Frame 1 (326 bytes on wire, 326 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.120656000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfade [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x8b18 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0xE6D87ADC4099A15F Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 ba 58 19 00 0c 29 48 f8 2f 08 00 45 00 ..).X...)H./..E. 0010 01 38 00 00 40 00 40 11 fa de a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 92 01 f4 01 f4 01 24 8b 18 e6 d8 7a dc 40 99 .......$....z.@. 0030 a1 5f 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ._.............. 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 e6 d8 7a dc 40 99 .....|......z.@. 0060 a1 5f 03 00 00 24 00 01 00 00 80 01 00 07 80 0e ._...$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 2 (326 bytes on wire, 326 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.120670000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 0.000014000 seconds] Frame Number: 2 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfade [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x8b18 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0xE6D87ADC4099A15F Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 ba 58 19 00 0c 29 48 f8 2f 08 00 45 00 ..).X...)H./..E. 0010 01 38 00 00 40 00 40 11 fa de a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 92 01 f4 01 f4 01 24 8b 18 e6 d8 7a dc 40 99 .......$....z.@. 0030 a1 5f 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ._.............. 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 e6 d8 7a dc 40 99 .....|......z.@. 0060 a1 5f 03 00 00 24 00 01 00 00 80 01 00 07 80 0e ._...$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 3 (186 bytes on wire, 186 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.133764000 [Time delta from previous captured frame: 0.013094000 seconds] [Time delta from previous displayed frame: 0.013094000 seconds] [Time since reference or first frame: 0.013108000 seconds] Frame Number: 3 Frame Length: 186 bytes Capture Length: 186 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 172 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb6a [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 152 Checksum: 0xa155 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 63759362D137DEC2 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 144 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 0 Next payload: NONE (0) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Hash-Algorithm (2): SHA (2) Encryption-Algorithm (1): AES-CBC (7) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Key-Length (14): Key-Length (128) Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID: Microsoft L2TP/IPSec VPN Client Next payload: NONE (0) Payload length: 20 Vendor ID: Microsoft L2TP/IPSec VPN Client 0000 00 0c 29 48 f8 2f 00 0c 29 ba 58 19 08 00 45 00 ..)H./..).X...E. 0010 00 ac 00 00 40 00 40 11 fb 6a a5 e3 f9 92 a5 e3 ....@.@..j...... 0020 f9 7c 01 f4 01 f4 00 98 a1 55 e6 d8 7a dc 40 99 .|.......U..z.@. 0030 a1 5f 63 75 93 62 d1 37 de c2 01 10 02 00 00 00 ._cu.b.7........ 0040 00 00 00 00 00 90 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 03 00 01 80 04 00 02 80 02 00 02 80 01 ................ 0070 00 07 80 0b 00 01 80 0c 70 80 80 0e 00 80 0d 00 ........p....... 0080 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0090 45 2f 0d 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 00a0 96 fc 77 57 01 00 00 00 00 14 40 48 b7 d5 6e bc ..wW......@H..n. 00b0 e8 85 25 e7 de 7f 00 d6 c2 d3 ..%....... Frame 4 (186 bytes on wire, 186 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.133774000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 0.013118000 seconds] Frame Number: 4 Frame Length: 186 bytes Capture Length: 186 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 172 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb6a [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 152 Checksum: 0xa155 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 63759362D137DEC2 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 144 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 0 Next payload: NONE (0) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Hash-Algorithm (2): SHA (2) Encryption-Algorithm (1): AES-CBC (7) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Key-Length (14): Key-Length (128) Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID: Microsoft L2TP/IPSec VPN Client Next payload: NONE (0) Payload length: 20 Vendor ID: Microsoft L2TP/IPSec VPN Client 0000 00 0c 29 48 f8 2f 00 0c 29 ba 58 19 08 00 45 00 ..)H./..).X...E. 0010 00 ac 00 00 40 00 40 11 fb 6a a5 e3 f9 92 a5 e3 ....@.@..j...... 0020 f9 7c 01 f4 01 f4 00 98 a1 55 e6 d8 7a dc 40 99 .|.......U..z.@. 0030 a1 5f 63 75 93 62 d1 37 de c2 01 10 02 00 00 00 ._cu.b.7........ 0040 00 00 00 00 00 90 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 03 00 01 80 04 00 02 80 02 00 02 80 01 ................ 0070 00 07 80 0b 00 01 80 0c 70 80 80 0e 00 80 0d 00 ........p....... 0080 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0090 45 2f 0d 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 00a0 96 fc 77 57 01 00 00 00 00 14 40 48 b7 d5 6e bc ..wW......@H..n. 00b0 e8 85 25 e7 de 7f 00 d6 c2 d3 ..%....... Frame 5 (270 bytes on wire, 270 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.138443000 [Time delta from previous captured frame: 0.004669000 seconds] [Time delta from previous displayed frame: 0.004669000 seconds] [Time since reference or first frame: 0.017787000 seconds] Frame Number: 5 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb16 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0xdf7d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 63759362D137DEC2 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (RFC 3947) (20) Payload length: 20 Nonce Data NAT-D (RFC 3947) payload Next payload: NAT-D (RFC 3947) (20) Payload length: 24 Hash of address and port: C1FFC819F842970CF908FF23FF6D444FB8B75724 NAT-D (RFC 3947) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: BB74E3886F318D058F589B1E6983D432C4AFD950 0000 00 0c 29 ba 58 19 00 0c 29 48 f8 2f 08 00 45 00 ..).X...)H./..E. 0010 01 00 00 00 40 00 40 11 fb 16 a5 e3 f9 7c a5 e3 ....@.@......|.. 0020 f9 92 01 f4 01 f4 00 ec df 7d e6 d8 7a dc 40 99 .........}..z.@. 0030 a1 5f 63 75 93 62 d1 37 de c2 04 10 02 00 00 00 ._cu.b.7........ 0040 00 00 00 00 00 e4 0a 00 00 84 fc 84 69 40 2f a0 ............i@/. 0050 6e e5 68 ce 6b fc a5 f1 04 22 b4 2d 40 24 b9 7a n.h.k....".-@$.z 0060 46 a2 54 17 92 08 86 e8 11 4c c9 66 c8 c5 94 49 F.T......L.f...I 0070 b8 fe 34 ff d6 19 f7 19 d7 9e 5f 17 cf 2f 0d f3 ..4......._../.. 0080 df 56 53 21 85 11 a3 4a b3 76 3a 3d 9f b1 2d a7 .VS!...J.v:=..-. 0090 d6 66 67 77 57 91 98 26 f9 56 09 50 1b 67 b1 5a .fgwW..&.V.P.g.Z 00a0 98 4f f9 3a a8 86 95 c2 9b 4f dc 5f 23 b7 f9 30 .O.:.....O._#..0 00b0 fd 16 6c 65 7c 3b cc 8b 46 c6 6c c4 94 a2 f7 18 ..le|;..F.l..... 00c0 98 fc 30 23 01 c8 64 28 92 df 14 00 00 14 4d ad ..0#..d(......M. 00d0 09 8c 86 a8 7b 6e c9 75 24 4f 19 a1 3a 21 14 00 ....{n.u$O..:!.. 00e0 00 18 c1 ff c8 19 f8 42 97 0c f9 08 ff 23 ff 6d .......B.....#.m 00f0 44 4f b8 b7 57 24 00 00 00 18 bb 74 e3 88 6f 31 DO..W$.....t..o1 0100 8d 05 8f 58 9b 1e 69 83 d4 32 c4 af d9 50 ...X..i..2...P Frame 6 (270 bytes on wire, 270 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.138457000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 0.017801000 seconds] Frame Number: 6 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb16 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0xdf7d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 63759362D137DEC2 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (RFC 3947) (20) Payload length: 20 Nonce Data NAT-D (RFC 3947) payload Next payload: NAT-D (RFC 3947) (20) Payload length: 24 Hash of address and port: C1FFC819F842970CF908FF23FF6D444FB8B75724 NAT-D (RFC 3947) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: BB74E3886F318D058F589B1E6983D432C4AFD950 0000 00 0c 29 ba 58 19 00 0c 29 48 f8 2f 08 00 45 00 ..).X...)H./..E. 0010 01 00 00 00 40 00 40 11 fb 16 a5 e3 f9 7c a5 e3 ....@.@......|.. 0020 f9 92 01 f4 01 f4 00 ec df 7d e6 d8 7a dc 40 99 .........}..z.@. 0030 a1 5f 63 75 93 62 d1 37 de c2 04 10 02 00 00 00 ._cu.b.7........ 0040 00 00 00 00 00 e4 0a 00 00 84 fc 84 69 40 2f a0 ............i@/. 0050 6e e5 68 ce 6b fc a5 f1 04 22 b4 2d 40 24 b9 7a n.h.k....".-@$.z 0060 46 a2 54 17 92 08 86 e8 11 4c c9 66 c8 c5 94 49 F.T......L.f...I 0070 b8 fe 34 ff d6 19 f7 19 d7 9e 5f 17 cf 2f 0d f3 ..4......._../.. 0080 df 56 53 21 85 11 a3 4a b3 76 3a 3d 9f b1 2d a7 .VS!...J.v:=..-. 0090 d6 66 67 77 57 91 98 26 f9 56 09 50 1b 67 b1 5a .fgwW..&.V.P.g.Z 00a0 98 4f f9 3a a8 86 95 c2 9b 4f dc 5f 23 b7 f9 30 .O.:.....O._#..0 00b0 fd 16 6c 65 7c 3b cc 8b 46 c6 6c c4 94 a2 f7 18 ..le|;..F.l..... 00c0 98 fc 30 23 01 c8 64 28 92 df 14 00 00 14 4d ad ..0#..d(......M. 00d0 09 8c 86 a8 7b 6e c9 75 24 4f 19 a1 3a 21 14 00 ....{n.u$O..:!.. 00e0 00 18 c1 ff c8 19 f8 42 97 0c f9 08 ff 23 ff 6d .......B.....#.m 00f0 44 4f b8 b7 57 24 00 00 00 18 bb 74 e3 88 6f 31 DO..W$.....t..o1 0100 8d 05 8f 58 9b 1e 69 83 d4 32 c4 af d9 50 ...X..i..2...P Frame 7 (270 bytes on wire, 270 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.186908000 [Time delta from previous captured frame: 0.048451000 seconds] [Time delta from previous displayed frame: 0.048451000 seconds] [Time since reference or first frame: 0.066252000 seconds] Frame Number: 7 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb16 [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x2c42 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 63759362D137DEC2 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (RFC 3947) (20) Payload length: 20 Nonce Data NAT-D (RFC 3947) payload Next payload: NAT-D (RFC 3947) (20) Payload length: 24 Hash of address and port: BB74E3886F318D058F589B1E6983D432C4AFD950 NAT-D (RFC 3947) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: C1FFC819F842970CF908FF23FF6D444FB8B75724 0000 00 0c 29 48 f8 2f 00 0c 29 ba 58 19 08 00 45 00 ..)H./..).X...E. 0010 01 00 00 00 40 00 40 11 fb 16 a5 e3 f9 92 a5 e3 ....@.@......... 0020 f9 7c 01 f4 01 f4 00 ec 2c 42 e6 d8 7a dc 40 99 .|......,B..z.@. 0030 a1 5f 63 75 93 62 d1 37 de c2 04 10 02 00 00 00 ._cu.b.7........ 0040 00 00 00 00 00 e4 0a 00 00 84 a8 b7 19 38 4d ed .............8M. 0050 52 c2 2c f7 6c 17 63 76 19 2e ac 41 01 3e 71 61 R.,.l.cv...A.>qa 0060 df 7f 62 a0 cc ab da 1a a1 2f 95 88 65 f0 dd 54 ..b....../..e..T 0070 cd 00 9f a6 c8 a8 3d 69 07 7a 37 5c 1e 38 92 c1 ......=i.z7\.8.. 0080 2f 77 43 18 6c 3b 9f ec 3f a2 eb 58 c0 b3 c2 32 /wC.l;..?..X...2 0090 45 32 4c c2 4c 5b 37 cf ef 5a 8e 69 b8 5b 26 64 E2L.L[7..Z.i.[&d 00a0 14 32 08 9a a9 29 07 d9 ad a2 60 0a 2a c0 e5 62 .2...)....`.*..b 00b0 84 72 48 02 96 85 a7 e0 1d 50 18 73 ab e1 e3 40 .rH......P.s...@ 00c0 56 b2 9f 55 45 3a 75 93 43 15 14 00 00 14 0b ef V..UE:u.C....... 00d0 e5 ad f7 27 46 98 14 fd c3 41 5c 37 55 4a 14 00 ...'F....A\7UJ.. 00e0 00 18 bb 74 e3 88 6f 31 8d 05 8f 58 9b 1e 69 83 ...t..o1...X..i. 00f0 d4 32 c4 af d9 50 00 00 00 18 c1 ff c8 19 f8 42 .2...P.........B 0100 97 0c f9 08 ff 23 ff 6d 44 4f b8 b7 57 24 .....#.mDO..W$ Frame 8 (270 bytes on wire, 270 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.186918000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 0.066262000 seconds] Frame Number: 8 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb16 [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x2c42 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 63759362D137DEC2 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (RFC 3947) (20) Payload length: 20 Nonce Data NAT-D (RFC 3947) payload Next payload: NAT-D (RFC 3947) (20) Payload length: 24 Hash of address and port: BB74E3886F318D058F589B1E6983D432C4AFD950 NAT-D (RFC 3947) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: C1FFC819F842970CF908FF23FF6D444FB8B75724 0000 00 0c 29 48 f8 2f 00 0c 29 ba 58 19 08 00 45 00 ..)H./..).X...E. 0010 01 00 00 00 40 00 40 11 fb 16 a5 e3 f9 92 a5 e3 ....@.@......... 0020 f9 7c 01 f4 01 f4 00 ec 2c 42 e6 d8 7a dc 40 99 .|......,B..z.@. 0030 a1 5f 63 75 93 62 d1 37 de c2 04 10 02 00 00 00 ._cu.b.7........ 0040 00 00 00 00 00 e4 0a 00 00 84 a8 b7 19 38 4d ed .............8M. 0050 52 c2 2c f7 6c 17 63 76 19 2e ac 41 01 3e 71 61 R.,.l.cv...A.>qa 0060 df 7f 62 a0 cc ab da 1a a1 2f 95 88 65 f0 dd 54 ..b....../..e..T 0070 cd 00 9f a6 c8 a8 3d 69 07 7a 37 5c 1e 38 92 c1 ......=i.z7\.8.. 0080 2f 77 43 18 6c 3b 9f ec 3f a2 eb 58 c0 b3 c2 32 /wC.l;..?..X...2 0090 45 32 4c c2 4c 5b 37 cf ef 5a 8e 69 b8 5b 26 64 E2L.L[7..Z.i.[&d 00a0 14 32 08 9a a9 29 07 d9 ad a2 60 0a 2a c0 e5 62 .2...)....`.*..b 00b0 84 72 48 02 96 85 a7 e0 1d 50 18 73 ab e1 e3 40 .rH......P.s...@ 00c0 56 b2 9f 55 45 3a 75 93 43 15 14 00 00 14 0b ef V..UE:u.C....... 00d0 e5 ad f7 27 46 98 14 fd c3 41 5c 37 55 4a 14 00 ...'F....A\7UJ.. 00e0 00 18 bb 74 e3 88 6f 31 8d 05 8f 58 9b 1e 69 83 ...t..o1...X..i. 00f0 d4 32 c4 af d9 50 00 00 00 18 c1 ff c8 19 f8 42 .2...P.........B 0100 97 0c f9 08 ff 23 ff 6d 44 4f b8 b7 57 24 .....#.mDO..W$ Frame 9 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.190071000 [Time delta from previous captured frame: 0.003153000 seconds] [Time delta from previous displayed frame: 0.003153000 seconds] [Time since reference or first frame: 0.069415000 seconds] Frame Number: 9 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb9e [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xa209 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 63759362D137DEC2 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 ba 58 19 00 0c 29 48 f8 2f 08 00 45 00 ..).X...)H./..E. 0010 00 78 00 00 40 00 40 11 fb 9e a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 92 01 f4 01 f4 00 64 a2 09 e6 d8 7a dc 40 99 .......d....z.@. 0030 a1 5f 63 75 93 62 d1 37 de c2 05 10 02 01 00 00 ._cu.b.7........ 0040 00 00 00 00 00 5c 0c 50 57 60 43 b0 9b e8 6f 72 .....\.PW`C...or 0050 b4 f7 d9 d4 02 36 2c c1 52 92 f2 0f 01 76 f9 47 .....6,.R....v.G 0060 d3 cb 4a 4a 12 06 25 87 9b fd 05 d4 73 cb 50 2f ..JJ..%.....s.P/ 0070 52 43 84 90 19 32 ca 61 e5 42 dc 8d dd 5e 30 98 RC...2.a.B...^0. 0080 33 1d c4 8c 3b 47 3...;G Frame 10 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.190081000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 0.069425000 seconds] Frame Number: 10 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb9e [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xa209 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 63759362D137DEC2 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 ba 58 19 00 0c 29 48 f8 2f 08 00 45 00 ..).X...)H./..E. 0010 00 78 00 00 40 00 40 11 fb 9e a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 92 01 f4 01 f4 00 64 a2 09 e6 d8 7a dc 40 99 .......d....z.@. 0030 a1 5f 63 75 93 62 d1 37 de c2 05 10 02 01 00 00 ._cu.b.7........ 0040 00 00 00 00 00 5c 0c 50 57 60 43 b0 9b e8 6f 72 .....\.PW`C...or 0050 b4 f7 d9 d4 02 36 2c c1 52 92 f2 0f 01 76 f9 47 .....6,.R....v.G 0060 d3 cb 4a 4a 12 06 25 87 9b fd 05 d4 73 cb 50 2f ..JJ..%.....s.P/ 0070 52 43 84 90 19 32 ca 61 e5 42 dc 8d dd 5e 30 98 RC...2.a.B...^0. 0080 33 1d c4 8c 3b 47 3...;G Frame 11 (118 bytes on wire, 118 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.198164000 [Time delta from previous captured frame: 0.008083000 seconds] [Time delta from previous displayed frame: 0.008083000 seconds] [Time since reference or first frame: 0.077508000 seconds] Frame Number: 11 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbae [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x0dcd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 63759362D137DEC2 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 ba 58 19 08 00 45 00 ..)H./..).X...E. 0010 00 68 00 00 40 00 40 11 fb ae a5 e3 f9 92 a5 e3 .h..@.@......... 0020 f9 7c 01 f4 01 f4 00 54 0d cd e6 d8 7a dc 40 99 .|.....T....z.@. 0030 a1 5f 63 75 93 62 d1 37 de c2 05 10 02 01 00 00 ._cu.b.7........ 0040 00 00 00 00 00 4c 99 06 e2 cb 43 91 dd 37 94 0e .....L....C..7.. 0050 0f 41 f8 58 2f f6 ea 9b a2 1f e4 09 5a 14 f9 ef .A.X/.......Z... 0060 cc f1 db 82 70 c2 31 0d f1 dd 5f 73 0b fa e2 51 ....p.1..._s...Q 0070 d3 dd 1d ab 14 6e .....n Frame 12 (118 bytes on wire, 118 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.198175000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 0.077519000 seconds] Frame Number: 12 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbae [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x0dcd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 63759362D137DEC2 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 ba 58 19 08 00 45 00 ..)H./..).X...E. 0010 00 68 00 00 40 00 40 11 fb ae a5 e3 f9 92 a5 e3 .h..@.@......... 0020 f9 7c 01 f4 01 f4 00 54 0d cd e6 d8 7a dc 40 99 .|.....T....z.@. 0030 a1 5f 63 75 93 62 d1 37 de c2 05 10 02 01 00 00 ._cu.b.7........ 0040 00 00 00 00 00 4c 99 06 e2 cb 43 91 dd 37 94 0e .....L....C..7.. 0050 0f 41 f8 58 2f f6 ea 9b a2 1f e4 09 5a 14 f9 ef .A.X/.......Z... 0060 cc f1 db 82 70 c2 31 0d f1 dd 5f 73 0b fa e2 51 ....p.1..._s...Q 0070 d3 dd 1d ab 14 6e .....n Frame 13 (518 bytes on wire, 518 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.204002000 [Time delta from previous captured frame: 0.005827000 seconds] [Time delta from previous displayed frame: 0.005827000 seconds] [Time since reference or first frame: 0.083346000 seconds] Frame Number: 13 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa1e [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0xe15e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 63759362D137DEC2 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x409099b2 Length: 476 Encrypted payload (448 bytes) 0000 00 0c 29 ba 58 19 00 0c 29 48 f8 2f 08 00 45 00 ..).X...)H./..E. 0010 01 f8 00 00 40 00 40 11 fa 1e a5 e3 f9 7c a5 e3 ....@.@......|.. 0020 f9 92 01 f4 01 f4 01 e4 e1 5e e6 d8 7a dc 40 99 .........^..z.@. 0030 a1 5f 63 75 93 62 d1 37 de c2 08 10 20 01 40 90 ._cu.b.7.... .@. 0040 99 b2 00 00 01 dc 77 7e 72 af 05 ee 17 c2 59 dc ......w~r.....Y. 0050 72 1f 98 c6 71 54 54 c9 9d 8e fb a6 4d 27 df 22 r...qTT.....M'." 0060 16 6e 6c e3 1c 3a 1b 73 12 72 8e 34 f9 e7 6c 19 .nl..:.s.r.4..l. 0070 6f 78 21 7e f0 2d 69 a7 65 24 5e cb 8a 69 31 23 ox!~.-i.e$^..i1# 0080 a6 c0 2b 24 0e 0a 3f 5c ea 78 6d 9a 2c 81 ee f5 ..+$..?\.xm.,... 0090 73 59 08 d1 91 07 d1 68 72 29 81 42 7f 09 11 fc sY.....hr).B.... 00a0 e9 fe c0 d1 96 df 2b 88 40 db 56 1c e6 d9 7f db ......+.@.V..... 00b0 47 4d ed 20 8e ff ac 42 5d 2a d4 7c 1a 85 03 4a GM. ...B]*.|...J 00c0 ed 8b fe 6e 60 96 27 52 73 8e cc 3b cd 24 6a fe ...n`.'Rs..;.$j. 00d0 b8 a2 10 0d 5e 3b 3e 3d c8 43 65 7b 75 1c 14 d3 ....^;>=.Ce{u... 00e0 f5 24 14 c9 ab fd 7f d8 6f 9c f9 bd b9 18 92 d0 .$......o....... 00f0 00 92 73 38 e1 55 25 49 72 39 7f 99 c3 f4 b4 1b ..s8.U%Ir9...... 0100 b0 ab 37 ad e2 a0 67 33 7f de 86 b4 75 ae bd 81 ..7...g3....u... 0110 cf 26 05 7c 42 64 32 c9 c8 50 4d 9e 86 6f e8 6a .&.|Bd2..PM..o.j 0120 41 1e 37 a8 c4 37 51 37 c9 20 3e 14 aa 7a 89 9f A.7..7Q7. >..z.. 0130 15 fc a4 e1 0a 91 fe c5 87 4b 25 cf 2e 06 6d a3 .........K%...m. 0140 21 df 13 7f 9f 27 fd 85 4c e5 85 7d ad 09 55 e7 !....'..L..}..U. 0150 d5 1a d4 b7 78 75 ab 9e 90 8d 97 b8 35 dd 13 f4 ....xu......5... 0160 fd 1b af d9 c8 e6 28 31 98 49 2a 4b 28 75 67 75 ......(1.I*K(ugu 0170 2a d5 a9 fc 46 55 0d 13 d6 3e fd fa 50 62 59 48 *...FU...>..PbYH 0180 25 cc fe 30 ff 5d 7a ed ba 72 69 75 57 10 b6 c5 %..0.]z..riuW... 0190 b6 2e 40 7c b8 f2 b0 40 33 5c e3 6b ae 3e e0 69 ..@|...@3\.k.>.i 01a0 57 21 89 21 31 fc be 45 cc 8f 29 66 b8 ac 2f 0c W!.!1..E..)f../. 01b0 a0 7c e6 e3 32 f7 14 cf 0b ed 57 13 c9 4a 12 71 .|..2.....W..J.q 01c0 60 1b 36 ba 77 32 1e 94 4e a0 01 89 9c b5 03 b4 `.6.w2..N....... 01d0 f2 cf ee 5d 50 ad a1 16 9e aa ec 55 d6 98 44 1e ...]P......U..D. 01e0 74 a9 59 a5 d9 d8 e4 0b 5f 60 fc be 76 21 d9 e4 t.Y....._`..v!.. 01f0 31 94 8d 68 91 63 25 33 ba 20 79 2a 7b 29 94 7d 1..h.c%3. y*{).} 0200 a5 98 b2 9d cd d3 ...... Frame 14 (518 bytes on wire, 518 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.204013000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 0.083357000 seconds] Frame Number: 14 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa1e [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0xe15e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 63759362D137DEC2 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x409099b2 Length: 476 Encrypted payload (448 bytes) 0000 00 0c 29 ba 58 19 00 0c 29 48 f8 2f 08 00 45 00 ..).X...)H./..E. 0010 01 f8 00 00 40 00 40 11 fa 1e a5 e3 f9 7c a5 e3 ....@.@......|.. 0020 f9 92 01 f4 01 f4 01 e4 e1 5e e6 d8 7a dc 40 99 .........^..z.@. 0030 a1 5f 63 75 93 62 d1 37 de c2 08 10 20 01 40 90 ._cu.b.7.... .@. 0040 99 b2 00 00 01 dc 77 7e 72 af 05 ee 17 c2 59 dc ......w~r.....Y. 0050 72 1f 98 c6 71 54 54 c9 9d 8e fb a6 4d 27 df 22 r...qTT.....M'." 0060 16 6e 6c e3 1c 3a 1b 73 12 72 8e 34 f9 e7 6c 19 .nl..:.s.r.4..l. 0070 6f 78 21 7e f0 2d 69 a7 65 24 5e cb 8a 69 31 23 ox!~.-i.e$^..i1# 0080 a6 c0 2b 24 0e 0a 3f 5c ea 78 6d 9a 2c 81 ee f5 ..+$..?\.xm.,... 0090 73 59 08 d1 91 07 d1 68 72 29 81 42 7f 09 11 fc sY.....hr).B.... 00a0 e9 fe c0 d1 96 df 2b 88 40 db 56 1c e6 d9 7f db ......+.@.V..... 00b0 47 4d ed 20 8e ff ac 42 5d 2a d4 7c 1a 85 03 4a GM. ...B]*.|...J 00c0 ed 8b fe 6e 60 96 27 52 73 8e cc 3b cd 24 6a fe ...n`.'Rs..;.$j. 00d0 b8 a2 10 0d 5e 3b 3e 3d c8 43 65 7b 75 1c 14 d3 ....^;>=.Ce{u... 00e0 f5 24 14 c9 ab fd 7f d8 6f 9c f9 bd b9 18 92 d0 .$......o....... 00f0 00 92 73 38 e1 55 25 49 72 39 7f 99 c3 f4 b4 1b ..s8.U%Ir9...... 0100 b0 ab 37 ad e2 a0 67 33 7f de 86 b4 75 ae bd 81 ..7...g3....u... 0110 cf 26 05 7c 42 64 32 c9 c8 50 4d 9e 86 6f e8 6a .&.|Bd2..PM..o.j 0120 41 1e 37 a8 c4 37 51 37 c9 20 3e 14 aa 7a 89 9f A.7..7Q7. >..z.. 0130 15 fc a4 e1 0a 91 fe c5 87 4b 25 cf 2e 06 6d a3 .........K%...m. 0140 21 df 13 7f 9f 27 fd 85 4c e5 85 7d ad 09 55 e7 !....'..L..}..U. 0150 d5 1a d4 b7 78 75 ab 9e 90 8d 97 b8 35 dd 13 f4 ....xu......5... 0160 fd 1b af d9 c8 e6 28 31 98 49 2a 4b 28 75 67 75 ......(1.I*K(ugu 0170 2a d5 a9 fc 46 55 0d 13 d6 3e fd fa 50 62 59 48 *...FU...>..PbYH 0180 25 cc fe 30 ff 5d 7a ed ba 72 69 75 57 10 b6 c5 %..0.]z..riuW... 0190 b6 2e 40 7c b8 f2 b0 40 33 5c e3 6b ae 3e e0 69 ..@|...@3\.k.>.i 01a0 57 21 89 21 31 fc be 45 cc 8f 29 66 b8 ac 2f 0c W!.!1..E..)f../. 01b0 a0 7c e6 e3 32 f7 14 cf 0b ed 57 13 c9 4a 12 71 .|..2.....W..J.q 01c0 60 1b 36 ba 77 32 1e 94 4e a0 01 89 9c b5 03 b4 `.6.w2..N....... 01d0 f2 cf ee 5d 50 ad a1 16 9e aa ec 55 d6 98 44 1e ...]P......U..D. 01e0 74 a9 59 a5 d9 d8 e4 0b 5f 60 fc be 76 21 d9 e4 t.Y....._`..v!.. 01f0 31 94 8d 68 91 63 25 33 ba 20 79 2a 7b 29 94 7d 1..h.c%3. y*{).} 0200 a5 98 b2 9d cd d3 ...... Frame 15 (342 bytes on wire, 342 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.278509000 [Time delta from previous captured frame: 0.074496000 seconds] [Time delta from previous displayed frame: 0.074496000 seconds] [Time since reference or first frame: 0.157853000 seconds] Frame Number: 15 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xface [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x9396 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 63759362D137DEC2 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x409099b2 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 ba 58 19 08 00 45 00 ..)H./..).X...E. 0010 01 48 00 00 40 00 40 11 fa ce a5 e3 f9 92 a5 e3 .H..@.@......... 0020 f9 7c 01 f4 01 f4 01 34 93 96 e6 d8 7a dc 40 99 .|.....4....z.@. 0030 a1 5f 63 75 93 62 d1 37 de c2 08 10 20 01 40 90 ._cu.b.7.... .@. 0040 99 b2 00 00 01 2c fa e4 87 82 f8 e8 15 e5 6e b8 .....,........n. 0050 bd 37 7b f5 ea eb aa 66 8f e6 0f 76 10 42 53 b4 .7{....f...v.BS. 0060 72 15 a4 ee 84 82 a0 b3 3b ff 3f 26 91 a5 bd 70 r.......;.?&...p 0070 01 70 e0 7f e5 d8 4a 98 c9 85 42 20 41 39 8d 59 .p....J...B A9.Y 0080 a2 25 84 79 aa 4e 73 c3 3d 2f 56 e4 4a 8f d9 43 .%.y.Ns.=/V.J..C 0090 ce 7b 34 1c 7b 2c 6f 9e 34 67 f9 78 ac 10 47 ea .{4.{,o.4g.x..G. 00a0 1c fc 73 21 a5 ab 0c 6f dc 26 89 86 b6 55 95 7f ..s!...o.&...U.. 00b0 4d 1a bd 04 da 6b 00 6f 6d 5c df a4 5c 80 a5 4c M....k.om\..\..L 00c0 66 70 85 4a b1 27 e0 21 4c 3d ec 25 b1 79 ef 7e fp.J.'.!L=.%.y.~ 00d0 a4 9c 0a 9f 5e dd f7 35 12 c4 8b b6 e6 13 88 5f ....^..5......._ 00e0 fe cd 41 71 4f e6 55 91 ea 6d c7 ae 52 4e 20 cb ..AqO.U..m..RN . 00f0 b7 8d cc 2e ac 29 bc 28 2e c6 58 97 09 d6 5c 82 .....).(..X...\. 0100 8f 35 77 e0 bc fd 9f 57 44 60 98 be 6d b5 11 68 .5w....WD`..m..h 0110 4a 07 66 c4 46 0e 1f 80 7a 0a 3d fe fa f6 dd 1b J.f.F...z.=..... 0120 e9 18 7d 37 5c 55 88 7d b9 19 33 dd 0c e7 ef 4a ..}7\U.}..3....J 0130 b9 75 12 6e 53 4c 26 4d 8f c4 d7 ca bc 25 ba 56 .u.nSL&M.....%.V 0140 13 ce 20 0b df 39 42 f1 0d 07 23 74 bc d3 68 96 .. ..9B...#t..h. 0150 42 fa 7b ec ca f3 B.{... Frame 16 (342 bytes on wire, 342 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.278519000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 0.157863000 seconds] Frame Number: 16 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xface [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x9396 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 63759362D137DEC2 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x409099b2 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 ba 58 19 08 00 45 00 ..)H./..).X...E. 0010 01 48 00 00 40 00 40 11 fa ce a5 e3 f9 92 a5 e3 .H..@.@......... 0020 f9 7c 01 f4 01 f4 01 34 93 96 e6 d8 7a dc 40 99 .|.....4....z.@. 0030 a1 5f 63 75 93 62 d1 37 de c2 08 10 20 01 40 90 ._cu.b.7.... .@. 0040 99 b2 00 00 01 2c fa e4 87 82 f8 e8 15 e5 6e b8 .....,........n. 0050 bd 37 7b f5 ea eb aa 66 8f e6 0f 76 10 42 53 b4 .7{....f...v.BS. 0060 72 15 a4 ee 84 82 a0 b3 3b ff 3f 26 91 a5 bd 70 r.......;.?&...p 0070 01 70 e0 7f e5 d8 4a 98 c9 85 42 20 41 39 8d 59 .p....J...B A9.Y 0080 a2 25 84 79 aa 4e 73 c3 3d 2f 56 e4 4a 8f d9 43 .%.y.Ns.=/V.J..C 0090 ce 7b 34 1c 7b 2c 6f 9e 34 67 f9 78 ac 10 47 ea .{4.{,o.4g.x..G. 00a0 1c fc 73 21 a5 ab 0c 6f dc 26 89 86 b6 55 95 7f ..s!...o.&...U.. 00b0 4d 1a bd 04 da 6b 00 6f 6d 5c df a4 5c 80 a5 4c M....k.om\..\..L 00c0 66 70 85 4a b1 27 e0 21 4c 3d ec 25 b1 79 ef 7e fp.J.'.!L=.%.y.~ 00d0 a4 9c 0a 9f 5e dd f7 35 12 c4 8b b6 e6 13 88 5f ....^..5......._ 00e0 fe cd 41 71 4f e6 55 91 ea 6d c7 ae 52 4e 20 cb ..AqO.U..m..RN . 00f0 b7 8d cc 2e ac 29 bc 28 2e c6 58 97 09 d6 5c 82 .....).(..X...\. 0100 8f 35 77 e0 bc fd 9f 57 44 60 98 be 6d b5 11 68 .5w....WD`..m..h 0110 4a 07 66 c4 46 0e 1f 80 7a 0a 3d fe fa f6 dd 1b J.f.F...z.=..... 0120 e9 18 7d 37 5c 55 88 7d b9 19 33 dd 0c e7 ef 4a ..}7\U.}..3....J 0130 b9 75 12 6e 53 4c 26 4d 8f c4 d7 ca bc 25 ba 56 .u.nSL&M.....%.V 0140 13 ce 20 0b df 39 42 f1 0d 07 23 74 bc d3 68 96 .. ..9B...#t..h. 0150 42 fa 7b ec ca f3 B.{... Frame 17 (102 bytes on wire, 102 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.281803000 [Time delta from previous captured frame: 0.003284000 seconds] [Time delta from previous displayed frame: 0.003284000 seconds] [Time since reference or first frame: 0.161147000 seconds] Frame Number: 17 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbbe [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x7652 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E6D87ADC4099A15F Responder cookie: 63759362D137DEC2 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x409099b2 Length: 60 Encrypted payload (32 bytes) 0000 00 0c 29 ba 58 19 00 0c 29 48 f8 2f 08 00 45 00 ..).X...)H./..E. 0010 00 58 00 00 40 00 40 11 fb be a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 92 01 f4 01 f4 00 44 76 52 e6 d8 7a dc 40 99 .......DvR..z.@. 0030 a1 5f 63 75 93 62 d1 37 de c2 08 10 20 01 40 90 ._cu.b.7.... .@. 0040 99 b2 00 00 00 3c 66 3a fb ae ae 38 b7 0c eb c0 .......!.06....g.H 0050 a9 5a 53 ca 9a 10 e0 98 96 24 ec e1 6f 14 a8 7f .ZS......$..o... 0060 60 ec 4e b0 3b 23 0a 15 b1 c6 6e 1b 92 d5 de 29 `.N.;#....n....) 0070 6b 26 b8 cd b0 9b a8 93 47 1d fe 14 b5 3f ab d9 k&......G....?.. 0080 29 9e e2 24 31 3c )..$1< Frame 22 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:42:54.555288000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 0.434632000 seconds] Frame Number: 22 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x1d33 (7475) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 127 Protocol: ESP (0x32) Header checksum: 0xdf4a [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0xc7d67ff5 ESP Sequence: 1 0000 00 0c 29 48 f8 2f 00 0c 29 ba 58 19 08 00 45 00 ..)H./..).X...E. 0010 00 78 1d 33 00 00 7f 32 df 4a a5 e3 f9 92 a5 e3 .x.3...2.J...... 0020 f9 7c c7 d6 7f f5 00 00 00 01 8a 32 f7 a5 11 65 .|.........2...e 0030 25 20 54 5e 3d 56 ca 9f 75 67 c0 9a 33 f6 52 dd % T^=V..ug..3.R. 0040 18 3f 3e 18 e5 21 14 30 36 c4 18 19 8e 67 f4 48 .?>..!.06....g.H 0050 a9 5a 53 ca 9a 10 e0 98 96 24 ec e1 6f 14 a8 7f .ZS......$..o... 0060 60 ec 4e b0 3b 23 0a 15 b1 c6 6e 1b 92 d5 de 29 `.N.;#....n....) 0070 6b 26 b8 cd b0 9b a8 93 47 1d fe 14 b5 3f ab d9 k&......G....?.. 0080 29 9e e2 24 31 3c )..$1< Frame 23 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:42:55.103950000 [Time delta from previous captured frame: 0.548662000 seconds] [Time delta from previous displayed frame: 0.548662000 seconds] [Time since reference or first frame: 0.983294000 seconds] Frame Number: 23 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0027 (39) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b56 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.146 (165.227.249.146) Encapsulating Security Payload ESP SPI: 0xf442927e ESP Sequence: 2 0000 00 0c 29 ba 58 19 00 0c 29 48 f8 2f 08 00 45 00 ..).X...)H./..E. 0010 00 78 00 27 00 00 f0 32 8b 56 a5 e3 f9 7c a5 e3 .x.'...2.V...|.. 0020 f9 92 f4 42 92 7e 00 00 00 02 fb 3d 7b d2 ec e4 ...B.~.....={... 0030 63 19 67 4f 77 28 29 0a bb 37 3a 9a f6 d2 3e 42 c.gOw()..7:...>B 0040 2d 9e 73 2b 38 9b 52 0c 99 6f d0 f3 82 68 6a 7b -.s+8.R..o...hj{ 0050 50 04 7d 70 8b 14 b4 1a 9a 6b 18 34 71 d3 1d ce P.}p.....k.4q... 0060 ce d1 d0 3d 50 59 09 60 16 19 76 e1 31 18 76 57 ...=PY.`..v.1.vW 0070 67 ba e7 fc 51 c7 48 c7 e4 af 31 85 13 ab 9f 64 g...Q.H...1....d 0080 02 e1 34 13 b1 72 ..4..r Frame 24 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:42:55.103964000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 0.983308000 seconds] Frame Number: 24 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Destination: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0027 (39) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b56 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.146 (165.227.249.146) Encapsulating Security Payload ESP SPI: 0xf442927e ESP Sequence: 2 0000 00 0c 29 ba 58 19 00 0c 29 48 f8 2f 08 00 45 00 ..).X...)H./..E. 0010 00 78 00 27 00 00 f0 32 8b 56 a5 e3 f9 7c a5 e3 .x.'...2.V...|.. 0020 f9 92 f4 42 92 7e 00 00 00 02 fb 3d 7b d2 ec e4 ...B.~.....={... 0030 63 19 67 4f 77 28 29 0a bb 37 3a 9a f6 d2 3e 42 c.gOw()..7:...>B 0040 2d 9e 73 2b 38 9b 52 0c 99 6f d0 f3 82 68 6a 7b -.s+8.R..o...hj{ 0050 50 04 7d 70 8b 14 b4 1a 9a 6b 18 34 71 d3 1d ce P.}p.....k.4q... 0060 ce d1 d0 3d 50 59 09 60 16 19 76 e1 31 18 76 57 ...=PY.`..v.1.vW 0070 67 ba e7 fc 51 c7 48 c7 e4 af 31 85 13 ab 9f 64 g...Q.H...1....d 0080 02 e1 34 13 b1 72 ..4..r Frame 25 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:42:55.104830000 [Time delta from previous captured frame: 0.000866000 seconds] [Time delta from previous displayed frame: 0.000866000 seconds] [Time since reference or first frame: 0.984174000 seconds] Frame Number: 25 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x1d34 (7476) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 127 Protocol: ESP (0x32) Header checksum: 0xdf49 [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0xc7d67ff5 ESP Sequence: 2 0000 00 0c 29 48 f8 2f 00 0c 29 ba 58 19 08 00 45 00 ..)H./..).X...E. 0010 00 78 1d 34 00 00 7f 32 df 49 a5 e3 f9 92 a5 e3 .x.4...2.I...... 0020 f9 7c c7 d6 7f f5 00 00 00 02 58 19 44 71 f8 01 .|........X.Dq.. 0030 13 e1 99 cf 00 98 1e 55 bd 24 23 87 bf 3c 77 a6 .......U.$#..... 0070 f6 76 e3 dd 8e 47 d5 d7 47 1c 6d c2 e4 5d 4a 6b .v...G..G.m..]Jk 0080 97 9e 6b 89 55 37 ..k.U7 Frame 26 (134 bytes on wire, 134 bytes captured) Arrival Time: Jun 11, 2010 14:42:55.104843000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 0.984187000 seconds] Frame Number: 26 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) Address: 00:0c:29:ba:58:19 (00:0c:29:ba:58:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x1d34 (7476) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 127 Protocol: ESP (0x32) Header checksum: 0xdf49 [correct] [Good: True] [Bad : False] Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0xc7d67ff5 ESP Sequence: 2 0000 00 0c 29 48 f8 2f 00 0c 29 ba 58 19 08 00 45 00 ..)H./..).X...E. 0010 00 78 1d 34 00 00 7f 32 df 49 a5 e3 f9 92 a5 e3 .x.4...2.I...... 0020 f9 7c c7 d6 7f f5 00 00 00 02 58 19 44 71 f8 01 .|........X.Dq.. 0030 13 e1 99 cf 00 98 1e 55 bd 24 23 87 bf 3c 77 a6 .......U.$#..... 0070 f6 76 e3 dd 8e 47 d5 d7 47 1c 6d c2 e4 5d 4a 6b .v...G..G.m..]Jk 0080 97 9e 6b 89 55 37 ..k.U7