Frame 1 (326 bytes on wire, 326 bytes captured) Arrival Time: Aug 11, 2011 13:51:22.902205000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Destination: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Address: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfad8 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xe30d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E20F541C1AF8468C Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0xE20F541C1AF8468C Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 c4 3d c7 cc fa 50 00 0c 29 96 68 b2 08 00 45 00 .=...P..).h...E. 0010 01 38 00 00 40 00 40 11 fa d8 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 98 01 f4 01 f4 01 24 e3 0d e2 0f 54 1c 1a f8 .......$....T... 0030 46 8c 00 00 00 00 00 00 00 00 01 10 02 00 00 00 F............... 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 e2 0f 54 1c 1a f8 .....|......T... 0060 46 8c 03 00 00 24 00 01 00 00 80 01 00 07 80 0e F....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 2 (326 bytes on wire, 326 bytes captured) Arrival Time: Aug 11, 2011 13:51:22.902233000 [Time delta from previous captured frame: 0.000028000 seconds] [Time delta from previous displayed frame: 0.000028000 seconds] [Time since reference or first frame: 0.000028000 seconds] Frame Number: 2 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Destination: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Address: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfad8 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xe30d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E20F541C1AF8468C Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0xE20F541C1AF8468C Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 c4 3d c7 cc fa 50 00 0c 29 96 68 b2 08 00 45 00 .=...P..).h...E. 0010 01 38 00 00 40 00 40 11 fa d8 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 98 01 f4 01 f4 01 24 e3 0d e2 0f 54 1c 1a f8 .......$....T... 0030 46 8c 00 00 00 00 00 00 00 00 01 10 02 00 00 00 F............... 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 e2 0f 54 1c 1a f8 .....|......T... 0060 46 8c 03 00 00 24 00 01 00 00 80 01 00 07 80 0e F....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 3 (174 bytes on wire, 174 bytes captured) Arrival Time: Aug 11, 2011 13:51:22.969642000 [Time delta from previous captured frame: 0.067409000 seconds] [Time delta from previous displayed frame: 0.067409000 seconds] [Time since reference or first frame: 0.067437000 seconds] Frame Number: 3 Frame Length: 174 bytes Capture Length: 174 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Address: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.152 (165.227.249.152), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 160 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb70 [correct] [Good: True] [Bad : False] Source: 165.227.249.152 (165.227.249.152) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 140 Checksum: 0x1209 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E20F541C1AF8468C Responder cookie: 1BF59E4DCA3626E6 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 132 Security Association payload Next payload: Vendor ID (13) Payload length: 64 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 52 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 1 SPI: 0x0000000000000000 Transform payload # 0 Next payload: NONE (0) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 96 68 b2 c4 3d c7 cc fa 50 08 00 45 00 ..).h..=...P..E. 0010 00 a0 00 00 40 00 40 11 fb 70 a5 e3 f9 98 a5 e3 ....@.@..p...... 0020 f9 7c 01 f4 01 f4 00 8c 12 09 e2 0f 54 1c 1a f8 .|..........T... 0030 46 8c 1b f5 9e 4d ca 36 26 e6 01 10 02 00 00 00 F....M.6&....... 0040 00 00 00 00 00 84 0d 00 00 40 00 00 00 01 00 00 .........@...... 0050 00 01 00 00 00 34 00 01 08 01 00 00 00 00 00 00 .....4.......... 0060 00 00 00 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 0d 00 00 14 af ca d7 13 68 a1 ....p.........h. 0090 f1 c9 6b 86 96 fc 77 57 01 00 00 00 00 14 70 03 ..k...wW......p. 00a0 cb c1 09 7d be 9c 26 00 ba 69 83 bc 8b 35 ...}..&..i...5 Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 11, 2011 13:51:22.974720000 [Time delta from previous captured frame: 0.005078000 seconds] [Time delta from previous displayed frame: 0.005078000 seconds] [Time since reference or first frame: 0.072515000 seconds] Frame Number: 4 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Destination: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Address: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb40 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x72ae [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E20F541C1AF8468C Responder cookie: 1BF59E4DCA3626E6 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 c4 3d c7 cc fa 50 00 0c 29 96 68 b2 08 00 45 00 .=...P..).h...E. 0010 00 d0 00 00 40 00 40 11 fb 40 a5 e3 f9 7c a5 e3 ....@.@..@...|.. 0020 f9 98 01 f4 01 f4 00 bc 72 ae e2 0f 54 1c 1a f8 ........r...T... 0030 46 8c 1b f5 9e 4d ca 36 26 e6 04 10 02 00 00 00 F....M.6&....... 0040 00 00 00 00 00 b4 0a 00 00 84 86 dc e6 6b 6d 76 .............kmv 0050 fd 71 62 ee fa c5 f1 db 7e 98 de cf e7 39 ca 74 .qb.....~....9.t 0060 5e 38 d8 0e 1a 74 e1 ea 01 35 8f d2 36 cb 5f 3b ^8...t...5..6._; 0070 dc ea 57 ae 8c 41 7e 7e 5f c7 9d 6e 5a c2 fc d4 ..W..A~~_..nZ... 0080 f8 b1 79 f2 e8 e8 52 72 9a 17 70 eb 0e ba 87 f3 ..y...Rr..p..... 0090 89 99 73 ca 09 8b 96 ae 3d 9f d4 59 52 46 d8 e0 ..s.....=..YRF.. 00a0 1c 61 3e f7 78 65 dd 6c 1b 03 85 71 85 3f 4d cf .a>.xe.l...q.?M. 00b0 e8 7a d1 33 47 9c 10 a3 70 ac ab bc 36 20 53 89 .z.3G...p...6 S. 00c0 8b 7e e2 b1 b4 04 a4 dd d8 51 00 00 00 14 01 33 .~.......Q.....3 00d0 97 d6 c7 33 32 70 71 f3 89 50 9e 6b fd 04 ...32pq..P.k.. Frame 5 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 11, 2011 13:51:22.974743000 [Time delta from previous captured frame: 0.000023000 seconds] [Time delta from previous displayed frame: 0.000023000 seconds] [Time since reference or first frame: 0.072538000 seconds] Frame Number: 5 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Destination: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Address: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb40 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x72ae [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E20F541C1AF8468C Responder cookie: 1BF59E4DCA3626E6 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 c4 3d c7 cc fa 50 00 0c 29 96 68 b2 08 00 45 00 .=...P..).h...E. 0010 00 d0 00 00 40 00 40 11 fb 40 a5 e3 f9 7c a5 e3 ....@.@..@...|.. 0020 f9 98 01 f4 01 f4 00 bc 72 ae e2 0f 54 1c 1a f8 ........r...T... 0030 46 8c 1b f5 9e 4d ca 36 26 e6 04 10 02 00 00 00 F....M.6&....... 0040 00 00 00 00 00 b4 0a 00 00 84 86 dc e6 6b 6d 76 .............kmv 0050 fd 71 62 ee fa c5 f1 db 7e 98 de cf e7 39 ca 74 .qb.....~....9.t 0060 5e 38 d8 0e 1a 74 e1 ea 01 35 8f d2 36 cb 5f 3b ^8...t...5..6._; 0070 dc ea 57 ae 8c 41 7e 7e 5f c7 9d 6e 5a c2 fc d4 ..W..A~~_..nZ... 0080 f8 b1 79 f2 e8 e8 52 72 9a 17 70 eb 0e ba 87 f3 ..y...Rr..p..... 0090 89 99 73 ca 09 8b 96 ae 3d 9f d4 59 52 46 d8 e0 ..s.....=..YRF.. 00a0 1c 61 3e f7 78 65 dd 6c 1b 03 85 71 85 3f 4d cf .a>.xe.l...q.?M. 00b0 e8 7a d1 33 47 9c 10 a3 70 ac ab bc 36 20 53 89 .z.3G...p...6 S. 00c0 8b 7e e2 b1 b4 04 a4 dd d8 51 00 00 00 14 01 33 .~.......Q.....3 00d0 97 d6 c7 33 32 70 71 f3 89 50 9e 6b fd 04 ...32pq..P.k.. Frame 6 (242 bytes on wire, 242 bytes captured) Arrival Time: Aug 11, 2011 13:51:23.067288000 [Time delta from previous captured frame: 0.092545000 seconds] [Time delta from previous displayed frame: 0.092545000 seconds] [Time since reference or first frame: 0.165083000 seconds] Frame Number: 6 Frame Length: 242 bytes Capture Length: 242 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Address: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.152 (165.227.249.152), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb2c [correct] [Good: True] [Bad : False] Source: 165.227.249.152 (165.227.249.152) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0x139d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E20F541C1AF8468C Responder cookie: 1BF59E4DCA3626E6 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 20 Nonce Data Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 96 68 b2 c4 3d c7 cc fa 50 08 00 45 00 ..).h..=...P..E. 0010 00 e4 00 00 40 00 40 11 fb 2c a5 e3 f9 98 a5 e3 ....@.@..,...... 0020 f9 7c 01 f4 01 f4 00 d0 13 9d e2 0f 54 1c 1a f8 .|..........T... 0030 46 8c 1b f5 9e 4d ca 36 26 e6 04 10 02 00 00 00 F....M.6&....... 0040 00 00 00 00 00 c8 0a 00 00 84 57 03 ab 5d cd bc ..........W..].. 0050 1b 12 aa 81 2f c0 d9 8a 64 14 6d a0 48 87 5b a5 ..../...d.m.H.[. 0060 90 62 9b ec 1d 21 7e e8 bc 2c 3b 9c 0c c4 0d 11 .b...!~..,;..... 0070 cc dd 35 36 a8 a8 a6 b2 09 c4 7a cb 7b eb 3e 2e ..56......z.{.>. 0080 df 20 bb ac 3f 36 62 33 d8 8b b5 0c 3f dc 0a 99 . ..?6b3....?... 0090 34 d7 ca 14 f3 98 47 47 e2 83 a3 8c 0c ff 19 63 4.....GG.......c 00a0 fc 45 92 31 3b 6e 01 2c e7 aa ab a5 1d 6d 06 0e .E.1;n.,.....m.. 00b0 66 5d 1f 08 3b ba 6f cf 79 e3 2b 7b 58 f4 cc 67 f]..;.o.y.+{X..g 00c0 33 68 48 e0 1c 3a 96 53 88 c8 0d 00 00 14 c1 54 3hH..:.S.......T 00d0 ca ad 64 0f 7b 5a d0 39 d9 20 26 cf 68 ef 00 00 ..d.{Z.9. &.h... 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 11, 2011 13:51:23.072198000 [Time delta from previous captured frame: 0.004910000 seconds] [Time delta from previous displayed frame: 0.004910000 seconds] [Time since reference or first frame: 0.169993000 seconds] Frame Number: 7 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Destination: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Address: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb98 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xcfd1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E20F541C1AF8468C Responder cookie: 1BF59E4DCA3626E6 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 c4 3d c7 cc fa 50 00 0c 29 96 68 b2 08 00 45 00 .=...P..).h...E. 0010 00 78 00 00 40 00 40 11 fb 98 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 98 01 f4 01 f4 00 64 cf d1 e2 0f 54 1c 1a f8 .......d....T... 0030 46 8c 1b f5 9e 4d ca 36 26 e6 05 10 02 01 00 00 F....M.6&....... 0040 00 00 00 00 00 5c 59 ab dd 3b af 0a 3d a5 25 5e .....\Y..;..=.%^ 0050 91 58 3d 1f 1b 4d f5 9b 17 44 4a 1d fc 1c 1b 29 .X=..M...DJ....) 0060 8f 25 9b 4a 5c fc 73 88 8c 4e 32 30 39 eb c9 97 .%.J\.s..N209... 0070 e3 7e 78 3e fe 28 80 bf a2 9d 43 a3 f7 7a 2f d8 .~x>.(....C..z/. 0080 19 d0 9b b2 a6 61 .....a Frame 8 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 11, 2011 13:51:23.072225000 [Time delta from previous captured frame: 0.000027000 seconds] [Time delta from previous displayed frame: 0.000027000 seconds] [Time since reference or first frame: 0.170020000 seconds] Frame Number: 8 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Destination: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Address: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb98 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xcfd1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E20F541C1AF8468C Responder cookie: 1BF59E4DCA3626E6 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 c4 3d c7 cc fa 50 00 0c 29 96 68 b2 08 00 45 00 .=...P..).h...E. 0010 00 78 00 00 40 00 40 11 fb 98 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 98 01 f4 01 f4 00 64 cf d1 e2 0f 54 1c 1a f8 .......d....T... 0030 46 8c 1b f5 9e 4d ca 36 26 e6 05 10 02 01 00 00 F....M.6&....... 0040 00 00 00 00 00 5c 59 ab dd 3b af 0a 3d a5 25 5e .....\Y..;..=.%^ 0050 91 58 3d 1f 1b 4d f5 9b 17 44 4a 1d fc 1c 1b 29 .X=..M...DJ....) 0060 8f 25 9b 4a 5c fc 73 88 8c 4e 32 30 39 eb c9 97 .%.J\.s..N209... 0070 e3 7e 78 3e fe 28 80 bf a2 9d 43 a3 f7 7a 2f d8 .~x>.(....C..z/. 0080 19 d0 9b b2 a6 61 .....a Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: Aug 11, 2011 13:51:23.216263000 [Time delta from previous captured frame: 0.144038000 seconds] [Time delta from previous displayed frame: 0.144038000 seconds] [Time since reference or first frame: 0.314058000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Address: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.152 (165.227.249.152), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba8 [correct] [Good: True] [Bad : False] Source: 165.227.249.152 (165.227.249.152) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xe2df [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E20F541C1AF8468C Responder cookie: 1BF59E4DCA3626E6 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 96 68 b2 c4 3d c7 cc fa 50 08 00 45 00 ..).h..=...P..E. 0010 00 68 00 00 40 00 40 11 fb a8 a5 e3 f9 98 a5 e3 .h..@.@......... 0020 f9 7c 01 f4 01 f4 00 54 e2 df e2 0f 54 1c 1a f8 .|.....T....T... 0030 46 8c 1b f5 9e 4d ca 36 26 e6 05 10 02 01 00 00 F....M.6&....... 0040 00 00 00 00 00 4c 60 ea 57 5f 89 7d b3 c9 fe 6a .....L`.W_.}...j 0050 38 e9 d9 d6 c1 8f 73 f7 18 fe 6e 13 f4 fb 0f 15 8.....s...n..... 0060 47 c0 19 86 d4 70 14 43 f6 c6 40 ce 2c 25 63 97 G....p.C..@.,%c. 0070 38 af e5 67 98 6b 8..g.k Frame 10 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 11, 2011 13:51:23.230459000 [Time delta from previous captured frame: 0.014196000 seconds] [Time delta from previous displayed frame: 0.014196000 seconds] [Time since reference or first frame: 0.328254000 seconds] Frame Number: 10 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Address: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.152 (165.227.249.152), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb98 [correct] [Good: True] [Bad : False] Source: 165.227.249.152 (165.227.249.152) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xe476 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E20F541C1AF8468C Responder cookie: 1BF59E4DCA3626E6 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xc0ef9a8f Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 96 68 b2 c4 3d c7 cc fa 50 08 00 45 00 ..).h..=...P..E. 0010 00 78 00 00 40 00 40 11 fb 98 a5 e3 f9 98 a5 e3 .x..@.@......... 0020 f9 7c 01 f4 01 f4 00 64 e4 76 e2 0f 54 1c 1a f8 .|.....d.v..T... 0030 46 8c 1b f5 9e 4d ca 36 26 e6 08 10 05 01 c0 ef F....M.6&....... 0040 9a 8f 00 00 00 5c b3 6b 84 09 a1 4d 4f 8f 3d 35 .....\.k...MO.=5 0050 0e bf 66 47 82 81 10 32 1c 4b 32 56 3e 79 95 0e ..fG...2.K2V>y.. 0060 4f 3a 28 b0 b1 d6 95 e9 b6 6d 53 de 68 53 46 f2 O:(......mS.hSF. 0070 67 f3 28 90 d2 7c 76 74 f5 77 00 50 09 75 71 9b g.(..|vt.w.P.uq. 0080 a9 fa 70 4a be b4 ..pJ.. Frame 11 (518 bytes on wire, 518 bytes captured) Arrival Time: Aug 11, 2011 13:51:23.238628000 [Time delta from previous captured frame: 0.008169000 seconds] [Time delta from previous displayed frame: 0.008169000 seconds] [Time since reference or first frame: 0.336423000 seconds] Frame Number: 11 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Destination: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Address: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa18 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0x0ed1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E20F541C1AF8468C Responder cookie: 1BF59E4DCA3626E6 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x17b78e62 Length: 476 Encrypted payload (448 bytes) 0000 c4 3d c7 cc fa 50 00 0c 29 96 68 b2 08 00 45 00 .=...P..).h...E. 0010 01 f8 00 00 40 00 40 11 fa 18 a5 e3 f9 7c a5 e3 ....@.@......|.. 0020 f9 98 01 f4 01 f4 01 e4 0e d1 e2 0f 54 1c 1a f8 ............T... 0030 46 8c 1b f5 9e 4d ca 36 26 e6 08 10 20 01 17 b7 F....M.6&... ... 0040 8e 62 00 00 01 dc b9 94 4e ba f2 80 fd ed 4d fe .b......N.....M. 0050 74 d2 98 ff d5 43 5a 8d 43 0c ae 63 7f 2a 0c ca t....CZ.C..c.*.. 0060 93 38 ea 1d 80 bb 99 20 6c ce e4 11 9d b3 a4 96 .8..... l....... 0070 49 d5 6e 4d d8 b8 db 79 77 e2 e2 ff 03 c8 d1 dd I.nM...yw....... 0080 8d 85 9d be f9 50 cd 78 f6 76 f3 87 a0 f4 67 86 .....P.x.v....g. 0090 f6 3a 2a d2 2e c6 23 34 17 a6 16 83 fe 48 10 17 .:*...#4.....H.. 00a0 0f bf 71 97 31 d3 75 9c e8 2e 3b bc 0b a8 44 c9 ..q.1.u...;...D. 00b0 1e 23 e1 63 03 df 56 8c 68 d9 f9 cd 32 bf d4 09 .#.c..V.h...2... 00c0 28 63 19 3b 22 f9 07 ae 43 5f 84 39 bd eb 0a 79 (c.;"...C_.9...y 00d0 ad 12 96 2c 36 de 70 7a 5c a1 1b 93 ac 3c 2c 76 ...,6.pz\....<,v 00e0 1f e2 ef 93 e3 a1 02 11 53 9c b7 03 86 4d 70 a4 ........S....Mp. 00f0 ad 05 0d 5b ae 09 61 ea a1 22 d4 86 30 b1 a4 08 ...[..a.."..0... 0100 72 00 b0 e3 af e8 b8 0c e3 a8 d2 4b fd 84 7e 04 r..........K..~. 0110 4a b6 70 ac 81 8c 67 cf 83 b6 55 a1 66 88 f9 43 J.p...g...U.f..C 0120 0e 67 ab 06 24 5c 62 62 93 c2 ed 2f e9 c8 c6 57 .g..$\bb.../...W 0130 08 94 f0 8c 17 fc db 28 2a 81 3b f8 8e 0f af 7c .......(*.;....| 0140 18 c9 bc a5 13 ee d2 6f 77 81 0d a9 52 71 ae a0 .......ow...Rq.. 0150 9a e3 6b f0 61 c5 86 93 06 e7 e9 55 1b 0d 8f c2 ..k.a......U.... 0160 2b 7a 4d 96 15 d6 d3 78 ba 46 91 61 26 92 c8 a5 +zM....x.F.a&... 0170 68 45 6d 32 23 8c cd 40 dc 62 89 d2 38 69 1f 2c hEm2#..@.b..8i., 0180 0b af d5 9d a1 11 b4 55 36 78 2e 00 c0 44 70 fc .......U6x...Dp. 0190 e1 69 dd 89 b0 a5 7f 94 de 18 fe c7 b7 fa 55 c3 .i............U. 01a0 9e cc a4 cc 8d 8c 8f 82 23 e0 bb 9c 1d a2 fe 0c ........#....... 01b0 20 bd 06 45 34 95 00 8f e6 b0 ad 99 52 81 9a 7d ..E4.......R..} 01c0 a4 09 dc cd 99 f7 e9 5c a3 dc e4 35 17 ab f9 31 .......\...5...1 01d0 55 48 75 e3 c5 7f 4d ca 46 c8 a5 c4 9b 5c 3c cf UHu...M.F....\<. 01e0 c2 7c ae 46 a5 f7 2f 90 e3 d4 5f b5 04 89 98 af .|.F../..._..... 01f0 fc 84 f2 7e fc 93 18 26 1e d5 1c 40 7a 7d b7 7e ...~...&...@z}.~ 0200 c3 6f af 66 e2 d2 .o.f.. Frame 12 (518 bytes on wire, 518 bytes captured) Arrival Time: Aug 11, 2011 13:51:23.238636000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 0.336431000 seconds] Frame Number: 12 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Destination: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Address: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa18 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0x0ed1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E20F541C1AF8468C Responder cookie: 1BF59E4DCA3626E6 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x17b78e62 Length: 476 Encrypted payload (448 bytes) 0000 c4 3d c7 cc fa 50 00 0c 29 96 68 b2 08 00 45 00 .=...P..).h...E. 0010 01 f8 00 00 40 00 40 11 fa 18 a5 e3 f9 7c a5 e3 ....@.@......|.. 0020 f9 98 01 f4 01 f4 01 e4 0e d1 e2 0f 54 1c 1a f8 ............T... 0030 46 8c 1b f5 9e 4d ca 36 26 e6 08 10 20 01 17 b7 F....M.6&... ... 0040 8e 62 00 00 01 dc b9 94 4e ba f2 80 fd ed 4d fe .b......N.....M. 0050 74 d2 98 ff d5 43 5a 8d 43 0c ae 63 7f 2a 0c ca t....CZ.C..c.*.. 0060 93 38 ea 1d 80 bb 99 20 6c ce e4 11 9d b3 a4 96 .8..... l....... 0070 49 d5 6e 4d d8 b8 db 79 77 e2 e2 ff 03 c8 d1 dd I.nM...yw....... 0080 8d 85 9d be f9 50 cd 78 f6 76 f3 87 a0 f4 67 86 .....P.x.v....g. 0090 f6 3a 2a d2 2e c6 23 34 17 a6 16 83 fe 48 10 17 .:*...#4.....H.. 00a0 0f bf 71 97 31 d3 75 9c e8 2e 3b bc 0b a8 44 c9 ..q.1.u...;...D. 00b0 1e 23 e1 63 03 df 56 8c 68 d9 f9 cd 32 bf d4 09 .#.c..V.h...2... 00c0 28 63 19 3b 22 f9 07 ae 43 5f 84 39 bd eb 0a 79 (c.;"...C_.9...y 00d0 ad 12 96 2c 36 de 70 7a 5c a1 1b 93 ac 3c 2c 76 ...,6.pz\....<,v 00e0 1f e2 ef 93 e3 a1 02 11 53 9c b7 03 86 4d 70 a4 ........S....Mp. 00f0 ad 05 0d 5b ae 09 61 ea a1 22 d4 86 30 b1 a4 08 ...[..a.."..0... 0100 72 00 b0 e3 af e8 b8 0c e3 a8 d2 4b fd 84 7e 04 r..........K..~. 0110 4a b6 70 ac 81 8c 67 cf 83 b6 55 a1 66 88 f9 43 J.p...g...U.f..C 0120 0e 67 ab 06 24 5c 62 62 93 c2 ed 2f e9 c8 c6 57 .g..$\bb.../...W 0130 08 94 f0 8c 17 fc db 28 2a 81 3b f8 8e 0f af 7c .......(*.;....| 0140 18 c9 bc a5 13 ee d2 6f 77 81 0d a9 52 71 ae a0 .......ow...Rq.. 0150 9a e3 6b f0 61 c5 86 93 06 e7 e9 55 1b 0d 8f c2 ..k.a......U.... 0160 2b 7a 4d 96 15 d6 d3 78 ba 46 91 61 26 92 c8 a5 +zM....x.F.a&... 0170 68 45 6d 32 23 8c cd 40 dc 62 89 d2 38 69 1f 2c hEm2#..@.b..8i., 0180 0b af d5 9d a1 11 b4 55 36 78 2e 00 c0 44 70 fc .......U6x...Dp. 0190 e1 69 dd 89 b0 a5 7f 94 de 18 fe c7 b7 fa 55 c3 .i............U. 01a0 9e cc a4 cc 8d 8c 8f 82 23 e0 bb 9c 1d a2 fe 0c ........#....... 01b0 20 bd 06 45 34 95 00 8f e6 b0 ad 99 52 81 9a 7d ..E4.......R..} 01c0 a4 09 dc cd 99 f7 e9 5c a3 dc e4 35 17 ab f9 31 .......\...5...1 01d0 55 48 75 e3 c5 7f 4d ca 46 c8 a5 c4 9b 5c 3c cf UHu...M.F....\<. 01e0 c2 7c ae 46 a5 f7 2f 90 e3 d4 5f b5 04 89 98 af .|.F../..._..... 01f0 fc 84 f2 7e fc 93 18 26 1e d5 1c 40 7a 7d b7 7e ...~...&...@z}.~ 0200 c3 6f af 66 e2 d2 .o.f.. Frame 13 (342 bytes on wire, 342 bytes captured) Arrival Time: Aug 11, 2011 13:51:23.474916000 [Time delta from previous captured frame: 0.236280000 seconds] [Time delta from previous displayed frame: 0.236280000 seconds] [Time since reference or first frame: 0.572711000 seconds] Frame Number: 13 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Address: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.152 (165.227.249.152), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfac8 [correct] [Good: True] [Bad : False] Source: 165.227.249.152 (165.227.249.152) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xc8c4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E20F541C1AF8468C Responder cookie: 1BF59E4DCA3626E6 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x17b78e62 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 96 68 b2 c4 3d c7 cc fa 50 08 00 45 00 ..).h..=...P..E. 0010 01 48 00 00 40 00 40 11 fa c8 a5 e3 f9 98 a5 e3 .H..@.@......... 0020 f9 7c 01 f4 01 f4 01 34 c8 c4 e2 0f 54 1c 1a f8 .|.....4....T... 0030 46 8c 1b f5 9e 4d ca 36 26 e6 08 10 20 01 17 b7 F....M.6&... ... 0040 8e 62 00 00 01 2c 82 c0 a4 8e 20 86 02 a9 6e c2 .b...,.... ...n. 0050 46 17 40 0a ed 2c 4b 0a 37 a9 ef 67 64 6c 6a 69 F.@..,K.7..gdlji 0060 99 2e 0c 68 3f e6 af 16 57 4c b0 ee 65 10 05 6a ...h?...WL..e..j 0070 3e ef 12 f3 fd b2 cd 9c 29 3e b3 c2 62 a2 32 37 >.......)>..b.27 0080 70 77 e8 eb d7 f5 7f 41 00 92 03 db bc 8a b7 76 pw.....A.......v 0090 9f 45 0c 33 ea fa 5f dc 83 fb 15 6e 10 b7 cf 85 .E.3.._....n.... 00a0 09 2b 70 a0 ae b7 92 b5 5f 16 2d b0 69 f2 05 a6 .+p....._.-.i... 00b0 aa 22 50 91 94 32 01 07 77 2b 79 fd 8a eb ad 45 ."P..2..w+y....E 00c0 e8 6b 9d e7 3f 96 93 45 40 d5 2a 59 3b eb 2b 3d .k..?..E@.*Y;.+= 00d0 c3 38 fd 05 5e dc 04 36 a4 bf e8 b1 22 b1 59 81 .8..^..6....".Y. 00e0 ee 05 93 bb f4 51 c3 59 09 93 73 6e 6d 10 06 91 .....Q.Y..snm... 00f0 20 1c 2b 77 85 3d 5d 7e 6c 6b 23 09 cc cd b4 40 .+w.=]~lk#....@ 0100 9a e0 7b f4 5a 66 a5 46 60 ac 33 5b 2c 5b 46 33 ..{.Zf.F`.3[,[F3 0110 7b ce 22 e9 7f 6a 17 c8 39 4c 50 d2 f6 1a fd 86 {."..j..9LP..... 0120 69 7b 62 73 4f 13 f3 da c3 b3 83 22 f7 a0 69 84 i{bsO......"..i. 0130 04 18 34 c3 83 88 0a 48 5c 03 29 39 9d a4 7d c6 ..4....H\.)9..}. 0140 db 7c ca 64 d7 2f 71 b3 4c d6 4f 17 99 5c 83 5f .|.d./q.L.O..\._ 0150 48 1a 96 af 9b 5b H....[ Frame 14 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 11, 2011 13:51:23.479542000 [Time delta from previous captured frame: 0.004626000 seconds] [Time delta from previous displayed frame: 0.004626000 seconds] [Time since reference or first frame: 0.577337000 seconds] Frame Number: 14 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Destination: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) Address: c4:3d:c7:cc:fa:50 (c4:3d:c7:cc:fa:50) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb8 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xeabd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: E20F541C1AF8468C Responder cookie: 1BF59E4DCA3626E6 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x17b78e62 Length: 60 Encrypted payload (32 bytes) 0000 c4 3d c7 cc fa 50 00 0c 29 96 68 b2 08 00 45 00 .=...P..).h...E. 0010 00 58 00 00 40 00 40 11 fb b8 a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 98 01 f4 01 f4 00 44 ea bd e2 0f 54 1c 1a f8 .......D....T... 0030 46 8c 1b f5 9e 4d ca 36 26 e6 08 10 20 01 17 b7 F....M.6&... ... 0040 8e 62 00 00 00 3c 44 02 e5 3b f2 ad 1a 75 e4 5b .b...