Frame 1 (266 bytes on wire, 266 bytes captured) Arrival Time: Dec 10, 2007 13:44:15.387199000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 266 bytes Capture Length: 266 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Destination: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.153 (165.227.249.153) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0150 (336) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x39c4 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.153 (165.227.249.153) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 232 Checksum: 0x1e1d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC9F81C72C79AFD21 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 224 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 44 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x8F9CC94E01248ECDF147594C284B213B Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-01 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 0000 00 1b 11 4d 7e f0 00 0c 29 f4 af 90 08 00 45 00 ...M~...).....E. 0010 00 fc 01 50 00 00 40 11 39 c4 a5 e3 f9 7c a5 e3 ...P..@.9....|.. 0020 f9 99 01 f4 01 f4 00 e8 1e 1d c9 f8 1c 72 c7 9a .............r.. 0030 fd 21 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .!.............. 0040 00 00 00 00 00 e0 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 00 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 8f 9c c9 4e 01 24 8e cd f1 47 59 4c 28 4b .....N.$...GYL(K 0090 21 3b 0d 00 00 14 27 ba b5 dc 01 ea 07 60 ea 4e !;....'......`.N 00a0 31 90 ac 27 c0 d0 0d 00 00 14 61 05 c4 22 e7 68 1..'......a..".h 00b0 47 e4 3f 96 84 80 12 92 ae cd 0d 00 00 14 44 85 G.?...........D. 00c0 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 0d 00 .-.......F.y.... 00d0 00 14 cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 ...`FC5.!.|...h. 00e0 a4 48 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .H........>.in.c 00f0 81 b5 ec 42 7b 1f 00 00 00 14 7d 94 19 a6 53 10 ...B{.....}...S. 0100 ca 6f 2c 17 9d 92 15 52 9d 56 .o,....R.V Frame 2 (146 bytes on wire, 146 bytes captured) Arrival Time: Dec 10, 2007 13:44:15.392606000 Time delta from previous packet: 0.005407000 seconds Time since reference or first frame: 0.005407000 seconds Frame Number: 2 Packet Length: 146 bytes Capture Length: 146 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.153 (165.227.249.153), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb8b [correct] Good: True Bad : False Source: 165.227.249.153 (165.227.249.153) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0xeef0 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC9F81C72C79AFD21 Responder cookie: 0x4726F5E40DF878AF Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 44 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 f4 af 90 00 1b 11 4d 7e f0 08 00 45 00 ..)......M~...E. 0010 00 84 00 00 40 00 40 11 fb 8b a5 e3 f9 99 a5 e3 ....@.@......... 0020 f9 7c 01 f4 01 f4 00 70 ee f0 c9 f8 1c 72 c7 9a .|.....p.....r.. 0030 fd 21 47 26 f5 e4 0d f8 78 af 01 10 02 00 00 00 .!G&....x....... 0040 00 00 00 00 00 68 0d 00 00 38 00 00 00 01 00 00 .....h...8...... 0050 00 01 00 00 00 2c 00 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 00 00 ............p... 0080 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 0090 01 00 .. Frame 3 (222 bytes on wire, 222 bytes captured) Arrival Time: Dec 10, 2007 13:44:15.398065000 Time delta from previous packet: 0.005459000 seconds Time since reference or first frame: 0.010866000 seconds Frame Number: 3 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Destination: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.153 (165.227.249.153) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0151 (337) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x39ef [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.153 (165.227.249.153) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x632b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC9F81C72C79AFD21 Responder cookie: 0x4726F5E40DF878AF Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 1b 11 4d 7e f0 00 0c 29 f4 af 90 08 00 45 00 ...M~...).....E. 0010 00 d0 01 51 00 00 40 11 39 ef a5 e3 f9 7c a5 e3 ...Q..@.9....|.. 0020 f9 99 01 f4 01 f4 00 bc 63 2b c9 f8 1c 72 c7 9a ........c+...r.. 0030 fd 21 47 26 f5 e4 0d f8 78 af 04 10 02 00 00 00 .!G&....x....... 0040 00 00 00 00 00 b4 0a 00 00 84 bd 7e 7a a3 03 ce ...........~z... 0050 4d 98 a5 d7 99 74 3e 0f 1b 66 1b 9b 37 28 86 da M....t>..f..7(.. 0060 6f aa 09 7f a9 22 57 eb 64 ba ee 3b 64 60 34 39 o...."W.d..;d`49 0070 0a a5 ab 43 d3 6f b5 34 75 2a b3 0f a2 fd df d3 ...C.o.4u*...... 0080 9f 7d 68 94 b7 7a bd 09 21 18 a6 67 47 cc df d3 .}h..z..!..gG... 0090 65 5a e5 95 56 3a 44 4f ae fd be 2f 8a a9 b8 7d eZ..V:DO.../...} 00a0 9d d0 9d e3 20 b8 ee 02 1d 28 35 f8 9f 08 a2 34 .... ....(5....4 00b0 71 da 5e 1b 0b 49 55 3f f0 4f 31 84 fb 81 36 c5 q.^..IU?.O1...6. 00c0 d4 65 a4 d7 c8 c3 05 fd 98 d7 00 00 00 14 65 b8 .e............e. 00d0 43 3c 7c 15 d7 d8 62 9e ee 46 93 c0 65 bc C<|...b..F..e. Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Dec 10, 2007 13:44:15.541819000 Time delta from previous packet: 0.143754000 seconds Time since reference or first frame: 0.154620000 seconds Frame Number: 4 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.153 (165.227.249.153), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb3f [correct] Good: True Bad : False Source: 165.227.249.153 (165.227.249.153) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x4c2d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC9F81C72C79AFD21 Responder cookie: 0x4726F5E40DF878AF Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 f4 af 90 00 1b 11 4d 7e f0 08 00 45 00 ..)......M~...E. 0010 00 d0 00 00 40 00 40 11 fb 3f a5 e3 f9 99 a5 e3 ....@.@..?...... 0020 f9 7c 01 f4 01 f4 00 bc 4c 2d c9 f8 1c 72 c7 9a .|......L-...r.. 0030 fd 21 47 26 f5 e4 0d f8 78 af 04 10 02 00 00 00 .!G&....x....... 0040 00 00 00 00 00 b4 0a 00 00 84 b7 21 af ec 9f 1d ...........!.... 0050 45 07 b7 16 70 1f 51 27 2f e9 df f4 fc 51 72 84 E...p.Q'/....Qr. 0060 0e 71 20 93 50 30 64 5f 80 87 f5 cc 4b 4d 0e eb .q .P0d_....KM.. 0070 18 e4 80 6d 62 74 0d 9d 4d dc a5 3f ce 45 7f ea ...mbt..M..?.E.. 0080 91 fe b2 5e c5 02 28 37 f0 22 5c 34 a8 48 4e 18 ...^..(7."\4.HN. 0090 40 a8 e7 0f d1 86 d1 d8 bc 75 c6 0d 0f f3 38 3b @........u....8; 00a0 4b d4 51 89 6c c6 ed f0 10 04 8c 06 65 90 af b5 K.Q.l.......e... 00b0 ed 17 bd e6 f4 01 14 95 22 ca 89 17 92 fa f8 85 ........"....... 00c0 55 c2 4a 71 25 08 c7 7d 5e 22 00 00 00 14 e9 45 U.Jq%..}^".....E 00d0 33 d2 af 36 2f 88 15 8a ec 33 05 ba 21 96 3..6/....3..!. Frame 5 (118 bytes on wire, 118 bytes captured) Arrival Time: Dec 10, 2007 13:44:15.541821000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.154622000 seconds Frame Number: 5 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Destination: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.153 (165.227.249.153) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0152 (338) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a56 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.153 (165.227.249.153) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x62fe [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC9F81C72C79AFD21 Responder cookie: 0x4726F5E40DF878AF Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 1b 11 4d 7e f0 00 0c 29 f4 af 90 08 00 45 00 ...M~...).....E. 0010 00 68 01 52 00 00 40 11 3a 56 a5 e3 f9 7c a5 e3 .h.R..@.:V...|.. 0020 f9 99 01 f4 01 f4 00 54 62 fe c9 f8 1c 72 c7 9a .......Tb....r.. 0030 fd 21 47 26 f5 e4 0d f8 78 af 05 10 02 01 00 00 .!G&....x....... 0040 00 00 00 00 00 4c 50 46 84 ce ec 54 18 7e 59 e7 .....LPF...T.~Y. 0050 bb 17 b3 c2 67 8d 08 f1 52 c1 b6 09 32 f6 10 75 ....g...R...2..u 0060 2b 07 1a d9 cb 30 4a 3c 57 7a c3 09 f0 1d ce 51 +....0J=.......n.Y.%. 00f0 e2 ad 6b ff 32 f0 07 fd 07 25 de 83 93 62 8e 58 ..k.2....%...b.X 0100 82 80 9f 77 98 6e 60 0e 2f 69 8e 18 29 94 29 93 ...w.n`./i..).). 0110 c2 a3 06 99 c9 29 3d 99 58 fe 04 ce 75 5a 5b 0e .....)=.X...uZ[. 0120 99 55 2a 89 ee f5 ca 12 75 b9 ec c0 21 5a 12 d4 .U*.....u...!Z.. 0130 7f 4c a8 07 ae 88 20 26 e4 27 85 0d 99 f3 c5 95 .L.... &.'...... 0140 70 b3 1d e6 86 41 ad 0f 0f d2 82 77 4d c2 c9 ec p....A.....wM... 0150 62 10 e7 03 f5 39 b....9 Frame 8 (342 bytes on wire, 342 bytes captured) Arrival Time: Dec 10, 2007 13:44:15.691060000 Time delta from previous packet: 0.140312000 seconds Time since reference or first frame: 0.303861000 seconds Frame Number: 8 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.153 (165.227.249.153), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfac7 [correct] Good: True Bad : False Source: 165.227.249.153 (165.227.249.153) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x973c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC9F81C72C79AFD21 Responder cookie: 0x4726F5E40DF878AF Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x08FFD526 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 f4 af 90 00 1b 11 4d 7e f0 08 00 45 00 ..)......M~...E. 0010 01 48 00 00 40 00 40 11 fa c7 a5 e3 f9 99 a5 e3 .H..@.@......... 0020 f9 7c 01 f4 01 f4 01 34 97 3c c9 f8 1c 72 c7 9a .|.....4.<...r.. 0030 fd 21 47 26 f5 e4 0d f8 78 af 08 10 20 01 08 ff .!G&....x... ... 0040 d5 26 00 00 01 2c 9c ef 9a b8 f3 09 dd a5 de 3e .&...,.........> 0050 de 4e 24 33 3e 99 b5 30 cf 96 e0 f6 56 cc 6e 77 .N$3>..0....V.nw 0060 51 ae b2 b9 dd 7d 34 85 da 53 1c 9e a0 18 ec b0 Q....}4..S...... 0070 9b 9f ce 02 49 a5 4b b5 7e c5 40 db 28 85 46 e1 ....I.K.~.@.(.F. 0080 af b9 28 ce 91 f4 bd b8 9a a5 af d3 49 b9 df cc ..(.........I... 0090 e9 f3 98 71 3f e6 a4 9a 11 1c a7 b4 cd 89 33 34 ...q?.........34 00a0 59 11 56 26 17 c8 b7 25 44 d1 b2 c5 ce c3 22 4b Y.V&...%D....."K 00b0 35 9a c7 5e 0a 97 59 b5 e9 cb 55 78 06 37 31 1d 5..^..Y...Ux.71. 00c0 2a 09 7a df ec db 19 cd 73 3d 72 5b 18 d2 7f f8 *.z.....s=r[.... 00d0 c4 f0 8b e1 f3 40 aa 29 d9 8d 9e b7 49 5a 73 9d .....@.)....IZs. 00e0 33 dc 15 5d d8 24 d3 7a 0c 13 9d a5 78 94 54 f3 3..].$.z....x.T. 00f0 d4 b5 d7 db b2 cd 67 8f 69 46 3c 98 1c 4f 33 6b ......g.iF<..O3k 0100 20 59 b3 d9 a6 89 b0 cd 0f b8 52 34 60 54 f2 86 Y........R4`T.. 0110 9a 78 e2 21 af e3 80 29 de a2 17 b6 54 36 d7 2a .x.!...)....T6.* 0120 6a ea ca d4 31 f9 43 7f 16 4d 67 77 51 e2 53 f4 j...1.C..MgwQ.S. 0130 70 1b 0a 78 f5 22 bb 6d 66 d3 24 a0 ba 19 ad 5e p..x.".mf.$....^ 0140 a3 ae e9 de 44 f4 f1 9b 6b df 6b 60 2d 2d 58 14 ....D...k.k`--X. 0150 e7 e4 28 a1 54 48 ..(.TH Frame 9 (102 bytes on wire, 102 bytes captured) Arrival Time: Dec 10, 2007 13:44:15.693031000 Time delta from previous packet: 0.001971000 seconds Time since reference or first frame: 0.305832000 seconds Frame Number: 9 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Destination: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.153 (165.227.249.153) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0154 (340) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a64 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.153 (165.227.249.153) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x27c7 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC9F81C72C79AFD21 Responder cookie: 0x4726F5E40DF878AF Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x08FFD526 Length: 60 Encrypted payload (32 bytes) 0000 00 1b 11 4d 7e f0 00 0c 29 f4 af 90 08 00 45 00 ...M~...).....E. 0010 00 58 01 54 00 00 40 11 3a 64 a5 e3 f9 7c a5 e3 .X.T..@.:d...|.. 0020 f9 99 01 f4 01 f4 00 44 27 c7 c9 f8 1c 72 c7 9a .......D'....r.. 0030 fd 21 47 26 f5 e4 0d f8 78 af 08 10 20 01 08 ff .!G&....x... ... 0040 d5 26 00 00 00 3c aa c2 55 3b ae aa a0 c0 34 97 .&...<..U;....4. 0050 fe 01 d9 9d fb 0a 22 70 6f 4d 37 b8 d5 06 39 4d ......"poM7...9M 0060 28 14 4d c7 7b 3b (.M.{; Frame 10 (134 bytes on wire, 134 bytes captured) Arrival Time: Dec 10, 2007 13:44:15.939040000 Time delta from previous packet: 0.246009000 seconds Time since reference or first frame: 0.551841000 seconds Frame Number: 10 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Destination: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.153 (165.227.249.153) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x004e (78) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b28 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.153 (165.227.249.153) Encapsulating Security Payload SPI: 0x2823b2fd Sequence: 2 Data (92 bytes) 0000 00 1b 11 4d 7e f0 00 0c 29 f4 af 90 08 00 45 00 ...M~...).....E. 0010 00 78 00 4e 00 00 f0 32 8b 28 a5 e3 f9 7c a5 e3 .x.N...2.(...|.. 0020 f9 99 28 23 b2 fd 00 00 00 02 de a2 4b e2 36 86 ..(#........K.6. 0030 bf 98 af 4e ca f6 c5 6c 5b 9e c1 77 f4 ac 4f 46 ...N...l[..w..OF 0040 ba 8f bd b2 41 c8 eb df 54 29 20 3b 30 29 b8 6e ....A...T) ;0).n 0050 35 ba e7 c3 08 f6 76 33 de 3b 52 37 57 e5 c9 69 5.....v3.;R7W..i 0060 79 b5 82 b7 52 8f 66 0f 53 d9 51 81 9d b3 66 10 y...R.f.S.Q...f. 0070 95 bb fa 6f 02 7a 3f df 73 2b cb 77 b4 ac 82 9f ...o.z?.s+.w.... 0080 6d e9 52 fb df 58 m.R..X Frame 11 (134 bytes on wire, 134 bytes captured) Arrival Time: Dec 10, 2007 13:44:15.940525000 Time delta from previous packet: 0.001485000 seconds Time since reference or first frame: 0.553326000 seconds Frame Number: 11 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.153 (165.227.249.153), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x012c (300) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x3a4b [correct] Good: True Bad : False Source: 165.227.249.153 (165.227.249.153) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0xadd98390 Sequence: 1 Data (92 bytes) 0000 00 0c 29 f4 af 90 00 1b 11 4d 7e f0 08 00 45 00 ..)......M~...E. 0010 00 78 01 2c 00 00 40 32 3a 4b a5 e3 f9 99 a5 e3 .x.,..@2:K...... 0020 f9 7c ad d9 83 90 00 00 00 01 63 c2 58 a2 42 c8 .|........c.X.B. 0030 7a 1f d1 87 0e dc 56 51 0b 70 8b aa 04 19 d6 67 z.....VQ.p.....g 0040 23 b7 bf c4 d8 81 da f7 c8 24 81 ed ad c5 94 c5 #........$...... 0050 20 59 a5 37 0c 5e f3 95 c8 d6 7e 09 9c 9e ea 61 Y.7.^....~....a 0060 34 7b 4c ee 85 f6 a3 e7 d1 9d 13 57 53 7b 7e d8 4{L........WS{~. 0070 aa 90 b1 e7 dd 49 ed 42 0d 72 26 11 71 e7 4e 8b .....I.B.r&.q.N. 0080 4f d6 28 f2 06 e3 O.(... Frame 12 (134 bytes on wire, 134 bytes captured) Arrival Time: Dec 10, 2007 13:44:16.453238000 Time delta from previous packet: 0.512713000 seconds Time since reference or first frame: 1.066039000 seconds Frame Number: 12 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Destination: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.153 (165.227.249.153) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x004f (79) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b27 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.153 (165.227.249.153) Encapsulating Security Payload SPI: 0x2823b2fd Sequence: 3 Data (92 bytes) 0000 00 1b 11 4d 7e f0 00 0c 29 f4 af 90 08 00 45 00 ...M~...).....E. 0010 00 78 00 4f 00 00 f0 32 8b 27 a5 e3 f9 7c a5 e3 .x.O...2.'...|.. 0020 f9 99 28 23 b2 fd 00 00 00 03 7b 73 39 97 45 c8 ..(#......{s9.E. 0030 b1 06 e5 e3 f9 f1 e9 9e 66 d1 eb ca 93 48 19 6b ........f....H.k 0040 fa 8d 50 90 d5 72 1d 0f d7 72 d5 f4 40 ff ea 6c ..P..r...r..@..l 0050 95 ab 9f 65 7e a9 74 4c 79 bc 0d e2 e0 4d 72 56 ...e~.tLy....MrV 0060 7a d9 5f e6 3d 22 0e cc da 34 8c 67 4d 72 e0 fa z._.="...4.gMr.. 0070 cc ef ee 3c ab 76 d0 8c 6d 35 14 49 88 3d bd e6 ...<.v..m5.I.=.. 0080 22 16 1c 4d d7 c9 "..M.. Frame 13 (134 bytes on wire, 134 bytes captured) Arrival Time: Dec 10, 2007 13:44:16.454699000 Time delta from previous packet: 0.001461000 seconds Time since reference or first frame: 1.067500000 seconds Frame Number: 13 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.153 (165.227.249.153), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x012d (301) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x3a4a [correct] Good: True Bad : False Source: 165.227.249.153 (165.227.249.153) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0xadd98390 Sequence: 2 Data (92 bytes) 0000 00 0c 29 f4 af 90 00 1b 11 4d 7e f0 08 00 45 00 ..)......M~...E. 0010 00 78 01 2d 00 00 40 32 3a 4a a5 e3 f9 99 a5 e3 .x.-..@2:J...... 0020 f9 7c ad d9 83 90 00 00 00 02 75 76 77 61 62 63 .|........uvwabc 0030 64 65 66 67 68 69 01 02 02 04 18 a6 08 ca 85 88 defghi.......... 0040 33 57 0f 94 07 65 08 34 b0 c4 0a 2a 96 58 dc 13 3W...e.4...*.X.. 0050 62 b9 85 1d 89 f9 79 1c 71 2c a7 c0 2f 5d 7e 1f b.....y.q,../]~. 0060 4c 4d 92 b6 32 da 05 31 ad 8c e0 30 47 a3 6d a8 LM..2..1...0G.m. 0070 b4 2f cd 64 0a 59 6a 0d ed b8 24 66 8c a6 65 a9 ./.d.Yj...$f..e. 0080 b6 0d 47 3d 04 a7 ..G=.. Frame 14 (134 bytes on wire, 134 bytes captured) Arrival Time: Dec 10, 2007 13:44:17.474290000 Time delta from previous packet: 1.019591000 seconds Time since reference or first frame: 2.087091000 seconds Frame Number: 14 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Destination: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.153 (165.227.249.153) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0050 (80) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b26 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.153 (165.227.249.153) Encapsulating Security Payload SPI: 0x2823b2fd Sequence: 4 Data (92 bytes) 0000 00 1b 11 4d 7e f0 00 0c 29 f4 af 90 08 00 45 00 ...M~...).....E. 0010 00 78 00 50 00 00 f0 32 8b 26 a5 e3 f9 7c a5 e3 .x.P...2.&...|.. 0020 f9 99 28 23 b2 fd 00 00 00 04 c3 fd a2 d9 ff 12 ..(#............ 0030 f4 d9 13 10 22 e3 1c 6b 3e db a7 13 77 18 f6 8c ...."..k>...w... 0040 61 4b f0 bc ca 59 da fa a9 01 3d 11 83 15 17 9e aK...Y....=..... 0050 ed 26 b9 45 86 23 29 eb 68 44 d0 8e fe eb b1 ea .&.E.#).hD...... 0060 7c d3 67 78 b6 db 1c d8 57 6a d8 70 a1 c9 16 06 |.gx....Wj.p.... 0070 8e b2 2e f6 8f a8 ed 1e 6b 2d 2f 03 9a 06 9f b5 ........k-/..... 0080 d0 9c 16 8b a6 ca ...... Frame 15 (134 bytes on wire, 134 bytes captured) Arrival Time: Dec 10, 2007 13:44:17.475534000 Time delta from previous packet: 0.001244000 seconds Time since reference or first frame: 2.088335000 seconds Frame Number: 15 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.153 (165.227.249.153), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x012e (302) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x3a49 [correct] Good: True Bad : False Source: 165.227.249.153 (165.227.249.153) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0xadd98390 Sequence: 3 Data (92 bytes) 0000 00 0c 29 f4 af 90 00 1b 11 4d 7e f0 08 00 45 00 ..)......M~...E. 0010 00 78 01 2e 00 00 40 32 3a 49 a5 e3 f9 99 a5 e3 .x....@2:I...... 0020 f9 7c ad d9 83 90 00 00 00 03 75 76 77 61 62 63 .|........uvwabc 0030 64 65 66 67 68 69 01 02 02 04 11 e0 33 02 60 ab defghi......3.`. 0040 de 74 45 77 59 67 88 72 22 f8 9f 94 e6 18 eb fb .tEwYg.r"....... 0050 fd 67 de 73 df 8a 5d 4d 57 68 db 38 e4 42 21 f3 .g.s..]MWh.8.B!. 0060 1a bf db 26 b0 22 16 11 0b 06 3c 8e 77 3b 79 c8 ...&."....<.w;y. 0070 a1 ab 63 cb 5f c4 7b e2 ec df f6 0e 46 07 a8 f2 ..c._.{.....F... 0080 f4 00 44 db c5 34 ..D..4 Frame 16 (134 bytes on wire, 134 bytes captured) Arrival Time: Dec 10, 2007 13:44:18.477373000 Time delta from previous packet: 1.001839000 seconds Time since reference or first frame: 3.090174000 seconds Frame Number: 16 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Destination: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.153 (165.227.249.153) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0051 (81) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b25 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.153 (165.227.249.153) Encapsulating Security Payload SPI: 0x2823b2fd Sequence: 5 Data (92 bytes) 0000 00 1b 11 4d 7e f0 00 0c 29 f4 af 90 08 00 45 00 ...M~...).....E. 0010 00 78 00 51 00 00 f0 32 8b 25 a5 e3 f9 7c a5 e3 .x.Q...2.%...|.. 0020 f9 99 28 23 b2 fd 00 00 00 05 7c 43 32 b7 29 e4 ..(#......|C2.). 0030 06 3b 68 3b c2 91 47 12 ad 74 9f cb d9 ee 8d 5e .;h;..G..t.....^ 0040 c8 4a d2 63 ba c3 2f a0 d6 f5 80 7e b1 da f9 27 .J.c../....~...' 0050 64 34 71 73 5e cb 2b f9 50 4c 26 18 2d 0d b0 fd d4qs^.+.PL&.-... 0060 4b ea 4a 7d 75 3a 59 fe 22 3f 6b bd a1 38 81 a3 K.J}u:Y."?k..8.. 0070 82 ef 3b 1c 18 2e 87 38 55 0a 63 22 f1 5b 3a 84 ..;....8U.c".[:. 0080 2f 87 c3 e1 3b 8b /...;. Frame 17 (134 bytes on wire, 134 bytes captured) Arrival Time: Dec 10, 2007 13:44:18.478796000 Time delta from previous packet: 0.001423000 seconds Time since reference or first frame: 3.091597000 seconds Frame Number: 17 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:1b:11:4d:7e:f0 (00:1b:11:4d:7e:f0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.153 (165.227.249.153), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x012f (303) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x3a48 [correct] Good: True Bad : False Source: 165.227.249.153 (165.227.249.153) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0xadd98390 Sequence: 4 Data (92 bytes) 0000 00 0c 29 f4 af 90 00 1b 11 4d 7e f0 08 00 45 00 ..)......M~...E. 0010 00 78 01 2f 00 00 40 32 3a 48 a5 e3 f9 99 a5 e3 .x./..@2:H...... 0020 f9 7c ad d9 83 90 00 00 00 04 75 76 77 61 62 63 .|........uvwabc 0030 64 65 66 67 68 69 01 02 02 04 21 29 77 b1 c9 0e defghi....!)w... 0040 69 3e 6d 71 39 7b 13 3c fd 39 a3 8a 3d e9 ad 31 i>mq9{.<.9..=..1 0050 63 51 52 60 ad 65 e0 31 98 b4 30 fd b3 90 f7 b1 cQR`.e.1..0..... 0060 37 b9 8c b3 a3 5f c8 df e9 72 5f 3d 88 35 d0 6b 7...._...r_=.5.k 0070 41 58 d0 12 6b eb d4 da 99 e8 e8 c3 0e 5f f7 d1 AX..k........_.. 0080 d1 a9 d5 1a d5 95 ......