Frame 1 (230 bytes on wire, 230 bytes captured) Arrival Time: Jul 4, 2007 18:11:03.509543000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 230 bytes Capture Length: 230 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 216 Identification: 0x0043 (67) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3af6 [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 196 Checksum: 0x55a4 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 188 Security Association payload Next payload: Vendor ID (13) Length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 48 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 40 Transform number: 1 Transform ID: KEY_IKE (1) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Encryption-Algorithm (1): AES-CBC (7) Hash-Algorithm (2): SHA (2) Key-Length (14): Key-Length (128) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x1FB99487B303B5E6C4695C0F98074FF4 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x648982785BEDBDD66A6DD356F0E160FD 0000 00 03 d2 20 0e a4 00 0f b5 c4 e4 ae 08 00 45 00 ... ..........E. 0010 00 d8 00 43 00 00 40 11 3a f6 a5 e3 f9 89 a5 e3 ...C..@.:....... 0020 f9 8b 01 f4 01 f4 00 c4 55 a4 b5 b7 5a a1 39 1a ........U...Z.9. 0030 50 a2 00 00 00 00 00 00 00 00 01 10 02 00 00 00 P............... 0040 00 00 00 00 00 bc 0d 00 00 3c 00 00 00 01 00 00 .........<...... 0050 00 01 00 00 00 30 01 01 00 01 00 00 00 28 01 01 .....0.......(.. 0060 00 00 80 04 00 02 80 03 00 01 80 01 00 07 80 02 ................ 0070 00 02 80 0e 00 80 80 0b 00 01 00 0c 00 04 00 00 ................ 0080 70 80 0d 00 00 14 44 85 15 2d 18 b6 bb cd 0b e8 p.....D..-...... 0090 a8 46 95 79 dd cc 0d 00 00 14 90 cb 80 91 3e bb .F.y..........>. 00a0 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 1f b9 in.c...B{....... 00b0 94 87 b3 03 b5 e6 c4 69 5c 0f 98 07 4f f4 0d 00 .......i\...O... 00c0 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00d0 01 00 00 00 00 14 64 89 82 78 5b ed bd d6 6a 6d ......d..x[...jm 00e0 d3 56 f0 e1 60 fd .V..`. Frame 2 (130 bytes on wire, 130 bytes captured) Arrival Time: Jul 4, 2007 18:11:03.510340000 Time delta from previous packet: 0.000797000 seconds Time since reference or first frame: 0.000797000 seconds Frame Number: 2 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 116 Identification: 0x015c (348) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa40 [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 96 Checksum: 0x478e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 88 Security Association payload Next payload: NONE (0) Length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 48 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 40 Transform number: 1 Transform ID: KEY_IKE (1) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Encryption-Algorithm (1): AES-CBC (7) Hash-Algorithm (2): SHA (2) Key-Length (14): Key-Length (128) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0f b5 c4 e4 ae 00 03 d2 20 0e a4 08 00 45 00 ......... ....E. 0010 00 74 01 5c 40 00 40 11 fa 40 a5 e3 f9 8b a5 e3 .t.\@.@..@...... 0020 f9 89 01 f4 01 f4 00 60 47 8e b5 b7 5a a1 39 1a .......`G...Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 01 10 02 00 00 00 P..P.*T C....... 0040 00 00 00 00 00 58 00 00 00 3c 00 00 00 01 00 00 .....X...<...... 0050 00 01 00 00 00 30 01 01 00 01 00 00 00 28 01 01 .....0.......(.. 0060 00 00 80 04 00 02 80 03 00 01 80 01 00 07 80 02 ................ 0070 00 02 80 0e 00 80 80 0b 00 01 00 0c 00 04 00 00 ................ 0080 70 80 p. Frame 3 (130 bytes on wire, 130 bytes captured) Arrival Time: Jul 4, 2007 18:11:05.527730000 Time delta from previous packet: 2.017390000 seconds Time since reference or first frame: 2.018187000 seconds Frame Number: 3 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 116 Identification: 0x015d (349) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa3f [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 96 Checksum: 0x478e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 88 Security Association payload Next payload: NONE (0) Length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 48 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 40 Transform number: 1 Transform ID: KEY_IKE (1) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Encryption-Algorithm (1): AES-CBC (7) Hash-Algorithm (2): SHA (2) Key-Length (14): Key-Length (128) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0f b5 c4 e4 ae 00 03 d2 20 0e a4 08 00 45 00 ......... ....E. 0010 00 74 01 5d 40 00 40 11 fa 3f a5 e3 f9 8b a5 e3 .t.]@.@..?...... 0020 f9 89 01 f4 01 f4 00 60 47 8e b5 b7 5a a1 39 1a .......`G...Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 01 10 02 00 00 00 P..P.*T C....... 0040 00 00 00 00 00 58 00 00 00 3c 00 00 00 01 00 00 .....X...<...... 0050 00 01 00 00 00 30 01 01 00 01 00 00 00 28 01 01 .....0.......(.. 0060 00 00 80 04 00 02 80 03 00 01 80 01 00 07 80 02 ................ 0070 00 02 80 0e 00 80 80 0b 00 01 00 0c 00 04 00 00 ................ 0080 70 80 p. Frame 4 (130 bytes on wire, 130 bytes captured) Arrival Time: Jul 4, 2007 18:11:07.550419000 Time delta from previous packet: 2.022689000 seconds Time since reference or first frame: 4.040876000 seconds Frame Number: 4 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 116 Identification: 0x015e (350) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa3e [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 96 Checksum: 0x478e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 88 Security Association payload Next payload: NONE (0) Length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 48 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 40 Transform number: 1 Transform ID: KEY_IKE (1) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Encryption-Algorithm (1): AES-CBC (7) Hash-Algorithm (2): SHA (2) Key-Length (14): Key-Length (128) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0f b5 c4 e4 ae 00 03 d2 20 0e a4 08 00 45 00 ......... ....E. 0010 00 74 01 5e 40 00 40 11 fa 3e a5 e3 f9 8b a5 e3 .t.^@.@..>...... 0020 f9 89 01 f4 01 f4 00 60 47 8e b5 b7 5a a1 39 1a .......`G...Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 01 10 02 00 00 00 P..P.*T C....... 0040 00 00 00 00 00 58 00 00 00 3c 00 00 00 01 00 00 .....X...<...... 0050 00 01 00 00 00 30 01 01 00 01 00 00 00 28 01 01 .....0.......(.. 0060 00 00 80 04 00 02 80 03 00 01 80 01 00 07 80 02 ................ 0070 00 02 80 0e 00 80 80 0b 00 01 00 0c 00 04 00 00 ................ 0080 70 80 p. Frame 5 (130 bytes on wire, 130 bytes captured) Arrival Time: Jul 4, 2007 18:11:09.514890000 Time delta from previous packet: 1.964471000 seconds Time since reference or first frame: 6.005347000 seconds Frame Number: 5 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 116 Identification: 0x015f (351) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa3d [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 96 Checksum: 0x478e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 88 Security Association payload Next payload: NONE (0) Length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 48 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 40 Transform number: 1 Transform ID: KEY_IKE (1) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Encryption-Algorithm (1): AES-CBC (7) Hash-Algorithm (2): SHA (2) Key-Length (14): Key-Length (128) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0f b5 c4 e4 ae 00 03 d2 20 0e a4 08 00 45 00 ......... ....E. 0010 00 74 01 5f 40 00 40 11 fa 3d a5 e3 f9 8b a5 e3 .t._@.@..=...... 0020 f9 89 01 f4 01 f4 00 60 47 8e b5 b7 5a a1 39 1a .......`G...Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 01 10 02 00 00 00 P..P.*T C....... 0040 00 00 00 00 00 58 00 00 00 3c 00 00 00 01 00 00 .....X...<...... 0050 00 01 00 00 00 30 01 01 00 01 00 00 00 28 01 01 .....0.......(.. 0060 00 00 80 04 00 02 80 03 00 01 80 01 00 07 80 02 ................ 0070 00 02 80 0e 00 80 80 0b 00 01 00 0c 00 04 00 00 ................ 0080 70 80 p. Frame 6 (130 bytes on wire, 130 bytes captured) Arrival Time: Jul 4, 2007 18:11:11.526157000 Time delta from previous packet: 2.011267000 seconds Time since reference or first frame: 8.016614000 seconds Frame Number: 6 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 116 Identification: 0x0160 (352) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa3c [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 96 Checksum: 0x478e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 88 Security Association payload Next payload: NONE (0) Length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 48 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 40 Transform number: 1 Transform ID: KEY_IKE (1) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Encryption-Algorithm (1): AES-CBC (7) Hash-Algorithm (2): SHA (2) Key-Length (14): Key-Length (128) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0f b5 c4 e4 ae 00 03 d2 20 0e a4 08 00 45 00 ......... ....E. 0010 00 74 01 60 40 00 40 11 fa 3c a5 e3 f9 8b a5 e3 .t.`@.@..<...... 0020 f9 89 01 f4 01 f4 00 60 47 8e b5 b7 5a a1 39 1a .......`G...Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 01 10 02 00 00 00 P..P.*T C....... 0040 00 00 00 00 00 58 00 00 00 3c 00 00 00 01 00 00 .....X...<...... 0050 00 01 00 00 00 30 01 01 00 01 00 00 00 28 01 01 .....0.......(.. 0060 00 00 80 04 00 02 80 03 00 01 80 01 00 07 80 02 ................ 0070 00 02 80 0e 00 80 80 0b 00 01 00 0c 00 04 00 00 ................ 0080 70 80 p. Frame 7 (130 bytes on wire, 130 bytes captured) Arrival Time: Jul 4, 2007 18:11:13.546860000 Time delta from previous packet: 2.020703000 seconds Time since reference or first frame: 10.037317000 seconds Frame Number: 7 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 116 Identification: 0x0161 (353) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa3b [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 96 Checksum: 0x478e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 88 Security Association payload Next payload: NONE (0) Length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 48 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 40 Transform number: 1 Transform ID: KEY_IKE (1) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Encryption-Algorithm (1): AES-CBC (7) Hash-Algorithm (2): SHA (2) Key-Length (14): Key-Length (128) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0f b5 c4 e4 ae 00 03 d2 20 0e a4 08 00 45 00 ......... ....E. 0010 00 74 01 61 40 00 40 11 fa 3b a5 e3 f9 8b a5 e3 .t.a@.@..;...... 0020 f9 89 01 f4 01 f4 00 60 47 8e b5 b7 5a a1 39 1a .......`G...Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 01 10 02 00 00 00 P..P.*T C....... 0040 00 00 00 00 00 58 00 00 00 3c 00 00 00 01 00 00 .....X...<...... 0050 00 01 00 00 00 30 01 01 00 01 00 00 00 28 01 01 .....0.......(.. 0060 00 00 80 04 00 02 80 03 00 01 80 01 00 07 80 02 ................ 0070 00 02 80 0e 00 80 80 0b 00 01 00 0c 00 04 00 00 ................ 0080 70 80 p. Frame 8 (230 bytes on wire, 230 bytes captured) Arrival Time: Jul 4, 2007 18:11:13.662817000 Time delta from previous packet: 0.115957000 seconds Time since reference or first frame: 10.153274000 seconds Frame Number: 8 Packet Length: 230 bytes Capture Length: 230 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 216 Identification: 0x004c (76) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3aed [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 196 Checksum: 0x55a4 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 188 Security Association payload Next payload: Vendor ID (13) Length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 48 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 40 Transform number: 1 Transform ID: KEY_IKE (1) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Encryption-Algorithm (1): AES-CBC (7) Hash-Algorithm (2): SHA (2) Key-Length (14): Key-Length (128) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x1FB99487B303B5E6C4695C0F98074FF4 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x648982785BEDBDD66A6DD356F0E160FD 0000 00 03 d2 20 0e a4 00 0f b5 c4 e4 ae 08 00 45 00 ... ..........E. 0010 00 d8 00 4c 00 00 40 11 3a ed a5 e3 f9 89 a5 e3 ...L..@.:....... 0020 f9 8b 01 f4 01 f4 00 c4 55 a4 b5 b7 5a a1 39 1a ........U...Z.9. 0030 50 a2 00 00 00 00 00 00 00 00 01 10 02 00 00 00 P............... 0040 00 00 00 00 00 bc 0d 00 00 3c 00 00 00 01 00 00 .........<...... 0050 00 01 00 00 00 30 01 01 00 01 00 00 00 28 01 01 .....0.......(.. 0060 00 00 80 04 00 02 80 03 00 01 80 01 00 07 80 02 ................ 0070 00 02 80 0e 00 80 80 0b 00 01 00 0c 00 04 00 00 ................ 0080 70 80 0d 00 00 14 44 85 15 2d 18 b6 bb cd 0b e8 p.....D..-...... 0090 a8 46 95 79 dd cc 0d 00 00 14 90 cb 80 91 3e bb .F.y..........>. 00a0 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 1f b9 in.c...B{....... 00b0 94 87 b3 03 b5 e6 c4 69 5c 0f 98 07 4f f4 0d 00 .......i\...O... 00c0 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00d0 01 00 00 00 00 14 64 89 82 78 5b ed bd d6 6a 6d ......d..x[...jm 00e0 d3 56 f0 e1 60 fd .V..`. Frame 9 (214 bytes on wire, 214 bytes captured) Arrival Time: Jul 4, 2007 18:11:13.663019000 Time delta from previous packet: 0.000202000 seconds Time since reference or first frame: 10.153476000 seconds Frame Number: 9 Packet Length: 214 bytes Capture Length: 214 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 200 Identification: 0x004e (78) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3afb [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 180 Checksum: 0x8060 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 172 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 12 Nonce Data 0000 00 03 d2 20 0e a4 00 0f b5 c4 e4 ae 08 00 45 00 ... ..........E. 0010 00 c8 00 4e 00 00 40 11 3a fb a5 e3 f9 89 a5 e3 ...N..@.:....... 0020 f9 8b 01 f4 01 f4 00 b4 80 60 b5 b7 5a a1 39 1a .........`..Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 04 10 02 00 00 00 P..P.*T C....... 0040 00 00 00 00 00 ac 0a 00 00 84 80 ab d3 f8 c0 a6 ................ 0050 8e 9c ca 0c fc 2f c1 20 29 db 68 b2 77 b2 71 b3 ...../. ).h.w.q. 0060 1c b1 ca 73 2d 54 f3 60 95 79 b8 f5 13 88 bb 9b ...s-T.`.y...... 0070 96 f7 96 b2 0c 32 43 a6 69 b5 43 8c 82 71 d9 5e .....2C.i.C..q.^ 0080 78 51 cf 44 cb dd 19 f9 35 d9 50 b8 45 46 93 8e xQ.D....5.P.EF.. 0090 ef 3f 12 a5 75 25 29 4c 63 85 fd 7a 13 52 a2 0e .?..u%)Lc..z.R.. 00a0 7c da 08 65 e4 04 af a8 a0 ba a7 72 4f 7f f8 42 |..e.......rO..B 00b0 4a 91 a4 5d b3 c4 57 f6 80 a9 91 ca 1e 17 41 14 J..]..W.......A. 00c0 d3 6c 26 e8 70 0a b4 5f 23 25 00 00 00 0c d8 8e .l&.p.._#%...... 00d0 d4 75 72 f2 1e b7 .ur... Frame 10 (226 bytes on wire, 226 bytes captured) Arrival Time: Jul 4, 2007 18:11:13.665603000 Time delta from previous packet: 0.002584000 seconds Time since reference or first frame: 10.156060000 seconds Frame Number: 10 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x0162 (354) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xf9da [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x9ced [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 24 Nonce Data 0000 00 0f b5 c4 e4 ae 00 03 d2 20 0e a4 08 00 45 00 ......... ....E. 0010 00 d4 01 62 40 00 40 11 f9 da a5 e3 f9 8b a5 e3 ...b@.@......... 0020 f9 89 01 f4 01 f4 00 c0 9c ed b5 b7 5a a1 39 1a ............Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 04 10 02 00 00 00 P..P.*T C....... 0040 00 00 00 00 00 b8 0a 00 00 84 a1 99 0a 95 04 e4 ................ 0050 36 c0 d0 0c 4b 27 0c c4 c2 c9 c6 8b db a5 39 df 6...K'........9. 0060 27 32 f6 30 de 68 e3 3d 76 fe 46 d7 a4 89 a3 51 '2.0.h.=v.F....Q 0070 67 e6 0d 23 cd 93 43 89 eb 89 01 e6 96 27 15 c4 g..#..C......'.. 0080 89 ed 8b 3e 78 0c e4 23 b3 a9 d3 ad ca 83 34 3b ...>x..#......4; 0090 2d 6b d9 ef 4f 50 db 2a f1 8a df e3 13 c3 ce 2b -k..OP.*.......+ 00a0 75 5f e7 aa 26 cb 28 2b 52 8f 09 91 9b 0e 82 bd u_..&.(+R....... 00b0 8a 5f fe 11 bd ae 2e 48 21 fa ee c8 e5 10 48 32 ._.....H!.....H2 00c0 24 df 51 e5 a1 93 12 43 9d ce 00 00 00 18 8a 9f $.Q....C........ 00d0 97 2d 75 f3 09 86 4e 6e 5f 1b 05 14 bc 1c de a7 .-u...Nn_....... 00e0 f0 c8 .. Frame 11 (134 bytes on wire, 134 bytes captured) Arrival Time: Jul 4, 2007 18:11:15.261303000 Time delta from previous packet: 1.595700000 seconds Time since reference or first frame: 11.751760000 seconds Frame Number: 11 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x004f (79) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3b4a [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x5a7d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 03 d2 20 0e a4 00 0f b5 c4 e4 ae 08 00 45 00 ... ..........E. 0010 00 78 00 4f 00 00 40 11 3b 4a a5 e3 f9 89 a5 e3 .x.O..@.;J...... 0020 f9 8b 01 f4 01 f4 00 64 5a 7d b5 b7 5a a1 39 1a .......dZ}..Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 05 10 02 01 00 00 P..P.*T C....... 0040 00 00 00 00 00 5c a4 52 a1 4d 5d 80 ed 74 62 4b .....\.R.M]..tbK 0050 c9 7a ae 6e e3 57 43 9f 20 7f 1c 79 eb c3 0c 74 .z.n.WC. ..y...t 0060 93 6e 35 7c 49 50 83 6e b6 35 ff e7 24 ee b0 c7 .n5|IP.n.5..$... 0070 d0 bc 0f 9e d2 8e a2 48 9a 0a 85 de 30 d6 e9 44 .......H....0..D 0080 56 11 c1 1e ce 0a V..... Frame 12 (118 bytes on wire, 118 bytes captured) Arrival Time: Jul 4, 2007 18:11:15.264779000 Time delta from previous packet: 0.003476000 seconds Time since reference or first frame: 11.755236000 seconds Frame Number: 12 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0163 (355) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa45 [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xb488 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0f b5 c4 e4 ae 00 03 d2 20 0e a4 08 00 45 00 ......... ....E. 0010 00 68 01 63 40 00 40 11 fa 45 a5 e3 f9 8b a5 e3 .h.c@.@..E...... 0020 f9 89 01 f4 01 f4 00 54 b4 88 b5 b7 5a a1 39 1a .......T....Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 05 10 02 01 00 00 P..P.*T C....... 0040 00 00 00 00 00 4c 67 10 79 2c 19 d4 c5 16 9d 1e .....Lg.y,...... 0050 4b fe cc ce af d2 d7 fd 57 f3 84 73 44 70 84 7c K.......W..sDp.| 0060 b1 7a 91 d0 ae 78 63 d2 d1 25 c5 84 45 e2 b2 15 .z...xc..%..E... 0070 5b 99 a0 5c 80 9e [..\.. Frame 13 (118 bytes on wire, 118 bytes captured) Arrival Time: Jul 4, 2007 18:11:15.365074000 Time delta from previous packet: 0.100295000 seconds Time since reference or first frame: 11.855531000 seconds Frame Number: 13 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0164 (356) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa44 [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xb488 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0f b5 c4 e4 ae 00 03 d2 20 0e a4 08 00 45 00 ......... ....E. 0010 00 68 01 64 40 00 40 11 fa 44 a5 e3 f9 8b a5 e3 .h.d@.@..D...... 0020 f9 89 01 f4 01 f4 00 54 b4 88 b5 b7 5a a1 39 1a .......T....Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 05 10 02 01 00 00 P..P.*T C....... 0040 00 00 00 00 00 4c 67 10 79 2c 19 d4 c5 16 9d 1e .....Lg.y,...... 0050 4b fe cc ce af d2 d7 fd 57 f3 84 73 44 70 84 7c K.......W..sDp.| 0060 b1 7a 91 d0 ae 78 63 d2 d1 25 c5 84 45 e2 b2 15 .z...xc..%..E... 0070 5b 99 a0 5c 80 9e [..\.. Frame 14 (118 bytes on wire, 118 bytes captured) Arrival Time: Jul 4, 2007 18:11:15.458399000 Time delta from previous packet: 0.093325000 seconds Time since reference or first frame: 11.948856000 seconds Frame Number: 14 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0165 (357) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa43 [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xb488 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0f b5 c4 e4 ae 00 03 d2 20 0e a4 08 00 45 00 ......... ....E. 0010 00 68 01 65 40 00 40 11 fa 43 a5 e3 f9 8b a5 e3 .h.e@.@..C...... 0020 f9 89 01 f4 01 f4 00 54 b4 88 b5 b7 5a a1 39 1a .......T....Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 05 10 02 01 00 00 P..P.*T C....... 0040 00 00 00 00 00 4c 67 10 79 2c 19 d4 c5 16 9d 1e .....Lg.y,...... 0050 4b fe cc ce af d2 d7 fd 57 f3 84 73 44 70 84 7c K.......W..sDp.| 0060 b1 7a 91 d0 ae 78 63 d2 d1 25 c5 84 45 e2 b2 15 .z...xc..%..E... 0070 5b 99 a0 5c 80 9e [..\.. Frame 15 (134 bytes on wire, 134 bytes captured) Arrival Time: Jul 4, 2007 18:11:19.488624000 Time delta from previous packet: 4.030225000 seconds Time since reference or first frame: 15.979081000 seconds Frame Number: 15 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0050 (80) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3b49 [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x5a7d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 03 d2 20 0e a4 00 0f b5 c4 e4 ae 08 00 45 00 ... ..........E. 0010 00 78 00 50 00 00 40 11 3b 49 a5 e3 f9 89 a5 e3 .x.P..@.;I...... 0020 f9 8b 01 f4 01 f4 00 64 5a 7d b5 b7 5a a1 39 1a .......dZ}..Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 05 10 02 01 00 00 P..P.*T C....... 0040 00 00 00 00 00 5c a4 52 a1 4d 5d 80 ed 74 62 4b .....\.R.M]..tbK 0050 c9 7a ae 6e e3 57 43 9f 20 7f 1c 79 eb c3 0c 74 .z.n.WC. ..y...t 0060 93 6e 35 7c 49 50 83 6e b6 35 ff e7 24 ee b0 c7 .n5|IP.n.5..$... 0070 d0 bc 0f 9e d2 8e a2 48 9a 0a 85 de 30 d6 e9 44 .......H....0..D 0080 56 11 c1 1e ce 0a V..... Frame 16 (134 bytes on wire, 134 bytes captured) Arrival Time: Jul 4, 2007 18:11:24.456367000 Time delta from previous packet: 4.967743000 seconds Time since reference or first frame: 20.946824000 seconds Frame Number: 16 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0053 (83) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3b46 [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x5a7d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 03 d2 20 0e a4 00 0f b5 c4 e4 ae 08 00 45 00 ... ..........E. 0010 00 78 00 53 00 00 40 11 3b 46 a5 e3 f9 89 a5 e3 .x.S..@.;F...... 0020 f9 8b 01 f4 01 f4 00 64 5a 7d b5 b7 5a a1 39 1a .......dZ}..Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 05 10 02 01 00 00 P..P.*T C....... 0040 00 00 00 00 00 5c a4 52 a1 4d 5d 80 ed 74 62 4b .....\.R.M]..tbK 0050 c9 7a ae 6e e3 57 43 9f 20 7f 1c 79 eb c3 0c 74 .z.n.WC. ..y...t 0060 93 6e 35 7c 49 50 83 6e b6 35 ff e7 24 ee b0 c7 .n5|IP.n.5..$... 0070 d0 bc 0f 9e d2 8e a2 48 9a 0a 85 de 30 d6 e9 44 .......H....0..D 0080 56 11 c1 1e ce 0a V..... Frame 17 (134 bytes on wire, 134 bytes captured) Arrival Time: Jul 4, 2007 18:11:29.490739000 Time delta from previous packet: 5.034372000 seconds Time since reference or first frame: 25.981196000 seconds Frame Number: 17 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0054 (84) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3b45 [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x5a7d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 03 d2 20 0e a4 00 0f b5 c4 e4 ae 08 00 45 00 ... ..........E. 0010 00 78 00 54 00 00 40 11 3b 45 a5 e3 f9 89 a5 e3 .x.T..@.;E...... 0020 f9 8b 01 f4 01 f4 00 64 5a 7d b5 b7 5a a1 39 1a .......dZ}..Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 05 10 02 01 00 00 P..P.*T C....... 0040 00 00 00 00 00 5c a4 52 a1 4d 5d 80 ed 74 62 4b .....\.R.M]..tbK 0050 c9 7a ae 6e e3 57 43 9f 20 7f 1c 79 eb c3 0c 74 .z.n.WC. ..y...t 0060 93 6e 35 7c 49 50 83 6e b6 35 ff e7 24 ee b0 c7 .n5|IP.n.5..$... 0070 d0 bc 0f 9e d2 8e a2 48 9a 0a 85 de 30 d6 e9 44 .......H....0..D 0080 56 11 c1 1e ce 0a V..... Frame 18 (342 bytes on wire, 342 bytes captured) Arrival Time: Jul 4, 2007 18:11:43.631300000 Time delta from previous packet: 14.140561000 seconds Time since reference or first frame: 40.121757000 seconds Frame Number: 18 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x005d (93) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a6c [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xf71a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xA4B78367 Length: 300 Encrypted payload (272 bytes) 0000 00 03 d2 20 0e a4 00 0f b5 c4 e4 ae 08 00 45 00 ... ..........E. 0010 01 48 00 5d 00 00 40 11 3a 6c a5 e3 f9 89 a5 e3 .H.]..@.:l...... 0020 f9 8b 01 f4 01 f4 01 34 f7 1a b5 b7 5a a1 39 1a .......4....Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 08 10 20 01 a4 b7 P..P.*T C... ... 0040 83 67 00 00 01 2c d3 8c 39 a5 c0 16 c6 d1 6e 53 .g...,..9.....nS 0050 bf 9f bc 9e da 6d dd 37 03 be bc e5 52 aa 0e aa .....m.7....R... 0060 fe 12 f1 0d b2 af 15 47 07 bb ae 3b 29 ff e3 cb .......G...;)... 0070 49 d0 98 74 7c a4 49 22 ec 20 4d 3f 35 de 75 8a I..t|.I". M?5.u. 0080 ff 69 8e c6 4f 19 31 28 d8 a2 1a 9a 10 a1 46 18 .i..O.1(......F. 0090 7c 27 70 96 86 80 b4 e0 66 0f 71 b1 ab 44 6a 7e |'p.....f.q..Dj~ 00a0 97 63 07 7a 60 2b 15 8b 98 cf d1 c9 82 4c b3 ea .c.z`+.......L.. 00b0 66 a5 ca ab ff 5c b6 21 62 63 dd 37 1a e1 a6 4d f....\.!bc.7...M 00c0 e4 2a 70 da 43 2a 1b 2c 4b 81 7b cf ff f9 70 8b .*p.C*.,K.{...p. 00d0 e8 86 81 6c ec fe 67 b8 de d9 1e 41 9e 20 0d 7b ...l..g....A. .{ 00e0 ed bc 86 ca 30 42 ae d9 92 32 05 39 fe dd 6e 34 ....0B...2.9..n4 00f0 7d 27 3b 9a e0 b2 c7 a1 58 dd d7 93 82 71 d1 09 }';.....X....q.. 0100 8c 6d b4 e7 53 00 f8 94 9b d1 d7 9f df f7 99 c2 .m..S........... 0110 02 6c 16 0c 7f cf 59 21 27 91 3f 3e ac 51 20 37 .l....Y!'.?>.Q 7 0120 46 91 38 8c 6d c6 a9 8b b9 a9 07 95 32 d2 ff c4 F.8.m.......2... 0130 20 30 2b d2 81 a7 84 97 b8 91 d7 d0 64 c7 ac 67 0+.........d..g 0140 99 92 96 53 c6 ef b7 c8 7d 90 54 4b 46 79 84 e4 ...S....}.TKFy.. 0150 f6 13 56 20 c4 fc ..V .. Frame 19 (358 bytes on wire, 358 bytes captured) Arrival Time: Jul 4, 2007 18:11:43.634410000 Time delta from previous packet: 0.003110000 seconds Time since reference or first frame: 40.124867000 seconds Frame Number: 19 Packet Length: 358 bytes Capture Length: 358 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 344 Identification: 0x0166 (358) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xf952 [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 324 Checksum: 0x26a0 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xA4B78367 Length: 316 Encrypted payload (288 bytes) 0000 00 0f b5 c4 e4 ae 00 03 d2 20 0e a4 08 00 45 00 ......... ....E. 0010 01 58 01 66 40 00 40 11 f9 52 a5 e3 f9 8b a5 e3 .X.f@.@..R...... 0020 f9 89 01 f4 01 f4 01 44 26 a0 b5 b7 5a a1 39 1a .......D&...Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 08 10 20 01 a4 b7 P..P.*T C... ... 0040 83 67 00 00 01 3c 6f 54 bd 62 93 fd 04 3b 4f 52 .g...7 0100 c7 cd da 0a 60 74 65 7b 68 03 d0 90 39 2f 99 22 ....`te{h...9/." 0110 e8 5d e7 4d 49 49 e4 06 19 4d 42 5b fb 96 81 f9 .].MII...MB[.... 0120 4b 6b 1e ce 0e a1 d6 1b 7a c9 4b b6 85 8c c7 ed Kk......z.K..... 0130 90 da 9d 25 72 15 8f 99 13 ca d1 1c 21 b0 32 31 ...%r.......!.21 0140 fd 22 3f a6 0f 33 5a 18 b4 ce 2d 37 fa 8d 19 21 ."?..3Z...-7...! 0150 f4 05 2c 6a 6b 1f 8d 98 a4 97 1e aa e5 9b 64 f0 ..,jk.........d. 0160 5d 67 47 6f 46 18 ]gGoF. Frame 20 (102 bytes on wire, 102 bytes captured) Arrival Time: Jul 4, 2007 18:11:45.230591000 Time delta from previous packet: 1.596181000 seconds Time since reference or first frame: 41.721048000 seconds Frame Number: 20 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x005e (94) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3b5b [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xf0be [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xA4B78367 Length: 60 Encrypted payload (32 bytes) 0000 00 03 d2 20 0e a4 00 0f b5 c4 e4 ae 08 00 45 00 ... ..........E. 0010 00 58 00 5e 00 00 40 11 3b 5b a5 e3 f9 89 a5 e3 .X.^..@.;[...... 0020 f9 8b 01 f4 01 f4 00 44 f0 be b5 b7 5a a1 39 1a .......D....Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 08 10 20 01 a4 b7 P..P.*T C... ... 0040 83 67 00 00 00 3c 05 59 99 0a 0a 7b b4 2d 76 7a .g...<.Y...{.-vz 0050 d4 1b b4 da 10 8b 69 af 7b 40 23 95 fc 7a c2 73 ......i.{@#..z.s 0060 8f 59 9e 42 1b c7 .Y.B.. Frame 21 (134 bytes on wire, 134 bytes captured) Arrival Time: Jul 4, 2007 18:11:47.581574000 Time delta from previous packet: 2.350983000 seconds Time since reference or first frame: 44.072031000 seconds Frame Number: 21 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x152f (5423) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 29 Protocol: ESP (0x32) Header checksum: 0x4949 [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.139 (165.227.249.139) Encapsulating Security Payload SPI: 0x3efda209 Sequence: 1 Data (92 bytes) 0000 00 03 d2 20 0e a4 00 0f b5 c4 e4 ae 08 00 45 00 ... ..........E. 0010 00 78 15 2f 00 00 1d 32 49 49 a5 e3 f9 89 a5 e3 .x./...2II...... 0020 f9 8b 3e fd a2 09 00 00 00 01 a9 b1 cb 38 61 48 ..>..........8aH 0030 b8 13 68 61 af ce 5d 1c d2 bb 3c 26 a4 fb b8 bb ..ha..]...<&.... 0040 ed af e9 14 d6 d3 df 9f 5d df a1 62 0b 7b b0 29 ........]..b.{.) 0050 18 10 50 4f c5 b9 dd 17 77 79 d1 f9 51 37 cf 4e ..PO....wy..Q7.N 0060 38 15 92 5a 4d 03 db 2c 10 56 27 2f 77 b3 ab aa 8..ZM..,.V'/w... 0070 3d 96 8c 27 90 a3 a9 db f6 e5 9f 9c f9 10 8d 02 =..'............ 0080 8e b7 31 c7 fc a4 ..1... Frame 22 (134 bytes on wire, 134 bytes captured) Arrival Time: Jul 4, 2007 18:11:47.584161000 Time delta from previous packet: 0.002587000 seconds Time since reference or first frame: 44.074618000 seconds Frame Number: 22 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x008e (142) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7be9 [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.137 (165.227.249.137) Encapsulating Security Payload SPI: 0xfca81e8c Sequence: 1 Data (92 bytes) 0000 00 0f b5 c4 e4 ae 00 03 d2 20 0e a4 08 00 45 00 ......... ....E. 0010 00 78 00 8e 00 00 ff 32 7b e9 a5 e3 f9 8b a5 e3 .x.....2{....... 0020 f9 89 fc a8 1e 8c 00 00 00 01 f1 a2 29 9d 72 13 ............).r. 0030 88 39 1e f0 47 bf e3 af 02 94 76 39 0f 45 cf 34 .9..G.....v9.E.4 0040 04 b7 28 7d 4a 25 59 52 a1 26 f9 5a cd 10 bf 14 ..(}J%YR.&.Z.... 0050 24 57 24 eb 97 95 da ab cd 1b fa 46 b2 23 4a 68 $W$........F.#Jh 0060 68 9d 07 39 f6 07 f7 85 d9 c9 e7 2a df 18 69 cf h..9.......*..i. 0070 10 a5 59 70 4b 54 35 ff 3e 79 61 c9 02 d3 cb 45 ..YpKT5.>ya....E 0080 2f e0 39 6d 46 b0 /.9mF. Frame 23 (134 bytes on wire, 134 bytes captured) Arrival Time: Jul 4, 2007 18:11:48.522455000 Time delta from previous packet: 0.938294000 seconds Time since reference or first frame: 45.012912000 seconds Frame Number: 23 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x1d5a (7514) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 29 Protocol: ESP (0x32) Header checksum: 0x411e [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.139 (165.227.249.139) Encapsulating Security Payload SPI: 0x3efda209 Sequence: 2 Data (92 bytes) 0000 00 03 d2 20 0e a4 00 0f b5 c4 e4 ae 08 00 45 00 ... ..........E. 0010 00 78 1d 5a 00 00 1d 32 41 1e a5 e3 f9 89 a5 e3 .x.Z...2A....... 0020 f9 8b 3e fd a2 09 00 00 00 02 3a 57 df 46 d9 fc ..>.......:W.F.. 0030 72 2c 76 68 c6 cc 8c 82 e7 5a f7 70 68 af 00 3d r,vh.....Z.ph..= 0040 de ca 91 e2 0d ea fd 6d da 0b fe 15 b4 1d 96 de .......m........ 0050 b8 4f fc 0c 21 ce b0 cd 14 b5 c7 b6 4e 53 0c ef .O..!.......NS.. 0060 a1 ee d8 4f dc bb 17 8c b8 58 e1 3e 71 9b cb 68 ...O.....X.>q..h 0070 3d 96 7a 31 ce 2f de 0a 27 fe 06 50 67 ea dc e7 =.z1./..'..Pg... 0080 d7 7e 6b 10 19 a7 .~k... Frame 24 (134 bytes on wire, 134 bytes captured) Arrival Time: Jul 4, 2007 18:11:48.523018000 Time delta from previous packet: 0.000563000 seconds Time since reference or first frame: 45.013475000 seconds Frame Number: 24 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x008f (143) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7be8 [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.137 (165.227.249.137) Encapsulating Security Payload SPI: 0xfca81e8c Sequence: 2 Data (92 bytes) 0000 00 0f b5 c4 e4 ae 00 03 d2 20 0e a4 08 00 45 00 ......... ....E. 0010 00 78 00 8f 00 00 ff 32 7b e8 a5 e3 f9 8b a5 e3 .x.....2{....... 0020 f9 89 fc a8 1e 8c 00 00 00 02 0f 20 ea c6 c9 dd ........... .... 0030 cf 45 f2 ee d5 a7 e9 fa 06 76 e7 5c cf cb 96 10 .E.......v.\.... 0040 53 6b a3 f8 9c 9e d1 67 3e 43 6e 1f 62 b4 7a 87 Sk.....g>Cn.b.z. 0050 28 06 3d 40 6b 16 59 b6 6a 2b 09 d7 84 d9 f0 aa (.=@k.Y.j+...... 0060 73 45 2c c8 27 26 11 89 ee 91 88 ac e5 cc be b9 sE,.'&.......... 0070 b7 c9 6b 1e ba 10 3d a2 45 92 0a 29 50 d1 8e a8 ..k...=.E..)P... 0080 51 6c 54 5e 3e fa QlT^>. Frame 25 (134 bytes on wire, 134 bytes captured) Arrival Time: Jul 4, 2007 18:11:49.540527000 Time delta from previous packet: 1.017509000 seconds Time since reference or first frame: 46.030984000 seconds Frame Number: 25 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x4cb2 (19634) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 29 Protocol: ESP (0x32) Header checksum: 0x11c6 [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.139 (165.227.249.139) Encapsulating Security Payload SPI: 0x3efda209 Sequence: 3 Data (92 bytes) 0000 00 03 d2 20 0e a4 00 0f b5 c4 e4 ae 08 00 45 00 ... ..........E. 0010 00 78 4c b2 00 00 1d 32 11 c6 a5 e3 f9 89 a5 e3 .xL....2........ 0020 f9 8b 3e fd a2 09 00 00 00 03 f2 a0 94 57 02 ab ..>..........W.. 0030 b2 fb 63 b4 8a ed c1 be 94 a8 b2 3d 73 46 32 2c ..c........=sF2, 0040 a4 a1 a3 11 42 45 3d 07 dc f3 bd 8a 78 67 1e 16 ....BE=.....xg.. 0050 ad 70 b0 ab c8 79 01 47 f5 d2 2f 79 2f 7a 04 7e .p...y.G../y/z.~ 0060 d1 ae d1 e7 b3 a7 0d 96 09 bd e7 7a fc 28 4b c9 ...........z.(K. 0070 93 d9 2b 4e 84 31 81 3f e7 61 d9 1e c8 fc ce 5c ..+N.1.?.a.....\ 0080 d5 87 71 d4 43 a2 ..q.C. Frame 26 (134 bytes on wire, 134 bytes captured) Arrival Time: Jul 4, 2007 18:11:49.541146000 Time delta from previous packet: 0.000619000 seconds Time since reference or first frame: 46.031603000 seconds Frame Number: 26 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0090 (144) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7be7 [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.137 (165.227.249.137) Encapsulating Security Payload SPI: 0xfca81e8c Sequence: 3 Data (92 bytes) 0000 00 0f b5 c4 e4 ae 00 03 d2 20 0e a4 08 00 45 00 ......... ....E. 0010 00 78 00 90 00 00 ff 32 7b e7 a5 e3 f9 8b a5 e3 .x.....2{....... 0020 f9 89 fc a8 1e 8c 00 00 00 03 4d 5c b4 4e 95 4c ..........M\.N.L 0030 fd 1e 5b ba e3 6a 36 20 8e 01 2c be a9 8c af 00 ..[..j6 ..,..... 0040 2e 85 6b 3f 75 da dc 0e 3f c4 ef 85 be 76 cf 92 ..k?u...?....v.. 0050 50 c5 76 1a d7 aa 21 91 82 c6 7c 0e 62 32 a3 46 P.v...!...|.b2.F 0060 cf c0 8f 69 09 c3 d1 f2 16 31 45 04 bd fc ba 6b ...i.....1E....k 0070 c1 76 81 5a f0 16 b3 62 cd 47 5d 7f e9 9d 96 48 .v.Z...b.G]....H 0080 f0 75 37 8f fd 9b .u7... Frame 27 (102 bytes on wire, 102 bytes captured) Arrival Time: Jul 4, 2007 18:11:50.208685000 Time delta from previous packet: 0.667539000 seconds Time since reference or first frame: 46.699142000 seconds Frame Number: 27 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Destination: 00:03:d2:20:0e:a4 (00:03:d2:20:0e:a4) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0060 (96) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3b59 [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xf0be [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xB5B75AA1391A50A2 Responder cookie: 0xFC50CF2A542043E5 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xA4B78367 Length: 60 Encrypted payload (32 bytes) 0000 00 03 d2 20 0e a4 00 0f b5 c4 e4 ae 08 00 45 00 ... ..........E. 0010 00 58 00 60 00 00 40 11 3b 59 a5 e3 f9 89 a5 e3 .X.`..@.;Y...... 0020 f9 8b 01 f4 01 f4 00 44 f0 be b5 b7 5a a1 39 1a .......D....Z.9. 0030 50 a2 fc 50 cf 2a 54 20 43 e5 08 10 20 01 a4 b7 P..P.*T C... ... 0040 83 67 00 00 00 3c 05 59 99 0a 0a 7b b4 2d 76 7a .g...<.Y...{.-vz 0050 d4 1b b4 da 10 8b 69 af 7b 40 23 95 fc 7a c2 73 ......i.{@#..z.s 0060 8f 59 9e 42 1b c7 .Y.B..