f0 e5 2f c7 38 12 c4 0c .3......../.8... 0060 b6 5a e8 28 ae 63 e1 25 30 7c a7 da c2 a2 d3 a9 .Z.(.c.%0|...... 0070 87 a9 28 c0 34 52 a9 28 64 60 39 99 74 a3 33 f0 ..(.4R.(d`9.t.3. 0080 1e 6f c7 41 c5 63 86 71 5a 80 af 7b 23 f0 df a3 .o.A.c.qZ..{#... 0090 9e 69 15 b0 34 4b 3a 0b 47 d4 df 15 76 49 31 56 .i..4K:.G...vI1V 00a0 b3 26 49 9f b2 6d 25 25 5f 3d e2 12 e9 44 4b ee .&I..m%%_=...DK. 00b0 b4 31 4a 45 a5 e3 c5 ae f6 4a cf 08 55 cc a5 62 .1JE.....J..U..b 00c0 2a 3a f1 74 55 0e 18 14 a6 2e 5b f8 ff 81 56 93 *:.tU.....[...V. 00d0 4f e7 51 b6 61 f7 6d a0 5f e6 7d 8f 2d 41 2f d0 O.Q.a.m._.}.-A/. 00e0 43 d8 d7 5d 2f a1 e2 00 ff 05 85 6e ee af 12 17 C..]/......n.... 00f0 e5 37 df f7 9e c8 f0 28 4a bf 8f e2 3a ea c6 73 .7.....(J...:..s 0100 95 31 21 a6 57 6b cf b4 e4 8e 01 52 03 da f7 d5 .1!.Wk.....R.... 0110 f4 09 b6 0b e0 9d f4 01 d6 64 81 9f 4c 8a 09 88 .........d..L... 0120 11 7f 6e a8 7a f6 77 89 e0 74 fa c4 7a 0f a2 b3 ..n.z.w..t..z... 0130 19 a5 fd 00 28 cf 6b 14 3e 8e df a7 38 c0 bc 49 ....(.k.>...8..I 0140 91 2c 30 f7 81 22 cb 25 92 b7 4b db 3b f0 a9 21 .,0..".%..K.;..! 0150 01 1d 4c 15 57 af c8 51 3f cb e9 a3 76 f5 af 57 ..L.W..Q?...v..W 0160 9e c2 a4 98 db a6 97 14 4a 5a 62 52 fb 9a 5d 36 ........JZbR..]6 0170 bb 65 8b ae d9 3a ca 34 c7 97 fa 15 0f 00 6b 9b .e...:.4......k. 0180 c0 67 2f 85 10 13 7d 8f 0c 3f 03 56 ce 95 c6 e2 .g/...}..?.V.... 0190 3e aa 70 da 7c d2 ac 2c 04 48 bc 52 43 59 f3 ae >.p.|..,.H.RCY.. 01a0 ce f2 4f 8b 38 b3 a5 c2 c8 76 93 e5 7d 87 af c3 ..O.8....v..}... 01b0 cf 71 e0 8f 70 c8 ad 22 66 2a b6 dd 59 f8 60 da .q..p.."f*..Y.`. 01c0 3e db 13 10 cd bd 84 f6 a4 e4 e0 37 ba bd 9d fc >..........7.... 01d0 ee de 39 27 f2 70 76 f4 e8 79 5e a5 5e 21 b5 94 ..9'.pv..y^.^!.. 01e0 e2 52 e5 e2 ad 35 a2 fb 5d 7a 03 4f 74 26 9e 47 .R...5..]z.Ot&.G 01f0 82 ad 12 c5 ba 16 96 b3 c3 f9 c4 dd 76 31 7c ea ............v1|. 0200 89 bd 94 68 6d f9 ...hm. Frame 12 (342 bytes on wire, 342 bytes captured) Arrival Time: Oct 26, 2009 14:38:18.450581000 [Time delta from previous captured frame: 0.158008000 seconds] [Time delta from previous displayed frame: 0.158008000 seconds] [Time since reference or first frame: 0.485434000 seconds] Frame Number: 12 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.142 (165.227.249.142), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x9448 (37960) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0xe789 [correct] [Good: True] [Bad : False] Source: 165.227.249.142 (165.227.249.142) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x97f9 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 67A47BE1A4F98D18 Responder cookie: DD3CF4A81684FB87 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x0a0df1de Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 48 f8 2f 00 0f 3d 55 af ff 08 00 45 00 ..)H./..=U....E. 0010 01 48 94 48 00 00 ff 11 e7 89 a5 e3 f9 8e a5 e3 .H.H............ 0020 f9 7c 01 f4 01 f4 01 34 97 f9 67 a4 7b e1 a4 f9 .|.....4..g.{... 0030 8d 18 dd 3c f4 a8 16 84 fb 87 08 10 20 01 0a 0d ...<........ ... 0040 f1 de 00 00 01 2c 20 27 84 97 81 89 4f 76 52 5f ....., '....OvR_ 0050 5d f9 22 4d e6 8f ad 13 2f 68 3a 90 ac 58 1b ab ]."M..../h:..X.. 0060 c4 02 0f fe ca da f6 e3 2f ea 1e 76 39 56 f0 57 ......../..v9V.W 0070 17 26 af e1 af ab ca db 81 5b fb 8f db 5e 2c b4 .&.......[...^,. 0080 45 24 c9 35 7a aa c3 aa 64 7a f6 59 bf 79 da b0 E$.5z...dz.Y.y.. 0090 db 7e a3 d6 75 81 a2 1b 5e 95 c6 ed fe 83 7f 09 .~..u...^....... 00a0 2f 37 00 6a ba d0 0a 8b 9b b2 8e 6a 36 6d f5 ac /7.j.......j6m.. 00b0 7e fa 05 5f 40 54 2a 6a bc 16 a3 d5 a1 44 95 e8 ~.._@T*j.....D.. 00c0 ed 44 28 75 f0 6f 48 73 b5 b2 fc ff d8 f2 1b 4a .D(u.oHs.......J 00d0 72 f1 19 09 18 45 33 d7 32 8d e4 d3 50 24 bc cc r....E3.2...P$.. 00e0 40 69 e7 18 0f 2e 34 0a f1 be 00 99 93 84 04 00 @i....4......... 00f0 bf 75 1e c6 48 72 9b ba a6 61 28 7e 51 9e e1 6b .u..Hr...a(~Q..k 0100 28 15 e6 2c c7 06 5e 04 7e f0 76 6e cf e3 53 69 (..,..^.~.vn..Si 0110 fd 39 4b ef 93 8d 52 e8 98 e0 59 45 38 cc 7b 26 .9K...R...YE8.{& 0120 c6 b8 5b 16 b6 76 b9 d7 c8 ec 9f 3d cb 8f 15 03 ..[..v.....=.... 0130 5d e9 4c 6f b9 3d 00 72 a9 50 f4 bd 10 8f 4f 80 ].Lo.=.r.P....O. 0140 1e 85 f4 7a 4f a3 b6 bf bd b4 e9 75 36 2b 8b c2 ...zO......u6+.. 0150 6e f7 09 80 d0 22 n...." Frame 13 (102 bytes on wire, 102 bytes captured) Arrival Time: Oct 26, 2009 14:38:18.454794000 [Time delta from previous captured frame: 0.004213000 seconds] [Time delta from previous displayed frame: 0.004213000 seconds] [Time since reference or first frame: 0.489647000 seconds] Frame Number: 13 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc2 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x4419 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 67A47BE1A4F98D18 Responder cookie: DD3CF4A81684FB87 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x0a0df1de Length: 60 Encrypted payload (32 bytes) 0000 00 0f 3d 55 af ff 00 0c 29 48 f8 2f 08 00 45 00 ..=U....)H./..E. 0010 00 58 00 00 40 00 40 11 fb c2 a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 8e 01 f4 01 f4 00 44 44 19 67 a4 7b e1 a4 f9 .......DD.g.{... 0030 8d 18 dd 3c f4 a8 16 84 fb 87 08 10 20 01 0a 0d ...<........ ... 0040 f1 de 00 00 00 3c f9 b9 8a bd cf 75 e2 11 4d fd .....<.....u..M. 0050 22 7c c5 19 37 39 5a 0f cd e6 e4 c9 c8 f7 60 d4 "|..79Z.......`. 0060 61 8e f2 f3 2c f5 a...,. Frame 14 (102 bytes on wire, 102 bytes captured) Arrival Time: Oct 26, 2009 14:38:18.454806000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 0.489659000 seconds] Frame Number: 14 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc2 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x4419 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 67A47BE1A4F98D18 Responder cookie: DD3CF4A81684FB87 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x0a0df1de Length: 60 Encrypted payload (32 bytes) 0000 00 0f 3d 55 af ff 00 0c 29 48 f8 2f 08 00 45 00 ..=U....)H./..E. 0010 00 58 00 00 40 00 40 11 fb c2 a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 8e 01 f4 01 f4 00 44 44 19 67 a4 7b e1 a4 f9 .......DD.g.{... 0030 8d 18 dd 3c f4 a8 16 84 fb 87 08 10 20 01 0a 0d ...<........ ... 0040 f1 de 00 00 00 3c f9 b9 8a bd cf 75 e2 11 4d fd .....<.....u..M. 0050 22 7c c5 19 37 39 5a 0f cd e6 e4 c9 c8 f7 60 d4 "|..79Z.......`. 0060 61 8e f2 f3 2c f5 a...,. Frame 15 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 14:38:18.746303000 [Time delta from previous captured frame: 0.291497000 seconds] [Time delta from previous displayed frame: 0.291497000 seconds] [Time since reference or first frame: 0.781156000 seconds] Frame Number: 15 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b81 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.142 (165.227.249.142) Encapsulating Security Payload ESP SPI: 0xeacf9261 ESP Sequence: 1 0000 00 0f 3d 55 af ff 00 0c 29 48 f8 2f 08 00 45 00 ..=U....)H./..E. 0010 00 78 00 00 00 00 f0 32 8b 81 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 8e ea cf 92 61 00 00 00 01 87 03 7b f3 6d 51 .....a......{.mQ 0030 a1 63 c1 8f 98 a4 e4 e5 25 4d d2 1d bc ce eb 44 .c......%M.....D 0040 47 d1 ac a0 b6 b9 1f 0b cc 54 6e e3 c2 8c b2 76 G........Tn....v 0050 f0 2d b7 00 2b 8e 37 04 11 55 71 cb 63 6e 85 ef .-..+.7..Uq.cn.. 0060 50 c1 ca bd 6a e7 92 ab e7 3d e3 85 f0 5c 78 a3 P...j....=...\x. 0070 b0 2d 6a 77 23 a8 cb ea 19 b1 f7 7d 51 1c f7 8c .-jw#......}Q... 0080 95 9a 5a 43 6a c8 ..ZCj. Frame 16 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 14:38:18.746320000 [Time delta from previous captured frame: 0.000017000 seconds] [Time delta from previous displayed frame: 0.000017000 seconds] [Time since reference or first frame: 0.781173000 seconds] Frame Number: 16 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b81 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.142 (165.227.249.142) Encapsulating Security Payload ESP SPI: 0xeacf9261 ESP Sequence: 1 0000 00 0f 3d 55 af ff 00 0c 29 48 f8 2f 08 00 45 00 ..=U....)H./..E. 0010 00 78 00 00 00 00 f0 32 8b 81 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 8e ea cf 92 61 00 00 00 01 87 03 7b f3 6d 51 .....a......{.mQ 0030 a1 63 c1 8f 98 a4 e4 e5 25 4d d2 1d bc ce eb 44 .c......%M.....D 0040 47 d1 ac a0 b6 b9 1f 0b cc 54 6e e3 c2 8c b2 76 G........Tn....v 0050 f0 2d b7 00 2b 8e 37 04 11 55 71 cb 63 6e 85 ef .-..+.7..Uq.cn.. 0060 50 c1 ca bd 6a e7 92 ab e7 3d e3 85 f0 5c 78 a3 P...j....=...\x. 0070 b0 2d 6a 77 23 a8 cb ea 19 b1 f7 7d 51 1c f7 8c .-jw#......}Q... 0080 95 9a 5a 43 6a c8 ..ZCj. Frame 17 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 14:38:23.171583000 [Time delta from previous captured frame: 4.425263000 seconds] [Time delta from previous displayed frame: 4.425263000 seconds] [Time since reference or first frame: 5.206436000 seconds] Frame Number: 17 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Address: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b80 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.142 (165.227.249.142) Encapsulating Security Payload ESP SPI: 0xeacf9261 ESP Sequence: 2 0000 00 0f 3d 55 af ff 00 0c 29 48 f8 2f 08 00 45 00 ..=U....)H./..E. 0010 00 78 00 01 00 00 f0 32 8b 80 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 8e ea cf 92 61 00 00 00 02 2e 3a 09 76 d9 27 .....a.....:.v.' 0030 23 c6 c4 ad 97 a1 6b 53 12 d8 10 2e cf bb ea 9f #.....kS........ 0040 a9 c6 49 15 5a aa 97 c6 d8 b1 ab 60 0d e7 9a ae ..I.Z......`.... 0050 a8 a2 3a d9 a0 e4 23 6a 31 9f e2 f4 3a 14 d0 0c ..:...#j1...:... 0060 90 73 33 06 19 3d fa d6 ac 8c ce 27 57 72 28 3a .s3..=.....'Wr(: 0070 ad 15 a8 b3 11 21 8a 7f a4 e0 c7 16 3c 3f 2c 1c .....!....... 0050 d1 8b 92 f5 26 3f 19 6f 6a 89 ca 65 a5 99 cd 17 ....&?.oj..e.... 0060 aa 9c a5 a2 64 43 e9 4d f6 b4 e6 f1 5b 3a df 67 ....dC.M....[:.g 0070 85 17 79 17 02 dd 2d da d8 cc 2e 8e 4c a2 c0 e1 ..y...-.....L... 0080 94 28 62 ce bd 7f .(b...