Frame 1 (270 bytes on wire, 270 bytes captured) Arrival Time: Feb 11, 2006 12:07:31.819527000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 270 bytes Capture Length: 270 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: BAB7B64C Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x00cb (203) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a4f [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 232 Checksum: 0x1926 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x2472370196D8BDD8 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 224 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 44 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x8F9CC94E01248ECDF147594C284B213B Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-01 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 00 fc 00 cb 00 00 40 11 3a 4f a5 e3 f9 7c a5 e3 ......@.:O...|.. 0020 f9 93 01 f4 01 f4 00 e8 19 26 24 72 37 01 96 d8 .........&$r7... 0030 bd d8 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 e0 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 00 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 8f 9c c9 4e 01 24 8e cd f1 47 59 4c 28 4b .....N.$...GYL(K 0090 21 3b 0d 00 00 14 27 ba b5 dc 01 ea 07 60 ea 4e !;....'......`.N 00a0 31 90 ac 27 c0 d0 0d 00 00 14 61 05 c4 22 e7 68 1..'......a..".h 00b0 47 e4 3f 96 84 80 12 92 ae cd 0d 00 00 14 44 85 G.?...........D. 00c0 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 0d 00 .-.......F.y.... 00d0 00 14 cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 ...`FC5.!.|...h. 00e0 a4 48 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .H........>.in.c 00f0 81 b5 ec 42 7b 1f 00 00 00 14 7d 94 19 a6 53 10 ...B{.....}...S. 0100 ca 6f 2c 17 9d 92 15 52 9d 56 ba b7 b6 4c .o,....R.V...L Frame 2 (154 bytes on wire, 154 bytes captured) Arrival Time: Feb 11, 2006 12:07:31.820403000 Time delta from previous packet: 0.000876000 seconds Time since reference or first frame: 0.000876000 seconds Frame Number: 2 Packet Length: 154 bytes Capture Length: 154 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: FD8C49ED Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x292a (10538) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x5363 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 116 Checksum: 0xb966 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x2472370196D8BDD8 Responder cookie: 0xE20203BF70FE2128 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 108 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 24 Vendor ID: Microsoft L2TP/IPSec VPN Client 0000 00 0c 29 f4 af 90 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 88 29 2a 00 00 ff 11 53 63 a5 e3 f9 93 a5 e3 ..)*....Sc...... 0020 f9 7c 01 f4 01 f4 00 74 b9 66 24 72 37 01 96 d8 .|.....t.f$r7... 0030 bd d8 e2 02 03 bf 70 fe 21 28 01 10 02 00 00 00 ......p.!(...... 0040 00 00 00 00 00 6c 0d 00 00 38 00 00 00 01 00 00 .....l...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 70 80 00 00 ............p... 0080 00 18 40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 ..@H..n...%..... 0090 c2 d3 c0 00 00 00 fd 8c 49 ed ........I. Frame 3 (226 bytes on wire, 226 bytes captured) Arrival Time: Feb 11, 2006 12:07:31.824105000 Time delta from previous packet: 0.003702000 seconds Time since reference or first frame: 0.004578000 seconds Frame Number: 3 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: 370EAB42 Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x00cc (204) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a7a [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x937b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x2472370196D8BDD8 Responder cookie: 0xE20203BF70FE2128 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 00 d0 00 cc 00 00 40 11 3a 7a a5 e3 f9 7c a5 e3 ......@.:z...|.. 0020 f9 93 01 f4 01 f4 00 bc 93 7b 24 72 37 01 96 d8 .........{$r7... 0030 bd d8 e2 02 03 bf 70 fe 21 28 04 10 02 00 00 00 ......p.!(...... 0040 00 00 00 00 00 b4 0a 00 00 84 3c 37 4d 42 e6 19 ..........<7MB.. 0050 ac 68 ae 61 da cd 00 c9 b4 94 b1 f3 f7 84 63 6d .h.a..........cm 0060 04 e6 26 27 07 d9 11 fd d3 06 69 e8 88 84 78 76 ..&'......i...xv 0070 e1 fe af 33 08 f7 19 1f b4 42 9c 9f e9 86 1e 04 ...3.....B...... 0080 b5 31 12 32 05 65 14 3c b0 ab 6d 76 68 2f d7 be .1.2.e.<..mvh/.. 0090 8f e2 6b fe b3 fd e2 c6 5a 77 02 14 b8 d5 7d ec ..k.....Zw....}. 00a0 15 3a 12 e8 3f 9f 9d 3a 01 52 5a 7b c1 be 68 cc .:..?..:.RZ{..h. 00b0 58 b4 f1 49 11 eb 97 db f3 a8 73 fb 57 66 d7 f5 X..I......s.Wf.. 00c0 2b 3a cb 88 3b d6 22 35 ca ac 00 00 00 14 ff 6d +:..;."5.......m 00d0 73 02 bb cf bd cd 50 8f c5 6a f1 42 6a f6 37 0e s.....P..j.Bj.7. 00e0 ab 42 .B Frame 4 (302 bytes on wire, 302 bytes captured) Arrival Time: Feb 11, 2006 12:07:31.825593000 Time delta from previous packet: 0.001488000 seconds Time since reference or first frame: 0.006066000 seconds Frame Number: 4 Packet Length: 302 bytes Capture Length: 302 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 4A2D13A9 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x292b (10539) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x52ce [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xe08c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x2472370196D8BDD8 Responder cookie: 0xE20203BF70FE2128 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x12F5F28C457168A9702D9FE274CC0100 Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x17C5A4A270FF2128B67A404D417B346C Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x1F07F70EAA6514D3B0FA96542A500100 0000 00 0c 29 f4 af 90 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 01 1c 29 2b 00 00 ff 11 52 ce a5 e3 f9 93 a5 e3 ..)+....R....... 0020 f9 7c 01 f4 01 f4 01 08 e0 8c 24 72 37 01 96 d8 .|........$r7... 0030 bd d8 e2 02 03 bf 70 fe 21 28 04 10 02 00 00 00 ......p.!(...... 0040 00 00 00 00 01 00 0a 00 00 84 05 98 2c 6c 94 b7 ............,l.. 0050 e5 25 da a1 ef 66 64 42 f2 24 91 f4 10 20 5f 1b .%...fdB.$... _. 0060 3b a5 70 da 91 f5 bf bc 7f 0e bc d8 26 dd c9 18 ;.p.........&... 0070 c7 ba 92 79 94 d9 5d 39 89 06 0f f7 eb f5 8d ef ...y..]9........ 0080 67 c9 42 5f 2e 30 b6 26 73 b7 17 d4 01 db 9e e7 g.B_.0.&s....... 0090 92 b3 cd 2a 89 eb 36 01 fc 37 7e 51 bc 98 ee 74 ...*..6..7~Q...t 00a0 60 7c f1 39 d9 9a 2a df 7b c9 3f cc ce 80 ae db `|.9..*.{.?..... 00b0 53 32 41 6e 18 69 06 a7 83 14 55 70 d2 b3 c3 1f S2An.i....Up.... 00c0 86 bf a7 cd 04 7c 33 20 1d ec 0d 00 00 18 fb f5 .....|3 ........ 00d0 47 d9 19 57 7f a8 d3 bd 0f 55 27 0b 48 22 0f 1e G..W.....U'.H".. 00e0 9f 1d 0d 00 00 14 12 f5 f2 8c 45 71 68 a9 70 2d ..........Eqh.p- 00f0 9f e2 74 cc 01 00 0d 00 00 0c 09 00 26 89 df d6 ..t.........&... 0100 b7 12 0d 00 00 14 17 c5 a4 a2 70 ff 21 28 b6 7a ..........p.!(.z 0110 40 4d 41 7b 34 6c 00 00 00 14 1f 07 f7 0e aa 65 @MA{4l.........e 0120 14 d3 b0 fa 96 54 2a 50 01 00 4a 2d 13 a9 .....T*P..J-.. Frame 5 (122 bytes on wire, 122 bytes captured) Arrival Time: Feb 11, 2006 12:07:31.828224000 Time delta from previous packet: 0.002631000 seconds Time since reference or first frame: 0.008697000 seconds Frame Number: 5 Packet Length: 122 bytes Capture Length: 122 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: DDD23B55 Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x00cd (205) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3ae1 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x943a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x2472370196D8BDD8 Responder cookie: 0xE20203BF70FE2128 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 00 68 00 cd 00 00 40 11 3a e1 a5 e3 f9 7c a5 e3 .h....@.:....|.. 0020 f9 93 01 f4 01 f4 00 54 94 3a 24 72 37 01 96 d8 .......T.:$r7... 0030 bd d8 e2 02 03 bf 70 fe 21 28 05 10 02 01 00 00 ......p.!(...... 0040 00 00 00 00 00 4c f8 44 1e b7 af e1 f4 0d 1d c0 .....L.D........ 0050 4d 7c 91 8c a7 b6 c4 8a 67 ab 8f d9 d9 d3 b3 bc M|......g....... 0060 52 74 2c ab ac 36 e0 01 8f fb 2b 4c 03 71 c6 4f Rt,..6....+L.q.O 0070 46 c2 12 9c 66 17 dd d2 3b 55 F...f...;U Frame 6 (138 bytes on wire, 138 bytes captured) Arrival Time: Feb 11, 2006 12:07:31.829183000 Time delta from previous packet: 0.000959000 seconds Time since reference or first frame: 0.009656000 seconds Frame Number: 6 Packet Length: 138 bytes Capture Length: 138 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 5D277A16 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x292c (10540) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x5371 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xca34 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x2472370196D8BDD8 Responder cookie: 0xE20203BF70FE2128 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 f4 af 90 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 78 29 2c 00 00 ff 11 53 71 a5 e3 f9 93 a5 e3 .x),....Sq...... 0020 f9 7c 01 f4 01 f4 00 64 ca 34 24 72 37 01 96 d8 .|.....d.4$r7... 0030 bd d8 e2 02 03 bf 70 fe 21 28 05 10 02 01 00 00 ......p.!(...... 0040 00 00 00 00 00 5c be 89 c6 02 b5 c0 06 02 a6 22 .....\........." 0050 18 9a 3c 45 10 93 88 f2 6f 89 77 a2 46 12 b3 f3 ..F 0070 ee 7d b1 87 fb de a1 f2 68 72 04 be c6 97 42 d2 .}......hr....B. 0080 a7 a1 8d a5 a4 68 5d 27 7a 16 .....h]'z. Frame 7 (346 bytes on wire, 346 bytes captured) Arrival Time: Feb 11, 2006 12:07:31.837522000 Time delta from previous packet: 0.008339000 seconds Time since reference or first frame: 0.017995000 seconds Frame Number: 7 Packet Length: 346 bytes Capture Length: 346 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: 8A89CB68 Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x00ce (206) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a00 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x9a6d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x2472370196D8BDD8 Responder cookie: 0xE20203BF70FE2128 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x737802C1 Length: 300 Encrypted payload (272 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 01 48 00 ce 00 00 40 11 3a 00 a5 e3 f9 7c a5 e3 .H....@.:....|.. 0020 f9 93 01 f4 01 f4 01 34 9a 6d 24 72 37 01 96 d8 .......4.m$r7... 0030 bd d8 e2 02 03 bf 70 fe 21 28 08 10 20 01 73 78 ......p.!(.. .sx 0040 02 c1 00 00 01 2c 12 ea 97 1d 5b 75 92 4c d0 95 .....,....[u.L.. 0050 11 79 99 6a b6 87 44 db a9 5f 4b 98 a4 10 9d f0 .y.j..D.._K..... 0060 40 dd d4 37 4b 35 65 27 f9 65 d4 28 a2 56 f2 4c @..7K5e'.e.(.V.L 0070 8f e6 13 f5 27 47 f9 f1 03 51 19 a6 a9 52 1e 11 ....'G...Q...R.. 0080 3e 1b 41 1e 11 fa 86 78 48 e9 cd 34 d0 a6 91 cd >.A....xH..4.... 0090 44 54 e2 47 66 a9 c9 e8 2c 65 1b 88 5d ad 99 23 DT.Gf...,e..]..# 00a0 e8 ee 84 b4 8d 6d a9 00 67 9a 2f 5d a7 5b 92 aa .....m..g./].[.. 00b0 d4 e8 8c 06 c1 82 ee 62 bf d3 5d 53 23 56 9f a0 .......b..]S#V.. 00c0 3f 2a 21 c7 60 68 dd d7 78 f9 41 e2 66 90 43 94 ?*!.`h..x.A.f.C. 00d0 7d a5 09 a3 0a bd 85 e4 96 bb ca 0e 5e ef fe 1a }...........^... 00e0 db 9c 9a 5a fe 3b e1 f0 bf 18 91 24 8a 0b 77 e3 ...Z.;.....$..w. 00f0 96 10 15 a7 7c 1b 42 e1 92 9a 38 44 99 8a 3a f3 ....|.B...8D..:. 0100 ca ec b0 b1 c0 37 0b 20 99 88 86 36 df a7 87 67 .....7. ...6...g 0110 a6 ed b5 77 11 f2 1d 5a a6 83 00 89 2e 8f 97 11 ...w...Z........ 0120 bf e5 30 97 44 41 ec bd 8c 3d 39 9e f5 fe db 4e ..0.DA...=9....N 0130 63 6d c8 fc e0 ca 70 11 3f ed 26 a9 ab ff a7 70 cm....p.?.&....p 0140 d3 48 e3 05 2f 82 cc ed 83 c6 27 cd b4 93 53 cc .H../.....'...S. 0150 85 a9 c2 3b c4 f3 8a 89 cb 68 ...;.....h Frame 8 (346 bytes on wire, 346 bytes captured) Arrival Time: Feb 11, 2006 12:07:31.840170000 Time delta from previous packet: 0.002648000 seconds Time since reference or first frame: 0.020643000 seconds Frame Number: 8 Packet Length: 346 bytes Capture Length: 346 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 6FD9E077 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x292d (10541) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x52a0 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x914a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x2472370196D8BDD8 Responder cookie: 0xE20203BF70FE2128 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x737802C1 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 f4 af 90 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 01 48 29 2d 00 00 ff 11 52 a0 a5 e3 f9 93 a5 e3 .H)-....R....... 0020 f9 7c 01 f4 01 f4 01 34 91 4a 24 72 37 01 96 d8 .|.....4.J$r7... 0030 bd d8 e2 02 03 bf 70 fe 21 28 08 10 20 01 73 78 ......p.!(.. .sx 0040 02 c1 00 00 01 2c c2 90 79 83 56 ef c7 8c 91 3b .....,..y.V....; 0050 df 10 27 7f 0b 4a 44 05 2b 52 9e dc cc b1 2e 2f ..'..JD.+R...../ 0060 5e 12 c5 3d 7c 18 80 29 73 94 4f ec 4f 9e f1 77 ^..=|..)s.O.O..w 0070 a3 87 e6 3d 9b d2 c8 94 c4 ba 83 10 94 52 4a e0 ...=.........RJ. 0080 19 dd 8d 93 5c f8 08 0b d1 1f 06 01 ee cf 52 d6 ....\.........R. 0090 fa 4a fa ac e5 cb 12 1a 36 b6 94 f1 b5 1f 7c f0 .J......6.....|. 00a0 2f 7b ec d3 5f 43 b2 34 e8 cb 86 ba f2 10 bc a8 /{.._C.4........ 00b0 c3 3e bb d8 26 ca ac 7c 7e 55 da 2d fa 2a d8 0c .>..&..|~U.-.*.. 00c0 01 63 59 a3 a3 4b fd fc 1f 76 94 f6 ef 6e 2f a6 .cY..K...v...n/. 00d0 6b 3c 25 78 28 f1 8e 8d e3 ab 0b b3 90 25 cd dd k<%x(........%.. 00e0 13 be 98 eb ee c9 32 7b 20 b9 bb 92 98 98 0e 30 ......2{ ......0 00f0 17 65 29 8f 8c 8c fa bc 07 e9 96 77 ee 99 9c 34 .e)........w...4 0100 1d 4f 2a 99 79 be d6 b2 ee 71 18 2f 0a 84 4e 7d .O*.y....q./..N} 0110 04 c7 4e 97 fd 4f 21 cb 04 0b 03 b7 f4 ab f2 db ..N..O!......... 0120 3f f8 e3 83 34 fb 43 6d 67 db f0 ae 82 06 6c 75 ?...4.Cmg.....lu 0130 28 8c e8 c0 70 f2 7c 74 7d 42 bc e8 5d e2 55 f4 (...p.|t}B..].U. 0140 c4 71 35 36 b5 d8 b6 d7 3f 0f 21 82 36 05 94 c7 .q56....?.!.6... 0150 46 6f ac a4 f2 f5 6f d9 e0 77 Fo....o..w Frame 9 (106 bytes on wire, 106 bytes captured) Arrival Time: Feb 11, 2006 12:07:31.843444000 Time delta from previous packet: 0.003274000 seconds Time since reference or first frame: 0.023917000 seconds Frame Number: 9 Packet Length: 106 bytes Capture Length: 106 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: DEB07E91 Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x00cf (207) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3aef [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xd4ad [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x2472370196D8BDD8 Responder cookie: 0xE20203BF70FE2128 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x737802C1 Length: 60 Encrypted payload (32 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 00 58 00 cf 00 00 40 11 3a ef a5 e3 f9 7c a5 e3 .X....@.:....|.. 0020 f9 93 01 f4 01 f4 00 44 d4 ad 24 72 37 01 96 d8 .......D..$r7... 0030 bd d8 e2 02 03 bf 70 fe 21 28 08 10 20 01 73 78 ......p.!(.. .sx 0040 02 c1 00 00 00 3c 6c 70 ce e1 85 31 7e ac 1d 90 .....oZ 0090 83 b6 ab 90 df d3 d9 2b a7 51 9b 2a de bd 44 c4 .......+.Q.*..D. 00a0 aa a7 46 b6 f4 52 ef 0d 13 8b ..F..R.... Frame 11 (170 bytes on wire, 170 bytes captured) Arrival Time: Feb 11, 2006 12:07:32.116746000 Time delta from previous packet: 0.000908000 seconds Time since reference or first frame: 0.297219000 seconds Frame Number: 11 Packet Length: 170 bytes Capture Length: 170 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 9D7B4E7A Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x2e29 (11817) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x0d34 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0xc08d36e0 Sequence: 1 Data (124 bytes) 0000 00 0c 29 f4 af 90 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 98 2e 29 00 00 40 32 0d 34 a5 e3 f9 93 a5 e3 ...)..@2.4...... 0020 f9 7c c0 8d 36 e0 00 00 00 01 a2 be f5 a9 9d 95 .|..6........... 0030 3a 8d f5 50 bd d9 cc ed 05 70 2a 9c 28 43 63 8b :..P.....p*.(Cc. 0040 6e 16 21 4e 07 b8 f1 60 ed 75 2c ca 1d 40 5e e7 n.!N...`.u,..@^. 0050 b4 77 25 d3 03 6d 06 71 cf 40 91 1b 4d b2 4b f5 .w%..m.q.@..M.K. 0060 96 7c 9c be 9d 46 5d 27 f5 f7 92 f5 41 c3 91 5b .|...F]'....A..[ 0070 ae 30 15 e4 5e 82 7c bc a4 3c ef 82 b1 5e 65 59 .0..^.|..<...^eY 0080 e2 2c ef a7 3a 6f 66 85 a9 dd 5c 29 a4 dc 09 77 .,..:of...\)...w 0090 e0 97 2c c7 69 3b 8d 73 12 1b e4 c9 44 c6 b5 bc ..,.i;.s....D... 00a0 78 38 d8 78 4c 6f 9d 7b 4e 7a x8.xLo.{Nz Frame 12 (170 bytes on wire, 170 bytes captured) Arrival Time: Feb 11, 2006 12:07:32.437013000 Time delta from previous packet: 0.320267000 seconds Time since reference or first frame: 0.617486000 seconds Frame Number: 12 Packet Length: 170 bytes Capture Length: 170 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: 122E0503 Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0008 (8) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b54 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) Encapsulating Security Payload SPI: 0x06bcb695 Sequence: 3 Data (124 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 00 98 00 08 00 00 f0 32 8b 54 a5 e3 f9 7c a5 e3 .......2.T...|.. 0020 f9 93 06 bc b6 95 00 00 00 03 d2 70 d1 f8 ee 74 ...........p...t 0030 45 e7 39 36 e6 60 9a f1 48 25 84 41 72 44 e5 75 E.96.`..H%.ArD.u 0040 5c b6 0a c3 ca bd 58 59 39 b7 67 fd e4 6e c2 92 \.....XY9.g..n.. 0050 d8 b0 85 2f 19 51 ba 7e cd be b0 c0 1c bd 7b 57 .../.Q.~......{W 0060 21 93 d0 01 08 5c f1 f3 bf 98 20 45 4f 25 4d 86 !....\.... EO%M. 0070 0d f9 40 bd b5 6c 7c 17 03 9e 51 2b 80 65 67 4a ..@..l|...Q+.egJ 0080 13 fe b0 44 ca 64 38 0e f7 39 10 e2 a6 f6 36 0e ...D.d8..9....6. 0090 e9 ab 19 da 26 3b 31 37 11 92 23 90 7a 6b 91 77 ....&;17..#.zk.w 00a0 5b a3 c7 a4 ee ba 12 2e 05 03 [......... Frame 13 (170 bytes on wire, 170 bytes captured) Arrival Time: Feb 11, 2006 12:07:32.437312000 Time delta from previous packet: 0.000299000 seconds Time since reference or first frame: 0.617785000 seconds Frame Number: 13 Packet Length: 170 bytes Capture Length: 170 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 1B0368D7 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x2f29 (12073) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x0c34 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0xc08d36e0 Sequence: 2 Data (124 bytes) 0000 00 0c 29 f4 af 90 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 98 2f 29 00 00 40 32 0c 34 a5 e3 f9 93 a5 e3 ../)..@2.4...... 0020 f9 7c c0 8d 36 e0 00 00 00 02 4e 94 e5 d8 e9 b8 .|..6.....N..... 0030 f0 35 a7 15 79 89 70 f3 0c d1 29 d2 7c 23 f9 a5 .5..y.p...).|#.. 0040 1e 9c d9 6d 7a d9 de 36 0f a2 38 43 f1 39 b6 ff ...mz..6..8C.9.. 0050 0f b6 98 c0 75 93 83 55 79 81 c9 6b 1a 85 ea a1 ....u..Uy..k.... 0060 76 3d de 81 7e ca 61 b4 dc 89 1e 74 d0 69 61 39 v=..~.a....t.ia9 0070 e8 6a ba d5 85 2b 75 7d 9b 39 0c b5 73 5c da d4 .j...+u}.9..s\.. 0080 42 30 bd 82 38 82 fa dd 16 c2 a9 66 39 1d b2 e3 B0..8......f9... 0090 26 eb 73 d5 b8 c1 0f bd 70 a7 15 ab cd 2b da 76 &.s.....p....+.v 00a0 e6 fa 82 d1 2f 56 1b 03 68 d7 ..../V..h. Frame 14 (170 bytes on wire, 170 bytes captured) Arrival Time: Feb 11, 2006 12:07:33.050134000 Time delta from previous packet: 0.612822000 seconds Time since reference or first frame: 1.230607000 seconds Frame Number: 14 Packet Length: 170 bytes Capture Length: 170 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: 80F9870E Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0009 (9) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b53 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) Encapsulating Security Payload SPI: 0x06bcb695 Sequence: 4 Data (124 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 00 98 00 09 00 00 f0 32 8b 53 a5 e3 f9 7c a5 e3 .......2.S...|.. 0020 f9 93 06 bc b6 95 00 00 00 04 70 4a 7d e6 82 b9 ..........pJ}... 0030 84 f8 a4 ef 80 cc d7 cc 46 38 d4 97 db 5f fc cc ........F8..._.. 0040 2b e3 6c 92 19 a9 10 cb 54 6a f6 3b ae 9d 04 e9 +.l.....Tj.;.... 0050 38 f1 86 c5 7e 96 fb d6 c4 78 9a 09 2f 3f d9 de 8...~....x../?.. 0060 8b 29 07 68 02 d8 f1 24 87 11 42 c0 ca 84 de 84 .).h...$..B..... 0070 a3 b2 80 88 8e 95 34 99 b9 62 26 e1 f9 ec 3f ec ......4..b&...?. 0080 8d 01 4c b4 6d 15 58 0f 09 86 7c d5 c5 b5 af 02 ..L.m.X...|..... 0090 fc f7 6e 17 33 33 73 03 85 b2 28 e6 ba 35 ef da ..n.33s...(..5.. 00a0 48 64 21 f7 0e a2 80 f9 87 0e Hd!....... Frame 15 (170 bytes on wire, 170 bytes captured) Arrival Time: Feb 11, 2006 12:07:33.050566000 Time delta from previous packet: 0.000432000 seconds Time since reference or first frame: 1.231039000 seconds Frame Number: 15 Packet Length: 170 bytes Capture Length: 170 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: CD4107A8 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x3029 (12329) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x0b34 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0xc08d36e0 Sequence: 3 Data (124 bytes) 0000 00 0c 29 f4 af 90 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 98 30 29 00 00 40 32 0b 34 a5 e3 f9 93 a5 e3 ..0)..@2.4...... 0020 f9 7c c0 8d 36 e0 00 00 00 03 4b da d1 e2 7c 80 .|..6.....K...|. 0030 16 21 d3 8c f6 ef 14 48 90 84 c1 f1 b6 a8 4a bb .!.....H......J. 0040 dc 3a 92 6b 15 fa 6e fc 96 0f 2d c8 93 ae 68 85 .:.k..n...-...h. 0050 8c d3 a2 4a 84 b6 c9 74 7d 9c fe d7 48 d1 67 5b ...J...t}...H.g[ 0060 02 7e 4a b5 99 64 90 ea b7 bb ad 55 f0 e0 d5 43 .~J..d.....U...C 0070 c6 f2 29 3b e7 a0 41 09 61 08 8d 29 9a b5 48 28 ..);..A.a..)..H( 0080 9d 20 5c 40 ac 1e 7e 94 2c c2 89 3a de 2c d8 6e . \@..~.,..:.,.n 0090 90 40 80 38 ab c5 aa 97 c6 1d 79 e6 3f 14 18 b4 .@.8......y.?... 00a0 e5 89 64 1c b6 48 cd 41 07 a8 ..d..H.A.. Frame 16 (170 bytes on wire, 170 bytes captured) Arrival Time: Feb 11, 2006 12:07:33.661398000 Time delta from previous packet: 0.610832000 seconds Time since reference or first frame: 1.841871000 seconds Frame Number: 16 Packet Length: 170 bytes Capture Length: 170 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: 5EF56D34 Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x000a (10) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b52 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) Encapsulating Security Payload SPI: 0x06bcb695 Sequence: 5 Data (124 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 00 98 00 0a 00 00 f0 32 8b 52 a5 e3 f9 7c a5 e3 .......2.R...|.. 0020 f9 93 06 bc b6 95 00 00 00 05 92 45 de 68 b5 67 ...........E.h.g 0030 49 5b 6e 73 d8 aa 00 ea e5 e7 c6 66 64 59 c2 1b I[ns.......fdY.. 0040 cb 67 97 27 6b 59 e9 ff ae 7b 5b 36 68 44 d2 4b .g.'kY...{[6hD.K 0050 1d fe 3c a3 ef 36 d0 a0 e3 bf ac b5 06 db b1 56 ..<..6.........V 0060 0f 70 b5 55 07 3a 49 9e 7b 8b f5 b2 29 d7 16 3e .p.U.:I.{...)..> 0070 07 ae eb 82 a9 57 8a d3 cd ea ad 5a 14 b2 8c 09 .....W.....Z.... 0080 89 dd 37 42 07 22 84 7e 11 2f db 47 79 ff f9 7e ..7B.".~./.Gy..~ 0090 bf a5 73 9a 48 97 04 c2 49 16 90 31 45 af 1b ce ..s.H...I..1E... 00a0 4f 3c 94 58 ed f8 5e f5 6d 34 O<.X..^.m4 Frame 17 (170 bytes on wire, 170 bytes captured) Arrival Time: Feb 11, 2006 12:07:33.661818000 Time delta from previous packet: 0.000420000 seconds Time since reference or first frame: 1.842291000 seconds Frame Number: 17 Packet Length: 170 bytes Capture Length: 170 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 66AF3D42 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x3129 (12585) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x0a34 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0xc08d36e0 Sequence: 4 Data (124 bytes) 0000 00 0c 29 f4 af 90 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 98 31 29 00 00 40 32 0a 34 a5 e3 f9 93 a5 e3 ..1)..@2.4...... 0020 f9 7c c0 8d 36 e0 00 00 00 04 c8 2e a7 5f 3e 3b .|..6........_>; 0030 f4 3d 62 9e 92 e5 38 8d e3 d0 12 60 c3 21 f3 e1 .=b...8....`.!.. 0040 6f 17 cb 40 2a 0c 34 50 84 1c 5e 86 8c ae ff ad o..@*.4P..^..... 0050 38 5f 6b 32 62 2a c7 b2 a6 80 8f b8 21 9d 6d 09 8_k2b*......!.m. 0060 fc f6 33 30 f4 44 68 a5 71 c0 63 52 19 a7 9d ff ..30.Dh.q.cR.... 0070 ac 3a ad e2 a4 92 24 4e 4c d6 c3 d1 6f 9a 19 d4 .:....$NL...o... 0080 4e 1e 89 3c e6 ed e1 2d 9b d5 70 94 99 a3 ba 8a N..<...-..p..... 0090 a1 f8 74 c1 f5 15 31 91 92 0d 23 d7 7b 24 0f d3 ..t...1...#.{$.. 00a0 8d 14 d2 f7 52 9e 66 af 3d 42 ....R.f.=B