Frame 1 (274 bytes on wire, 274 bytes captured) Arrival Time: Nov 21, 2007 11:15:32.569977000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 274 bytes Capture Length: 274 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff), Dst: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4) Destination: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4) Source: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.142 (165.227.249.142), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 260 Identification: 0x464a (17994) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x35c2 [correct] Good: True Bad : False Source: 165.227.249.142 (165.227.249.142) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 240 Checksum: 0x7616 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x868A33CE25E82BB9 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 232 Security Association payload Next payload: Vendor ID (13) Length: 184 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 172 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 5 Transform payload # 0 Next payload: Transform (3) Length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: Transform (3) Length: 32 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): MD5 (1) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 3 Next payload: Transform (3) Length: 32 Transform number: 3 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): DES-CBC (1) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 4 Next payload: NONE (0) Length: 32 Transform number: 4 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): DES-CBC (1) Hash-Algorithm (2): MD5 (1) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 9c c5 d4 00 0f 3d 55 af ff 08 00 45 00 ..).....=U....E. 0010 01 04 46 4a 00 00 ff 11 35 c2 a5 e3 f9 8e a5 e3 ..FJ....5....... 0020 f9 86 01 f4 01 f4 00 f0 76 16 86 8a 33 ce 25 e8 ........v...3.%. 0030 2b b9 00 00 00 00 00 00 00 00 01 10 02 00 00 00 +............... 0040 00 00 00 00 00 e8 0d 00 00 b8 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 ac 00 01 00 05 03 00 00 24 00 01 .............$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 03 00 ............p... 0080 00 20 01 01 00 00 80 01 00 05 80 02 00 02 80 03 . .............. 0090 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 03 00 ............p... 00a0 00 20 02 01 00 00 80 01 00 05 80 02 00 01 80 03 . .............. 00b0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 03 00 ............p... 00c0 00 20 03 01 00 00 80 01 00 01 80 02 00 02 80 03 . .............. 00d0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 00 00 ............p... 00e0 00 20 04 01 00 00 80 01 00 01 80 02 00 01 80 03 . .............. 00f0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 00 00 ............p... 0100 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 0110 01 00 .. Frame 2 (126 bytes on wire, 126 bytes captured) Arrival Time: Nov 21, 2007 11:15:32.838976000 Time delta from previous packet: 0.268999000 seconds Time since reference or first frame: 0.268999000 seconds Frame Number: 2 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Source: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0xe70e (59150) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x5492 [correct] Good: True Bad : False Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0xadb3 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x868A33CE25E82BB9 Responder cookie: 0xFB4CD2E9D2246D37 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 84 Security Association payload Next payload: NONE (0) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 44 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Key-Length (14): Key-Length (128) 0000 00 0f 3d 55 af ff 00 0c 29 9c c5 d4 08 00 45 00 ..=U....).....E. 0010 00 70 e7 0e 00 00 40 11 54 92 a5 e3 f9 86 a5 e3 .p....@.T....... 0020 f9 8e 01 f4 01 f4 00 5c ad b3 86 8a 33 ce 25 e8 .......\....3.%. 0030 2b b9 fb 4c d2 e9 d2 24 6d 37 01 10 02 00 00 00 +..L...$m7...... 0040 00 00 00 00 00 54 00 00 00 38 00 00 00 01 00 00 .....T...8...... 0050 00 01 00 00 00 2c 00 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 01 00 07 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 80 0c 70 80 80 0e 00 80 ........p..... Frame 3 (222 bytes on wire, 222 bytes captured) Arrival Time: Nov 21, 2007 11:15:33.106796000 Time delta from previous packet: 0.267820000 seconds Time since reference or first frame: 0.536819000 seconds Frame Number: 3 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff), Dst: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4) Destination: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4) Source: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.142 (165.227.249.142), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x6248 (25160) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x19f8 [correct] Good: True Bad : False Source: 165.227.249.142 (165.227.249.142) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x12bf [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x868A33CE25E82BB9 Responder cookie: 0xFB4CD2E9D2246D37 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 9c c5 d4 00 0f 3d 55 af ff 08 00 45 00 ..).....=U....E. 0010 00 d0 62 48 00 00 ff 11 19 f8 a5 e3 f9 8e a5 e3 ..bH............ 0020 f9 86 01 f4 01 f4 00 bc 12 bf 86 8a 33 ce 25 e8 ............3.%. 0030 2b b9 fb 4c d2 e9 d2 24 6d 37 04 10 02 00 00 00 +..L...$m7...... 0040 00 00 00 00 00 b4 0a 00 00 84 96 08 66 cf 92 d1 ............f... 0050 39 05 f5 3b 4c 8c 77 c8 69 85 22 5c 8c e1 08 66 9..;L.w.i."\...f 0060 4a 33 e9 d7 a8 c6 8a 64 eb 19 ef 61 a3 a9 84 76 J3.....d...a...v 0070 27 a1 5d ed 05 0f 16 7f 34 6c cb 75 b9 f3 06 bd '.].....4l.u.... 0080 c0 e9 42 17 d9 eb 6f f6 13 aa f2 e3 c0 4a 85 e2 ..B...o......J.. 0090 40 4d 2e f7 2d c4 37 4f 41 97 22 c5 23 d2 0c dd @M..-.7OA.".#... 00a0 40 a9 8c 3f de e9 e8 ed 0d eb 86 6a cc 44 29 12 @..?.......j.D). 00b0 8d 3b c3 74 9d 5c 88 9a 37 ac 04 ab be 68 46 82 .;.t.\..7....hF. 00c0 c9 d9 4b 24 98 ef 32 70 25 d9 00 00 00 14 ed bb ..K$..2p%....... 00d0 6c 4a a3 1a d2 f5 f6 76 b0 c6 9a 77 1d c3 lJ.....v...w.. Frame 4 (270 bytes on wire, 270 bytes captured) Arrival Time: Nov 21, 2007 11:15:33.232626000 Time delta from previous packet: 0.125830000 seconds Time since reference or first frame: 0.662649000 seconds Frame Number: 4 Packet Length: 270 bytes Capture Length: 270 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Source: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0xe80e (59406) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x5302 [correct] Good: True Bad : False Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x7fd5 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x868A33CE25E82BB9 Responder cookie: 0xFB4CD2E9D2246D37 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 68 Nonce Data 0000 00 0f 3d 55 af ff 00 0c 29 9c c5 d4 08 00 45 00 ..=U....).....E. 0010 01 00 e8 0e 00 00 40 11 53 02 a5 e3 f9 86 a5 e3 ......@.S....... 0020 f9 8e 01 f4 01 f4 00 ec 7f d5 86 8a 33 ce 25 e8 ............3.%. 0030 2b b9 fb 4c d2 e9 d2 24 6d 37 04 10 02 00 00 00 +..L...$m7...... 0040 00 00 00 00 00 e4 0a 00 00 84 f6 9c db 0f 59 23 ..............Y# 0050 72 79 36 52 af f6 76 96 b3 a0 32 f5 94 0b 6d 3b ry6R..v...2...m; 0060 0a 3d 16 35 a3 7b ff ef c8 e4 26 12 3b d9 f0 e8 .=.5.{....&.;... 0070 cd f7 fe ff cd 60 01 ea aa 28 6a 64 92 63 8d 46 .....`...(jd.c.F 0080 15 4e 0a ca 2b 39 7f 82 6a 16 44 aa 95 fe 92 ba .N..+9..j.D..... 0090 c9 16 c7 0c 47 2c 07 e8 89 5f be 51 00 2e 19 c9 ....G,..._.Q.... 00a0 b8 22 e5 d9 06 90 77 d5 1b 6f fa 94 9a da c8 87 ."....w..o...... 00b0 20 e0 46 6d 54 13 c7 d9 32 30 78 9b 13 e2 57 74 .FmT...20x...Wt 00c0 48 9a 8b 62 be 33 39 ee 3b 76 00 00 00 44 d9 b2 H..b.39.;v...D.. 00d0 cf b0 56 cd 10 66 0a 28 c9 0d 27 98 10 af e5 74 ..V..f.(..'....t 00e0 53 ac c6 42 a2 8c 6a 67 a0 b7 5e e2 d5 fd 86 c1 S..B..jg..^..... 00f0 2a 6c d0 9e a3 e2 8c bc d0 59 13 96 8b 1b cb 2a *l.......Y.....* 0100 0f f6 32 32 66 8b a4 88 ab 9a 63 82 1d 35 ..22f.....c..5 Frame 5 (118 bytes on wire, 118 bytes captured) Arrival Time: Nov 21, 2007 11:15:33.457560000 Time delta from previous packet: 0.224934000 seconds Time since reference or first frame: 0.887583000 seconds Frame Number: 5 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff), Dst: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4) Destination: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4) Source: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.142 (165.227.249.142), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x434d (17229) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x395b [correct] Good: True Bad : False Source: 165.227.249.142 (165.227.249.142) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xb405 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x868A33CE25E82BB9 Responder cookie: 0xFB4CD2E9D2246D37 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 9c c5 d4 00 0f 3d 55 af ff 08 00 45 00 ..).....=U....E. 0010 00 68 43 4d 00 00 ff 11 39 5b a5 e3 f9 8e a5 e3 .hCM....9[...... 0020 f9 86 01 f4 01 f4 00 54 b4 05 86 8a 33 ce 25 e8 .......T....3.%. 0030 2b b9 fb 4c d2 e9 d2 24 6d 37 05 10 02 01 00 00 +..L...$m7...... 0040 00 00 00 00 00 4c 01 05 76 a0 ec 82 76 2b 9f a2 .....L..v...v+.. 0050 67 b4 02 02 31 e0 c2 c3 7b d9 d5 bd ec 8f 77 79 g...1...{.....wy 0060 42 83 84 8f 0a cd 17 07 2b 08 90 49 6d 55 f7 70 B.......+..ImU.p 0070 06 a9 3b 2f 0e c9 ..;/.. Frame 6 (118 bytes on wire, 118 bytes captured) Arrival Time: Nov 21, 2007 11:15:33.545561000 Time delta from previous packet: 0.088001000 seconds Time since reference or first frame: 0.975584000 seconds Frame Number: 6 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Source: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0xe90e (59662) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x529a [correct] Good: True Bad : False Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x29f0 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x868A33CE25E82BB9 Responder cookie: 0xFB4CD2E9D2246D37 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0f 3d 55 af ff 00 0c 29 9c c5 d4 08 00 45 00 ..=U....).....E. 0010 00 68 e9 0e 00 00 40 11 52 9a a5 e3 f9 86 a5 e3 .h....@.R....... 0020 f9 8e 01 f4 01 f4 00 54 29 f0 86 8a 33 ce 25 e8 .......T)...3.%. 0030 2b b9 fb 4c d2 e9 d2 24 6d 37 05 10 02 01 00 00 +..L...$m7...... 0040 00 00 00 00 00 4c 2d 2e b3 51 4e 92 95 bf 83 b5 .....L-..QN..... 0050 89 fd bd e4 44 14 6c 13 86 46 2c f1 d7 08 6c 4b ....D.l..F,...lK 0060 de c8 ca c8 6f 88 71 8d d3 4f 25 8a 67 ba 04 05 ....o.q..O%.g... 0070 4a 05 c4 64 3c df J..d<. Frame 7 (502 bytes on wire, 502 bytes captured) Arrival Time: Nov 21, 2007 11:15:33.735893000 Time delta from previous packet: 0.190332000 seconds Time since reference or first frame: 1.165916000 seconds Frame Number: 7 Packet Length: 502 bytes Capture Length: 502 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff), Dst: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4) Destination: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4) Source: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.142 (165.227.249.142), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 488 Identification: 0x434c (17228) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x37dc [correct] Good: True Bad : False Source: 165.227.249.142 (165.227.249.142) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 468 Checksum: 0x535a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x868A33CE25E82BB9 Responder cookie: 0xFB4CD2E9D2246D37 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x6CB49254 Length: 460 Encrypted payload (432 bytes) 0000 00 0c 29 9c c5 d4 00 0f 3d 55 af ff 08 00 45 00 ..).....=U....E. 0010 01 e8 43 4c 00 00 ff 11 37 dc a5 e3 f9 8e a5 e3 ..CL....7....... 0020 f9 86 01 f4 01 f4 01 d4 53 5a 86 8a 33 ce 25 e8 ........SZ..3.%. 0030 2b b9 fb 4c d2 e9 d2 24 6d 37 08 10 20 01 6c b4 +..L...$m7.. .l. 0040 92 54 00 00 01 cc b4 3f cb 56 28 17 4c b5 bc 23 .T.....?.V(.L..# 0050 75 44 07 51 ae fd e0 61 62 20 85 d5 e4 43 81 2f uD.Q...ab ...C./ 0060 6b bc 85 85 c0 27 c2 a8 2a 32 fa fa ff 64 5f 3e k....'..*2...d_> 0070 ff da 7c 6b e0 e9 04 68 90 d0 ff 9d d0 a7 34 92 ..|k...h......4. 0080 37 cf 9d f1 21 d7 22 e8 82 c8 28 af bd bd 49 90 7...!."...(...I. 0090 4b d8 9c 1d c8 88 1e cf f6 8d 87 56 06 fa 07 13 K..........V.... 00a0 39 f4 de 54 81 90 1d 5e c3 2c 9b f9 20 cd 93 ba 9..T...^.,.. ... 00b0 6f 29 d4 8b bb f5 2a 9f b1 fe e8 8b 7d 76 cb f1 o)....*.....}v.. 00c0 b8 82 6c 55 76 99 f4 85 5f 59 7c 3a 68 94 f4 1c ..lUv..._Y|:h... 00d0 33 fd 7e 70 e6 e1 72 03 42 58 d3 35 e8 d8 0c f4 3.~p..r.BX.5.... 00e0 ce 0c 32 6b ae 6b c0 09 92 8b f8 0f d1 4f c5 74 ..2k.k.......O.t 00f0 78 75 08 13 a4 73 92 98 ec 59 23 56 c4 10 31 fc xu...s...Y#V..1. 0100 7f 27 0d e6 b9 28 60 1a 80 9a 43 7f 59 bc 6e 27 .'...(`...C.Y.n' 0110 a0 32 d4 db 62 a6 8a 10 9b 69 e1 ea 6a 6e 72 c0 .2..b....i..jnr. 0120 f0 0a 39 1f 13 8a 93 e3 4c e7 fc 1c 4d be e4 d4 ..9.....L...M... 0130 e5 69 33 78 94 b9 8f 31 1c 30 03 83 97 64 d1 8b .i3x...1.0...d.. 0140 bc 3f 73 aa 0e b1 cb cf 1a 22 b3 31 50 88 2b 7c .?s......".1P.+| 0150 34 2c dd 30 a9 99 09 2d 5b 6d 9f 62 64 94 92 7b 4,.0...-[m.bd..{ 0160 5d 8b 93 9c 9b c7 21 a4 76 b0 d4 e5 02 5e f6 b3 ].....!.v....^.. 0170 64 bd 45 67 4e 95 4f 47 54 e4 46 46 c1 4a 7f 85 d.EgN.OGT.FF.J.. 0180 40 40 1d 2f 00 a8 b1 d9 b2 7f ac 9c e3 32 9c 8d @@./.........2.. 0190 ee 0f 77 0f c6 52 7a 71 93 73 6c 97 35 c7 47 f2 ..w..Rzq.sl.5.G. 01a0 52 bb 45 04 78 8e 22 71 28 ee 77 bc 41 80 f1 d9 R.E.x."q(.w.A... 01b0 75 24 7b ce 77 f3 1e 03 97 3d 4f 70 c0 e6 e2 92 u${.w....=Op.... 01c0 77 5b 90 cc 7d f5 02 95 07 f1 e1 06 d7 40 a0 47 w[..}........@.G 01d0 b0 48 44 4c f9 5b 7c d8 32 e4 2d e6 bb 6c 46 0f .HDL.[|.2.-..lF. 01e0 fc 6e 65 ea f3 50 93 e8 c3 34 24 df aa 3a b8 81 .ne..P...4$..:.. 01f0 53 9d 68 c7 09 ed S.h... Frame 8 (390 bytes on wire, 390 bytes captured) Arrival Time: Nov 21, 2007 11:15:34.076181000 Time delta from previous packet: 0.340288000 seconds Time since reference or first frame: 1.506204000 seconds Frame Number: 8 Packet Length: 390 bytes Capture Length: 390 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Source: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 376 Identification: 0xea0e (59918) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x508a [correct] Good: True Bad : False Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 356 Checksum: 0x74f6 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x868A33CE25E82BB9 Responder cookie: 0xFB4CD2E9D2246D37 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x6CB49254 Length: 348 Encrypted payload (320 bytes) 0000 00 0f 3d 55 af ff 00 0c 29 9c c5 d4 08 00 45 00 ..=U....).....E. 0010 01 78 ea 0e 00 00 40 11 50 8a a5 e3 f9 86 a5 e3 .x....@.P....... 0020 f9 8e 01 f4 01 f4 01 64 74 f6 86 8a 33 ce 25 e8 .......dt...3.%. 0030 2b b9 fb 4c d2 e9 d2 24 6d 37 08 10 20 01 6c b4 +..L...$m7.. .l. 0040 92 54 00 00 01 5c a6 d5 1e 79 6e b8 f4 57 09 0f .T...\...yn..W.. 0050 ad b9 c9 94 3c 28 d7 b8 8a 6c 6c 37 b3 fe f5 59 ....<(...ll7...Y 0060 d4 21 8d ab d6 56 95 fd af af 5a be 8b bf 79 c9 .!...V....Z...y. 0070 c8 ea 0d 1a 17 90 7d b8 ff 6d c6 37 a1 0c cb cb ......}..m.7.... 0080 fa 4e 13 57 d9 bf db a6 c5 97 6a df 8c 9b 3d 9a .N.W......j...=. 0090 54 d8 ef 02 09 d2 cd cd 5d 06 ca 4b 31 54 3f 0f T.......]..K1T?. 00a0 c3 ef 07 61 ab 01 7f 95 7f 50 a6 cf 2b 93 ca 15 ...a.....P..+... 00b0 74 4f b2 f1 ae 25 20 ae 84 df 60 cc 1f 4e 12 0c tO...% ...`..N.. 00c0 37 d7 b6 d3 1f 3e 32 fb 84 4b f5 32 61 18 23 f5 7....>2..K.2a.#. 00d0 b9 17 c7 68 2d 1c 12 e0 4f 19 4a 75 34 17 81 97 ...h-...O.Ju4... 00e0 64 23 c1 50 8f 34 4c 2d ec e9 13 af a7 4e 9c 1b d#.P.4L-.....N.. 00f0 ee af 83 89 f6 7a fa 9a d2 fc f5 e9 00 60 05 23 .....z.......`.# 0100 8f 58 0c 22 35 fe 42 c4 34 96 dd b0 58 48 6f a9 .X."5.B.4...XHo. 0110 24 fe d2 fd bf fe 98 f9 58 47 be 6a cf f2 43 1d $.......XG.j..C. 0120 f2 a7 a4 35 72 f1 5e 9e 5e 69 28 ff 9e 00 21 2c ...5r.^.^i(...!, 0130 c4 be 57 8b ae 1a a0 75 82 bb 52 6a f3 ee c3 0b ..W....u..Rj.... 0140 78 9f 71 23 ca f4 71 cc 39 22 56 62 6f ec 9f 92 x.q#..q.9"Vbo... 0150 b8 fc 6c f6 3f 9a 85 1a 86 65 fa 1c e8 be b1 7c ..l.?....e.....| 0160 05 3d 66 13 44 18 e8 64 7d e8 0b 78 fc 6b 9d 2b .=f.D..d}..x.k.+ 0170 28 a9 aa 58 93 e7 97 90 a4 c2 94 17 95 05 ca 1e (..X............ 0180 65 1f 04 14 40 ec e...@. Frame 9 (102 bytes on wire, 102 bytes captured) Arrival Time: Nov 21, 2007 11:15:34.359040000 Time delta from previous packet: 0.282859000 seconds Time since reference or first frame: 1.789063000 seconds Frame Number: 9 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff), Dst: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4) Destination: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4) Source: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.142 (165.227.249.142), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x614b (24907) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x1b6d [correct] Good: True Bad : False Source: 165.227.249.142 (165.227.249.142) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xfe86 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x868A33CE25E82BB9 Responder cookie: 0xFB4CD2E9D2246D37 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x6CB49254 Length: 60 Encrypted payload (32 bytes) 0000 00 0c 29 9c c5 d4 00 0f 3d 55 af ff 08 00 45 00 ..).....=U....E. 0010 00 58 61 4b 00 00 ff 11 1b 6d a5 e3 f9 8e a5 e3 .XaK.....m...... 0020 f9 86 01 f4 01 f4 00 44 fe 86 86 8a 33 ce 25 e8 .......D....3.%. 0030 2b b9 fb 4c d2 e9 d2 24 6d 37 08 10 20 01 6c b4 +..L...$m7.. .l. 0040 92 54 00 00 00 3c 58 f9 32 a8 88 7e a8 05 d4 60 .T......Y.... 0070 08 ee 1c 5e 30 b9 33 93 bb 35 9f ee 33 84 2f 0b ...^0.3..5..3./. 0080 b4 75 98 39 df 32 .u.9.2 Frame 17 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 21, 2007 11:15:36.709562000 Time delta from previous packet: 0.014779000 seconds Time since reference or first frame: 4.139585000 seconds Frame Number: 17 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4), Dst: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Destination: 00:0f:3d:55:af:ff (00:0f:3d:55:af:ff) Source: 00:0c:29:9c:c5:d4 (00:0c:29:9c:c5:d4) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0xf30e (62222) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: ESP (0x32) Header checksum: 0x0969 [correct] Good: True Bad : False Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.142 (165.227.249.142) Encapsulating Security Payload SPI: 0x3345f191 Sequence: 4 Data (92 bytes) 0000 00 0f 3d 55 af ff 00 0c 29 9c c5 d4 08 00 45 00 ..=U....).....E. 0010 00 78 f3 0e 00 00 7f 32 09 69 a5 e3 f9 86 a5 e3 .x.....2.i...... 0020 f9 8e 33 45 f1 91 00 00 00 04 7e 59 bc 25 f4 72 ..3E......~Y.%.r 0030 08 d5 10 d7 a0 21 0c 74 46 1e fd 7f 71 fd 4c 57 .....!.tF...q.LW 0040 0f 01 b6 ed 5e fb 5e bb 18 fb 53 8d a1 07 6f 1a ....^.^...S...o. 0050 65 4f db a9 3b 19 46 c0 66 c9 55 7d ff 35 dc 2e eO..;.F.f.U}.5.. 0060 69 ed 5f ca fd f5 09 cc f8 da 0e a4 5c 86 f8 0b i._.........\... 0070 08 f3 35 26 ce 96 bd 29 cc 8a d9 de db 60 a8 0c ..5&...).....`.. 0080 32 c0 2c 13 78 6c 2.,.xl