Frame 1 (326 bytes on wire, 326 bytes captured) Arrival Time: Feb 7, 2011 14:51:55.025382000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfad4 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x2cfd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 27D00CE150D06D35 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0x27D00CE150D06D35 Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 23 f8 10 29 12 00 0c 29 96 68 b2 08 00 45 00 .#..)...).h...E. 0010 01 38 00 00 40 00 40 11 fa d4 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 9c 01 f4 01 f4 01 24 2c fd 27 d0 0c e1 50 d0 .......$,.'...P. 0030 6d 35 00 00 00 00 00 00 00 00 01 10 02 00 00 00 m5.............. 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 27 d0 0c e1 50 d0 .....|....'...P. 0060 6d 35 03 00 00 24 00 01 00 00 80 01 00 07 80 0e m5...$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 2 (326 bytes on wire, 326 bytes captured) Arrival Time: Feb 7, 2011 14:51:55.025408000 [Time delta from previous captured frame: 0.000026000 seconds] [Time delta from previous displayed frame: 0.000026000 seconds] [Time since reference or first frame: 0.000026000 seconds] Frame Number: 2 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfad4 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x2cfd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 27D00CE150D06D35 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0x27D00CE150D06D35 Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 23 f8 10 29 12 00 0c 29 96 68 b2 08 00 45 00 .#..)...).h...E. 0010 01 38 00 00 40 00 40 11 fa d4 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 9c 01 f4 01 f4 01 24 2c fd 27 d0 0c e1 50 d0 .......$,.'...P. 0030 6d 35 00 00 00 00 00 00 00 00 01 10 02 00 00 00 m5.............. 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 27 d0 0c e1 50 d0 .....|....'...P. 0060 6d 35 03 00 00 24 00 01 00 00 80 01 00 07 80 0e m5...$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 3 (162 bytes on wire, 162 bytes captured) Arrival Time: Feb 7, 2011 14:51:55.031532000 [Time delta from previous captured frame: 0.006124000 seconds] [Time delta from previous displayed frame: 0.006124000 seconds] [Time since reference or first frame: 0.006150000 seconds] Frame Number: 3 Frame Length: 162 bytes Capture Length: 162 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:23:f8:10:29:12 (00:23:f8:10:29:12), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.156 (165.227.249.156), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 148 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb78 [correct] [Good: True] [Bad : False] Source: 165.227.249.156 (165.227.249.156) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 128 Checksum: 0x79a2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 27D00CE150D06D35 Responder cookie: 48BD0FA4A1D9789A Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 120 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 44 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 0 Next payload: NONE (0) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: 4F457E717F6B5A4E727D576B Next payload: Vendor ID (13) Payload length: 16 Vendor ID: 4F457E717F6B5A4E727D576B Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 96 68 b2 00 23 f8 10 29 12 08 00 45 00 ..).h..#..)...E. 0010 00 94 00 00 40 00 40 11 fb 78 a5 e3 f9 9c a5 e3 ....@.@..x...... 0020 f9 7c 01 f4 01 f4 00 80 79 a2 27 d0 0c e1 50 d0 .|......y.'...P. 0030 6d 35 48 bd 0f a4 a1 d9 78 9a 01 10 02 00 00 00 m5H.....x....... 0040 00 00 00 00 00 78 0d 00 00 38 00 00 00 01 00 00 .....x...8...... 0050 00 01 00 00 00 2c 00 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 10 4f 45 7e 71 7f 6b 5a 4e 72 7d 57 6b 00 00 ..OE~q.kZNr}Wk.. 0090 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00a0 01 00 .. Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Feb 7, 2011 14:51:55.036583000 [Time delta from previous captured frame: 0.005051000 seconds] [Time delta from previous displayed frame: 0.005051000 seconds] [Time since reference or first frame: 0.011201000 seconds] Frame Number: 4 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb3c [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x6fd6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 27D00CE150D06D35 Responder cookie: 48BD0FA4A1D9789A Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 23 f8 10 29 12 00 0c 29 96 68 b2 08 00 45 00 .#..)...).h...E. 0010 00 d0 00 00 40 00 40 11 fb 3c a5 e3 f9 7c a5 e3 ....@.@..<...|.. 0020 f9 9c 01 f4 01 f4 00 bc 6f d6 27 d0 0c e1 50 d0 ........o.'...P. 0030 6d 35 48 bd 0f a4 a1 d9 78 9a 04 10 02 00 00 00 m5H.....x....... 0040 00 00 00 00 00 b4 0a 00 00 84 69 0f f3 4c f3 9d ..........i..L.. 0050 d4 4f c7 a8 09 ec 82 45 38 f2 fa 50 60 c7 97 d2 .O.....E8..P`... 0060 f6 e6 eb aa af 9b a8 1a 61 30 6a df af 14 ed 67 ........a0j....g 0070 e9 1b 4d 8c 48 63 1f d0 fe 6a 55 4a 08 64 67 07 ..M.Hc...jUJ.dg. 0080 aa 41 f6 04 5c 5a 6e f1 d4 c9 dd 6f fe 8d 89 33 .A..\Zn....o...3 0090 a5 a9 8d a0 b8 19 32 91 99 67 b8 35 f8 f5 da 6e ......2..g.5...n 00a0 0e 5c 48 84 4e b1 01 63 e0 13 e2 55 d3 cb f6 8d .\H.N..c...U.... 00b0 f8 2b c4 d6 79 af 4c bd c9 06 f8 8c e9 24 10 79 .+..y.L......$.y 00c0 44 4a b3 cd 29 dc 6f be ed 99 00 00 00 14 5a dd DJ..).o.......Z. 00d0 33 aa 3c 21 63 05 fa 86 14 ff 20 61 f4 5b 3.(..0......../. 00a0 c3 b8 8a 0a 19 1b 99 8c c0 f0 99 c8 77 56 99 b7 ............wV.. 00b0 5d 17 90 92 fd 92 40 04 1d f2 b1 cc 18 80 b5 e2 ].....@......... 00c0 96 37 5c 2f 85 92 81 28 d9 0e 00 00 00 14 e3 9d .7\/...(........ 00d0 ca 7a 0f 10 c5 23 66 c0 82 42 df f6 2f e8 .z...#f..B../. Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 7, 2011 14:51:55.105092000 [Time delta from previous captured frame: 0.005053000 seconds] [Time delta from previous displayed frame: 0.005053000 seconds] [Time since reference or first frame: 0.079710000 seconds] Frame Number: 7 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb94 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x89e6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 27D00CE150D06D35 Responder cookie: 48BD0FA4A1D9789A Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 23 f8 10 29 12 00 0c 29 96 68 b2 08 00 45 00 .#..)...).h...E. 0010 00 78 00 00 40 00 40 11 fb 94 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 9c 01 f4 01 f4 00 64 89 e6 27 d0 0c e1 50 d0 .......d..'...P. 0030 6d 35 48 bd 0f a4 a1 d9 78 9a 05 10 02 01 00 00 m5H.....x....... 0040 00 00 00 00 00 5c 09 e5 98 8d bc b1 ba 51 c4 59 .....\.......Q.Y 0050 31 a5 48 91 24 1c 4d 35 9d 1f 57 82 4b f7 57 c7 1.H.$.M5..W.K.W. 0060 e9 3f 56 ac 80 88 f4 4e aa 24 d2 7f e9 17 e9 0e .?V....N.$...... 0070 3a 0c a7 29 dc c5 f8 46 e6 39 2f c7 26 2d 7a 2c :..)...F.9/.&-z, 0080 4d 20 e3 90 c2 e7 M .... Frame 8 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 7, 2011 14:51:55.105113000 [Time delta from previous captured frame: 0.000021000 seconds] [Time delta from previous displayed frame: 0.000021000 seconds] [Time since reference or first frame: 0.079731000 seconds] Frame Number: 8 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb94 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x89e6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 27D00CE150D06D35 Responder cookie: 48BD0FA4A1D9789A Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 23 f8 10 29 12 00 0c 29 96 68 b2 08 00 45 00 .#..)...).h...E. 0010 00 78 00 00 40 00 40 11 fb 94 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 9c 01 f4 01 f4 00 64 89 e6 27 d0 0c e1 50 d0 .......d..'...P. 0030 6d 35 48 bd 0f a4 a1 d9 78 9a 05 10 02 01 00 00 m5H.....x....... 0040 00 00 00 00 00 5c 09 e5 98 8d bc b1 ba 51 c4 59 .....\.......Q.Y 0050 31 a5 48 91 24 1c 4d 35 9d 1f 57 82 4b f7 57 c7 1.H.$.M5..W.K.W. 0060 e9 3f 56 ac 80 88 f4 4e aa 24 d2 7f e9 17 e9 0e .?V....N.$...... 0070 3a 0c a7 29 dc c5 f8 46 e6 39 2f c7 26 2d 7a 2c :..)...F.9/.&-z, 0080 4d 20 e3 90 c2 e7 M .... Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: Feb 7, 2011 14:51:55.107455000 [Time delta from previous captured frame: 0.002342000 seconds] [Time delta from previous displayed frame: 0.002342000 seconds] [Time since reference or first frame: 0.082073000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:23:f8:10:29:12 (00:23:f8:10:29:12), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.156 (165.227.249.156), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba4 [correct] [Good: True] [Bad : False] Source: 165.227.249.156 (165.227.249.156) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xdaf1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 27D00CE150D06D35 Responder cookie: 48BD0FA4A1D9789A Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 96 68 b2 00 23 f8 10 29 12 08 00 45 00 ..).h..#..)...E. 0010 00 68 00 00 40 00 40 11 fb a4 a5 e3 f9 9c a5 e3 .h..@.@......... 0020 f9 7c 01 f4 01 f4 00 54 da f1 27 d0 0c e1 50 d0 .|.....T..'...P. 0030 6d 35 48 bd 0f a4 a1 d9 78 9a 05 10 02 01 00 00 m5H.....x....... 0040 00 00 00 00 00 4c 41 e8 98 f2 64 49 f3 26 b7 77 .....LA...dI.&.w 0050 f4 77 de 9f 32 f6 d7 52 5b b3 cf 6c 6d f4 a9 22 .w..2..R[..lm.." 0060 f2 c6 24 39 2c 3a 21 2a 3d a6 b0 9f 71 7f 2e d4 ..$9,:!*=...q... 0070 f4 32 ef 4a 94 cb .2.J.. Frame 10 (518 bytes on wire, 518 bytes captured) Arrival Time: Feb 7, 2011 14:51:55.136875000 [Time delta from previous captured frame: 0.029420000 seconds] [Time delta from previous displayed frame: 0.029420000 seconds] [Time since reference or first frame: 0.111493000 seconds] Frame Number: 10 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa14 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0x5de3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 27D00CE150D06D35 Responder cookie: 48BD0FA4A1D9789A Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xad4f789d Length: 476 Encrypted payload (448 bytes) 0000 00 23 f8 10 29 12 00 0c 29 96 68 b2 08 00 45 00 .#..)...).h...E. 0010 01 f8 00 00 40 00 40 11 fa 14 a5 e3 f9 7c a5 e3 ....@.@......|.. 0020 f9 9c 01 f4 01 f4 01 e4 5d e3 27 d0 0c e1 50 d0 ........].'...P. 0030 6d 35 48 bd 0f a4 a1 d9 78 9a 08 10 20 01 ad 4f m5H.....x... ..O 0040 78 9d 00 00 01 dc ea e8 7e e2 cc dc 71 6d 8a 8d x.......~...qm.. 0050 2b 50 9a 83 e1 2e d6 b2 24 91 a8 4e 5f 43 0c 35 +P......$..N_C.5 0060 a9 4c a7 e9 1a ea de 92 fd 4f 4e 4f d2 69 b3 e2 .L.......ONO.i.. 0070 00 e4 03 bc 52 93 70 44 58 2a 1a 34 c6 24 f0 1b ....R.pDX*.4.$.. 0080 9f 9e dc 3d 5a aa 1a 1b a3 64 09 85 7e 97 3d d7 ...=Z....d..~.=. 0090 2c 08 50 69 0f 11 27 08 5e af df b6 d6 ba fe ef ,.Pi..'.^....... 00a0 7c 99 db 9c c1 75 56 ec 2d 82 d4 45 ed e9 9c 4d |....uV.-..E...M 00b0 ba 27 ae 76 d4 1f 22 ec 99 dc 58 88 9a 49 e2 6c .'.v.."...X..I.l 00c0 92 8a e4 86 11 16 f5 7a a1 13 88 d9 e6 5d 52 22 .......z.....]R" 00d0 3c e1 f4 68 13 e7 f2 83 ba 2b 69 a9 46 4d 77 c1 <..h.....+i.FMw. 00e0 26 de ec e6 62 45 5e ab d3 30 38 58 6a d6 00 f4 &...bE^..08Xj... 00f0 83 7f 59 7e 92 10 2d ba 4e fe 6f b5 7a b9 48 b9 ..Y~..-.N.o.z.H. 0100 f9 39 8e 00 bd 7f ba 4a fa c0 98 9d 30 da ed 89 .9.....J....0... 0110 a6 fd 79 7b 39 6f 5b 25 13 27 e9 6d f2 31 2b 10 ..y{9o[%.'.m.1+. 0120 26 23 34 33 75 2c c0 38 92 9a 13 5f 74 bd 4e 44 +u,.8..._t.ND 0130 0e a0 d0 3c e7 e3 22 40 47 bd 9c 7b a8 43 3d a4 ...<.."@G..{.C=. 0140 19 47 4b 37 32 c0 dc 55 3c 13 5e a3 02 76 7b eb .GK72..U<.^..v{. 0150 e3 d6 28 99 1c f2 14 be 7a 48 3f 8a f9 ba 2c ed ..(.....zH?...,. 0160 f9 38 ff e3 eb 48 0c 71 c1 a2 8e d2 ab a3 19 08 .8...H.q........ 0170 cd 4b 32 a1 b4 a5 2b 6a 3e f5 f7 88 5d 7f 5e a5 .K2...+j>...].^. 0180 d6 52 92 4a ab db 6a fd 70 f4 7f 0b 5e 26 a4 0d .R.J..j.p...^&.. 0190 9b f4 9d ec 66 7e 51 48 b2 5f 79 99 b4 ad bf 21 ....f~QH._y....! 01a0 00 ec 2f 31 09 2b 42 ac 6c 5e 89 94 b9 45 74 54 ../1.+B.l^...EtT 01b0 78 15 ce 7b b9 8d 2b ae cb 4a b6 02 20 d0 f1 47 x..{..+..J.. ..G 01c0 6f 57 c9 2e be 14 5c b8 cd f9 d6 73 76 e2 58 58 oW....\....sv.XX 01d0 28 00 d1 6b 19 b5 d4 6a 00 0d a8 39 49 cd 0d 37 (..k...j...9I..7 01e0 c4 ed 4b a5 9c 2b 63 60 2c ec e5 b2 f0 b4 80 00 ..K..+c`,....... 01f0 b1 d6 cc af b5 9d 75 6d 4c 8e 3f 8a 2b f8 d7 f2 ......umL.?.+... 0200 f0 77 8c 29 57 66 .w.)Wf Frame 11 (518 bytes on wire, 518 bytes captured) Arrival Time: Feb 7, 2011 14:51:55.136884000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 0.111502000 seconds] Frame Number: 11 Frame Length: 518 bytes Capture Length: 518 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 504 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa14 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 484 Checksum: 0x5de3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 27D00CE150D06D35 Responder cookie: 48BD0FA4A1D9789A Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xad4f789d Length: 476 Encrypted payload (448 bytes) 0000 00 23 f8 10 29 12 00 0c 29 96 68 b2 08 00 45 00 .#..)...).h...E. 0010 01 f8 00 00 40 00 40 11 fa 14 a5 e3 f9 7c a5 e3 ....@.@......|.. 0020 f9 9c 01 f4 01 f4 01 e4 5d e3 27 d0 0c e1 50 d0 ........].'...P. 0030 6d 35 48 bd 0f a4 a1 d9 78 9a 08 10 20 01 ad 4f m5H.....x... ..O 0040 78 9d 00 00 01 dc ea e8 7e e2 cc dc 71 6d 8a 8d x.......~...qm.. 0050 2b 50 9a 83 e1 2e d6 b2 24 91 a8 4e 5f 43 0c 35 +P......$..N_C.5 0060 a9 4c a7 e9 1a ea de 92 fd 4f 4e 4f d2 69 b3 e2 .L.......ONO.i.. 0070 00 e4 03 bc 52 93 70 44 58 2a 1a 34 c6 24 f0 1b ....R.pDX*.4.$.. 0080 9f 9e dc 3d 5a aa 1a 1b a3 64 09 85 7e 97 3d d7 ...=Z....d..~.=. 0090 2c 08 50 69 0f 11 27 08 5e af df b6 d6 ba fe ef ,.Pi..'.^....... 00a0 7c 99 db 9c c1 75 56 ec 2d 82 d4 45 ed e9 9c 4d |....uV.-..E...M 00b0 ba 27 ae 76 d4 1f 22 ec 99 dc 58 88 9a 49 e2 6c .'.v.."...X..I.l 00c0 92 8a e4 86 11 16 f5 7a a1 13 88 d9 e6 5d 52 22 .......z.....]R" 00d0 3c e1 f4 68 13 e7 f2 83 ba 2b 69 a9 46 4d 77 c1 <..h.....+i.FMw. 00e0 26 de ec e6 62 45 5e ab d3 30 38 58 6a d6 00 f4 &...bE^..08Xj... 00f0 83 7f 59 7e 92 10 2d ba 4e fe 6f b5 7a b9 48 b9 ..Y~..-.N.o.z.H. 0100 f9 39 8e 00 bd 7f ba 4a fa c0 98 9d 30 da ed 89 .9.....J....0... 0110 a6 fd 79 7b 39 6f 5b 25 13 27 e9 6d f2 31 2b 10 ..y{9o[%.'.m.1+. 0120 26 23 34 33 75 2c c0 38 92 9a 13 5f 74 bd 4e 44 +u,.8..._t.ND 0130 0e a0 d0 3c e7 e3 22 40 47 bd 9c 7b a8 43 3d a4 ...<.."@G..{.C=. 0140 19 47 4b 37 32 c0 dc 55 3c 13 5e a3 02 76 7b eb .GK72..U<.^..v{. 0150 e3 d6 28 99 1c f2 14 be 7a 48 3f 8a f9 ba 2c ed ..(.....zH?...,. 0160 f9 38 ff e3 eb 48 0c 71 c1 a2 8e d2 ab a3 19 08 .8...H.q........ 0170 cd 4b 32 a1 b4 a5 2b 6a 3e f5 f7 88 5d 7f 5e a5 .K2...+j>...].^. 0180 d6 52 92 4a ab db 6a fd 70 f4 7f 0b 5e 26 a4 0d .R.J..j.p...^&.. 0190 9b f4 9d ec 66 7e 51 48 b2 5f 79 99 b4 ad bf 21 ....f~QH._y....! 01a0 00 ec 2f 31 09 2b 42 ac 6c 5e 89 94 b9 45 74 54 ../1.+B.l^...EtT 01b0 78 15 ce 7b b9 8d 2b ae cb 4a b6 02 20 d0 f1 47 x..{..+..J.. ..G 01c0 6f 57 c9 2e be 14 5c b8 cd f9 d6 73 76 e2 58 58 oW....\....sv.XX 01d0 28 00 d1 6b 19 b5 d4 6a 00 0d a8 39 49 cd 0d 37 (..k...j...9I..7 01e0 c4 ed 4b a5 9c 2b 63 60 2c ec e5 b2 f0 b4 80 00 ..K..+c`,....... 01f0 b1 d6 cc af b5 9d 75 6d 4c 8e 3f 8a 2b f8 d7 f2 ......umL.?.+... 0200 f0 77 8c 29 57 66 .w.)Wf Frame 12 (342 bytes on wire, 342 bytes captured) Arrival Time: Feb 7, 2011 14:51:55.203609000 [Time delta from previous captured frame: 0.066725000 seconds] [Time delta from previous displayed frame: 0.066725000 seconds] [Time since reference or first frame: 0.178227000 seconds] Frame Number: 12 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:23:f8:10:29:12 (00:23:f8:10:29:12), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.156 (165.227.249.156), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfac4 [correct] [Good: True] [Bad : False] Source: 165.227.249.156 (165.227.249.156) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xc90b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 27D00CE150D06D35 Responder cookie: 48BD0FA4A1D9789A Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xad4f789d Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 96 68 b2 00 23 f8 10 29 12 08 00 45 00 ..).h..#..)...E. 0010 01 48 00 00 40 00 40 11 fa c4 a5 e3 f9 9c a5 e3 .H..@.@......... 0020 f9 7c 01 f4 01 f4 01 34 c9 0b 27 d0 0c e1 50 d0 .|.....4..'...P. 0030 6d 35 48 bd 0f a4 a1 d9 78 9a 08 10 20 01 ad 4f m5H.....x... ..O 0040 78 9d 00 00 01 2c dd a9 27 7f f2 e6 8b 14 5d 0b x....,..'.....]. 0050 c9 2c 38 55 5e 6b b4 50 6b eb 1e 2b 2f 3d e4 87 .,8U^k.Pk..+/=.. 0060 1d 42 66 18 cb 1a fe c9 c0 ed 4e e4 7b c3 a3 05 .Bf.......N.{... 0070 93 a0 e5 9b d3 82 3e fe d2 f8 6d b7 4b cd 0f 96 ......>...m.K... 0080 b9 af 98 f4 1b 68 3c 35 5e 2c 87 2e 9e 89 c4 2c .....h<5^,....., 0090 30 6d 8f 39 ae 1b be fd a6 6b 16 c3 b6 3c ee 4e 0m.9.....k...<.N 00a0 ea 94 a7 3c aa f6 70 1b 74 5d 7f 68 2a ef 40 5d ...<..p.t].h*.@] 00b0 27 ec 5c 42 c8 a6 e4 6a 9c 02 6d f1 18 20 36 8a '.\B...j..m.. 6. 00c0 8f 8d b5 74 c5 ca 75 fd 27 6d e4 17 50 6f ff ab ...t..u.'m..Po.. 00d0 96 c9 bc 50 03 53 95 e4 3f 60 10 36 98 2d 32 b0 ...P.S..?`.6.-2. 00e0 06 8f 87 02 f2 f7 11 4a 98 8e 23 09 61 20 8f 37 .......J..#.a .7 00f0 f9 04 37 72 05 b9 87 d4 2d b4 de ef c8 09 ce 8f ..7r....-....... 0100 fa b3 44 c0 44 31 f2 37 fe 26 1a 93 72 dd 1a 90 ..D.D1.7.&..r... 0110 e4 09 81 32 3c 76 61 a0 95 8e 88 e6 bb 9a 41 04 ...2..".%y..O.. 0040 07 25 8d 18 39 cb 1e 65 63 ee 15 b6 ac 4b f4 28 .%..9..ec....K.( 0050 16 18 80 d9 4d d3 18 8b a8 9b d7 5a c2 d6 70 c3 ....M......Z..p. 0060 2f 98 de c5 24 e8 21 ed 49 f1 38 17 f1 a5 7f eb /...$.!.I.8..... 0070 0b 63 a3 7c c3 f5 32 0d ec 04 37 d4 8c a6 ed 6d .c.|..2...7....m 0080 34 97 90 ba a6 da 4..... Frame 19 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 7, 2011 14:51:56.030203000 [Time delta from previous captured frame: 0.000029000 seconds] [Time delta from previous displayed frame: 0.000029000 seconds] [Time since reference or first frame: 1.004821000 seconds] Frame Number: 19 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0005 (5) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b6e [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.156 (165.227.249.156) Encapsulating Security Payload ESP SPI: 0xbd8ef36d ESP Sequence: 2 0000 00 23 f8 10 29 12 00 0c 29 96 68 b2 08 00 45 00 .#..)...).h...E. 0010 00 78 00 05 00 00 f0 32 8b 6e a5 e3 f9 7c a5 e3 .x.....2.n...|.. 0020 f9 9c bd 8e f3 6d 00 00 00 02 c9 bf 1d d5 ae 3d .....m.........= 0030 f7 51 c4 59 3e 14 15 22 84 25 79 9f cf 4f ae 98 .Q.Y>..".%y..O.. 0040 07 25 8d 18 39 cb 1e 65 63 ee 15 b6 ac 4b f4 28 .%..9..ec....K.( 0050 16 18 80 d9 4d d3 18 8b a8 9b d7 5a c2 d6 70 c3 ....M......Z..p. 0060 2f 98 de c5 24 e8 21 ed 49 f1 38 17 f1 a5 7f eb /...$.!.I.8..... 0070 0b 63 a3 7c c3 f5 32 0d ec 04 37 d4 8c a6 ed 6d .c.|..2...7....m 0080 34 97 90 ba a6 da 4..... Frame 20 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 7, 2011 14:51:56.033462000 [Time delta from previous captured frame: 0.003259000 seconds] [Time delta from previous displayed frame: 0.003259000 seconds] [Time since reference or first frame: 1.008080000 seconds] Frame Number: 20 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:23:f8:10:29:12 (00:23:f8:10:29:12), Dst: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Destination: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) Address: 00:0c:29:96:68:b2 (00:0c:29:96:68:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.156 (165.227.249.156), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x3628 (13864) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x054c [correct] [Good: True] [Bad : False] Source: 165.227.249.156 (165.227.249.156) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0xe3537ad3 ESP Sequence: 2 0000 00 0c 29 96 68 b2 00 23 f8 10 29 12 08 00 45 00 ..).h..#..)...E. 0010 00 78 36 28 00 00 40 32 05 4c a5 e3 f9 9c a5 e3 .x6(..@2.L...... 0020 f9 7c e3 53 7a d3 00 00 00 02 9b fc f8 95 27 8c .|.Sz.........'. 0030 f6 3c aa ae 7a df 9e af fb 5a 26 6c 9b 6a 02 4b .<..z....Z&l.j.K 0040 91 ae 2c a7 98 d9 63 82 1f d2 d9 cb 0e e8 fc 56 ..,...c........V 0050 84 b7 04 51 3a 7d 36 dc 21 1f 84 b3 6e 71 9a 9c ...Q:}6.!...nq.. 0060 95 a1 3e 23 f3 c5 74 61 19 bd e6 79 e0 56 df b7 ..>#..ta...y.V.. 0070 70 95 ed 17 8d fe 77 19 52 60 84 5f f5 dc 5d ee p.....w.R`._..]. 0080 ab 00 92 87 44 d2 ....D.