Frame 1 (226 bytes on wire, 226 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.494352000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 226 bytes Capture Length: 226 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x0fab (4011) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xeb93 [correct] [Good: True] [Bad : False] Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x91c2 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 48 f8 2f 00 0c 29 93 b9 00 08 00 45 00 ..)H./..).....E. 0010 00 d4 0f ab 00 00 80 11 eb 93 a5 e3 f9 96 a5 e3 ................ 0020 f9 7c 01 f4 01 f4 00 c0 91 c2 0e 94 ec 59 98 7c .|...........Y.| 0030 30 bc 00 00 00 00 00 00 00 00 01 10 02 00 00 00 0............... 0040 00 00 00 00 00 b8 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0090 45 2f 0d 00 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 E/....}...S..o,. 00a0 9d 92 15 52 9d 56 0d 00 00 14 90 cb 80 91 3e bb ...R.V........>. 00b0 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 in.c...B{.....D. 00c0 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 00 00 .-.......F.y.... 00d0 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00e0 01 00 .. Frame 2 (226 bytes on wire, 226 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.494359000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 0.000007000 seconds] Frame Number: 2 Frame Length: 226 bytes Capture Length: 226 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x0fab (4011) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xeb93 [correct] [Good: True] [Bad : False] Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x91c2 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 48 f8 2f 00 0c 29 93 b9 00 08 00 45 00 ..)H./..).....E. 0010 00 d4 0f ab 00 00 80 11 eb 93 a5 e3 f9 96 a5 e3 ................ 0020 f9 7c 01 f4 01 f4 00 c0 91 c2 0e 94 ec 59 98 7c .|...........Y.| 0030 30 bc 00 00 00 00 00 00 00 00 01 10 02 00 00 00 0............... 0040 00 00 00 00 00 b8 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0090 45 2f 0d 00 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 E/....}...S..o,. 00a0 9d 92 15 52 9d 56 0d 00 00 14 90 cb 80 91 3e bb ...R.V........>. 00b0 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 in.c...B{.....D. 00c0 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 00 00 .-.......F.y.... 00d0 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00e0 01 00 .. Frame 3 (246 bytes on wire, 246 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.495328000 [Time delta from previous captured frame: 0.000969000 seconds] [Time delta from previous displayed frame: 0.000969000 seconds] [Time since reference or first frame: 0.000976000 seconds] Frame Number: 3 Frame Length: 246 bytes Capture Length: 246 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Destination: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 232 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb2a [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 212 Checksum: 0x7224 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: D3E3CB2998D09863 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 204 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 93 b9 00 00 0c 29 48 f8 2f 08 00 45 00 ..).....)H./..E. 0010 00 e8 00 00 40 00 40 11 fb 2a a5 e3 f9 7c a5 e3 ....@.@..*...|.. 0020 f9 96 01 f4 01 f4 00 d4 72 24 0e 94 ec 59 98 7c ........r$...Y.| 0030 30 bc d3 e3 cb 29 98 d0 98 63 01 10 02 00 00 00 0....)...c...... 0040 00 00 00 00 00 cc 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 0090 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00a0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 00b0 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 00c0 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 00d0 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 00e0 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 00f0 96 fc 77 57 01 00 ..wW.. Frame 4 (246 bytes on wire, 246 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.495338000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 0.000986000 seconds] Frame Number: 4 Frame Length: 246 bytes Capture Length: 246 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Destination: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 232 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb2a [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 212 Checksum: 0x7224 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: D3E3CB2998D09863 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 204 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 93 b9 00 00 0c 29 48 f8 2f 08 00 45 00 ..).....)H./..E. 0010 00 e8 00 00 40 00 40 11 fb 2a a5 e3 f9 7c a5 e3 ....@.@..*...|.. 0020 f9 96 01 f4 01 f4 00 d4 72 24 0e 94 ec 59 98 7c ........r$...Y.| 0030 30 bc d3 e3 cb 29 98 d0 98 63 01 10 02 00 00 00 0....)...c...... 0040 00 00 00 00 00 cc 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 0090 05 00 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00a0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 00b0 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 00c0 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 00d0 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 00e0 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 00f0 96 fc 77 57 01 00 ..wW.. Frame 5 (318 bytes on wire, 318 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.497814000 [Time delta from previous captured frame: 0.002476000 seconds] [Time delta from previous displayed frame: 0.002476000 seconds] [Time since reference or first frame: 0.003462000 seconds] Frame Number: 5 Frame Length: 318 bytes Capture Length: 318 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 304 Identification: 0x0fac (4012) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xeb36 [correct] [Good: True] [Bad : False] Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 284 Checksum: 0x24bc [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: D3E3CB2998D09863 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 276 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (RFC 3947) (20) Payload length: 68 Nonce Data NAT-D (RFC 3947) payload Next payload: NAT-D (RFC 3947) (20) Payload length: 24 Hash of address and port: 6A1BE7C0C034AC5CF0FAF7F7E4EC03F62E7780FF NAT-D (RFC 3947) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: 76306ECD6EEFB6F2D1BB54BC6A3FBDAE33F3AF6F 0000 00 0c 29 48 f8 2f 00 0c 29 93 b9 00 08 00 45 00 ..)H./..).....E. 0010 01 30 0f ac 00 00 80 11 eb 36 a5 e3 f9 96 a5 e3 .0.......6...... 0020 f9 7c 01 f4 01 f4 01 1c 24 bc 0e 94 ec 59 98 7c .|......$....Y.| 0030 30 bc d3 e3 cb 29 98 d0 98 63 04 10 02 00 00 00 0....)...c...... 0040 00 00 00 00 01 14 0a 00 00 84 99 9f 64 c7 a4 b2 ............d... 0050 2a f5 ac d2 7c 03 2d bc eb c2 c2 f9 73 12 d5 ef *...|.-.....s... 0060 85 90 77 4f 24 e3 ad 9d 95 63 30 3a 23 a7 ae 26 ..wO$....c0:#..& 0070 7d 0d 75 c8 0d c0 af 5c fc 41 e7 a8 66 72 92 e1 }.u....\.A..fr.. 0080 35 70 1e 6b d8 55 4f f2 cf ef 43 3e a8 a5 94 56 5p.k.UO...C>...V 0090 e5 d2 bf 29 39 86 96 89 24 ea 7b c9 e1 dd 10 46 ...)9...$.{....F 00a0 b9 2c d9 81 85 da e4 a6 f3 90 70 e2 84 3b 1e 1e .,........p..;.. 00b0 8c 8b bd 0b 1b 89 e7 27 1f 0f c9 c7 c9 33 81 00 .......'.....3.. 00c0 a0 18 1d 9b 56 d7 e9 99 86 b8 14 00 00 44 fa 31 ....V........D.1 00d0 eb a1 70 c0 2b ae c1 83 4c b0 28 3d fc 95 f3 e2 ..p.+...L.(=.... 00e0 48 35 71 bf 4b 1d a1 ab 70 35 62 1b 69 b2 44 38 H5q.K...p5b.i.D8 00f0 6a bb 73 fb 3f cf f1 7c a7 02 0d b2 d5 db 49 09 j.s.?..|......I. 0100 61 8e 64 05 8e 14 94 06 77 19 d7 c4 74 41 14 00 a.d.....w...tA.. 0110 00 18 6a 1b e7 c0 c0 34 ac 5c f0 fa f7 f7 e4 ec ..j....4.\...... 0120 03 f6 2e 77 80 ff 00 00 00 18 76 30 6e cd 6e ef ...w......v0n.n. 0130 b6 f2 d1 bb 54 bc 6a 3f bd ae 33 f3 af 6f ....T.j?..3..o Frame 6 (318 bytes on wire, 318 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.497824000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 0.003472000 seconds] Frame Number: 6 Frame Length: 318 bytes Capture Length: 318 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 304 Identification: 0x0fac (4012) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xeb36 [correct] [Good: True] [Bad : False] Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 284 Checksum: 0x24bc [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: D3E3CB2998D09863 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 276 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (RFC 3947) (20) Payload length: 68 Nonce Data NAT-D (RFC 3947) payload Next payload: NAT-D (RFC 3947) (20) Payload length: 24 Hash of address and port: 6A1BE7C0C034AC5CF0FAF7F7E4EC03F62E7780FF NAT-D (RFC 3947) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: 76306ECD6EEFB6F2D1BB54BC6A3FBDAE33F3AF6F 0000 00 0c 29 48 f8 2f 00 0c 29 93 b9 00 08 00 45 00 ..)H./..).....E. 0010 01 30 0f ac 00 00 80 11 eb 36 a5 e3 f9 96 a5 e3 .0.......6...... 0020 f9 7c 01 f4 01 f4 01 1c 24 bc 0e 94 ec 59 98 7c .|......$....Y.| 0030 30 bc d3 e3 cb 29 98 d0 98 63 04 10 02 00 00 00 0....)...c...... 0040 00 00 00 00 01 14 0a 00 00 84 99 9f 64 c7 a4 b2 ............d... 0050 2a f5 ac d2 7c 03 2d bc eb c2 c2 f9 73 12 d5 ef *...|.-.....s... 0060 85 90 77 4f 24 e3 ad 9d 95 63 30 3a 23 a7 ae 26 ..wO$....c0:#..& 0070 7d 0d 75 c8 0d c0 af 5c fc 41 e7 a8 66 72 92 e1 }.u....\.A..fr.. 0080 35 70 1e 6b d8 55 4f f2 cf ef 43 3e a8 a5 94 56 5p.k.UO...C>...V 0090 e5 d2 bf 29 39 86 96 89 24 ea 7b c9 e1 dd 10 46 ...)9...$.{....F 00a0 b9 2c d9 81 85 da e4 a6 f3 90 70 e2 84 3b 1e 1e .,........p..;.. 00b0 8c 8b bd 0b 1b 89 e7 27 1f 0f c9 c7 c9 33 81 00 .......'.....3.. 00c0 a0 18 1d 9b 56 d7 e9 99 86 b8 14 00 00 44 fa 31 ....V........D.1 00d0 eb a1 70 c0 2b ae c1 83 4c b0 28 3d fc 95 f3 e2 ..p.+...L.(=.... 00e0 48 35 71 bf 4b 1d a1 ab 70 35 62 1b 69 b2 44 38 H5q.K...p5b.i.D8 00f0 6a bb 73 fb 3f cf f1 7c a7 02 0d b2 d5 db 49 09 j.s.?..|......I. 0100 61 8e 64 05 8e 14 94 06 77 19 d7 c4 74 41 14 00 a.d.....w...tA.. 0110 00 18 6a 1b e7 c0 c0 34 ac 5c f0 fa f7 f7 e4 ec ..j....4.\...... 0120 03 f6 2e 77 80 ff 00 00 00 18 76 30 6e cd 6e ef ...w......v0n.n. 0130 b6 f2 d1 bb 54 bc 6a 3f bd ae 33 f3 af 6f ....T.j?..3..o Frame 7 (270 bytes on wire, 270 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.502451000 [Time delta from previous captured frame: 0.004627000 seconds] [Time delta from previous displayed frame: 0.004627000 seconds] [Time since reference or first frame: 0.008099000 seconds] Frame Number: 7 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Destination: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb12 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0xfdc9 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: D3E3CB2998D09863 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (RFC 3947) (20) Payload length: 20 Nonce Data NAT-D (RFC 3947) payload Next payload: NAT-D (RFC 3947) (20) Payload length: 24 Hash of address and port: 76306ECD6EEFB6F2D1BB54BC6A3FBDAE33F3AF6F NAT-D (RFC 3947) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: 6A1BE7C0C034AC5CF0FAF7F7E4EC03F62E7780FF 0000 00 0c 29 93 b9 00 00 0c 29 48 f8 2f 08 00 45 00 ..).....)H./..E. 0010 01 00 00 00 40 00 40 11 fb 12 a5 e3 f9 7c a5 e3 ....@.@......|.. 0020 f9 96 01 f4 01 f4 00 ec fd c9 0e 94 ec 59 98 7c .............Y.| 0030 30 bc d3 e3 cb 29 98 d0 98 63 04 10 02 00 00 00 0....)...c...... 0040 00 00 00 00 00 e4 0a 00 00 84 52 e3 ae cc b4 19 ..........R..... 0050 a7 d6 21 e3 94 f2 34 51 d6 cd bf 4e d3 6f 33 ff ..!...4Q...N.o3. 0060 11 a9 c2 9a 00 7a 1f 39 88 45 db c5 87 bd 28 94 .....z.9.E....(. 0070 33 57 ee 2e b8 7a 68 f2 b5 c0 3a 8e 63 05 dc b6 3W...zh...:.c... 0080 72 c8 b8 77 29 66 f4 a1 2e 6d 83 c7 10 b9 b7 06 r..w)f...m...... 0090 ee 0e 9a 52 30 4b 7b da 99 de 36 3e 1e e0 d8 15 ...R0K{...6>.... 00a0 90 fe de 21 4f 8f 8c 5b 35 88 eb eb 94 8c 5b 0b ...!O..[5.....[. 00b0 36 51 eb a6 fd 53 85 fd 66 04 d3 f7 0c 00 1d a5 6Q...S..f....... 00c0 ba 27 15 01 e8 fd 34 b9 e3 3b 14 00 00 14 8f 27 .'....4..;.....' 00d0 59 d2 9d 22 93 e6 bd 2b 4e d5 a8 21 4f 41 14 00 Y.."...+N..!OA.. 00e0 00 18 76 30 6e cd 6e ef b6 f2 d1 bb 54 bc 6a 3f ..v0n.n.....T.j? 00f0 bd ae 33 f3 af 6f 00 00 00 18 6a 1b e7 c0 c0 34 ..3..o....j....4 0100 ac 5c f0 fa f7 f7 e4 ec 03 f6 2e 77 80 ff .\.........w.. Frame 8 (270 bytes on wire, 270 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.502460000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 0.008108000 seconds] Frame Number: 8 Frame Length: 270 bytes Capture Length: 270 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Destination: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb12 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0xfdc9 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: D3E3CB2998D09863 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NAT-D (RFC 3947) (20) Payload length: 20 Nonce Data NAT-D (RFC 3947) payload Next payload: NAT-D (RFC 3947) (20) Payload length: 24 Hash of address and port: 76306ECD6EEFB6F2D1BB54BC6A3FBDAE33F3AF6F NAT-D (RFC 3947) payload Next payload: NONE (0) Payload length: 24 Hash of address and port: 6A1BE7C0C034AC5CF0FAF7F7E4EC03F62E7780FF 0000 00 0c 29 93 b9 00 00 0c 29 48 f8 2f 08 00 45 00 ..).....)H./..E. 0010 01 00 00 00 40 00 40 11 fb 12 a5 e3 f9 7c a5 e3 ....@.@......|.. 0020 f9 96 01 f4 01 f4 00 ec fd c9 0e 94 ec 59 98 7c .............Y.| 0030 30 bc d3 e3 cb 29 98 d0 98 63 04 10 02 00 00 00 0....)...c...... 0040 00 00 00 00 00 e4 0a 00 00 84 52 e3 ae cc b4 19 ..........R..... 0050 a7 d6 21 e3 94 f2 34 51 d6 cd bf 4e d3 6f 33 ff ..!...4Q...N.o3. 0060 11 a9 c2 9a 00 7a 1f 39 88 45 db c5 87 bd 28 94 .....z.9.E....(. 0070 33 57 ee 2e b8 7a 68 f2 b5 c0 3a 8e 63 05 dc b6 3W...zh...:.c... 0080 72 c8 b8 77 29 66 f4 a1 2e 6d 83 c7 10 b9 b7 06 r..w)f...m...... 0090 ee 0e 9a 52 30 4b 7b da 99 de 36 3e 1e e0 d8 15 ...R0K{...6>.... 00a0 90 fe de 21 4f 8f 8c 5b 35 88 eb eb 94 8c 5b 0b ...!O..[5.....[. 00b0 36 51 eb a6 fd 53 85 fd 66 04 d3 f7 0c 00 1d a5 6Q...S..f....... 00c0 ba 27 15 01 e8 fd 34 b9 e3 3b 14 00 00 14 8f 27 .'....4..;.....' 00d0 59 d2 9d 22 93 e6 bd 2b 4e d5 a8 21 4f 41 14 00 Y.."...+N..!OA.. 00e0 00 18 76 30 6e cd 6e ef b6 f2 d1 bb 54 bc 6a 3f ..v0n.n.....T.j? 00f0 bd ae 33 f3 af 6f 00 00 00 18 6a 1b e7 c0 c0 34 ..3..o....j....4 0100 ac 5c f0 fa f7 f7 e4 ec 03 f6 2e 77 80 ff .\.........w.. Frame 9 (150 bytes on wire, 150 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.504638000 [Time delta from previous captured frame: 0.002178000 seconds] [Time delta from previous displayed frame: 0.002178000 seconds] [Time since reference or first frame: 0.010286000 seconds] Frame Number: 9 Frame Length: 150 bytes Capture Length: 150 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x0fad (4013) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xebdd [correct] [Good: True] [Bad : False] Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 116 Checksum: 0x8916 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: D3E3CB2998D09863 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 108 Encrypted payload (80 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 93 b9 00 08 00 45 00 ..)H./..).....E. 0010 00 88 0f ad 00 00 80 11 eb dd a5 e3 f9 96 a5 e3 ................ 0020 f9 7c 01 f4 01 f4 00 74 89 16 0e 94 ec 59 98 7c .|.....t.....Y.| 0030 30 bc d3 e3 cb 29 98 d0 98 63 05 10 02 01 00 00 0....)...c...... 0040 00 00 00 00 00 6c 71 09 9b 85 68 44 87 04 22 b4 .....lq...hD..". 0050 2a 57 bd 04 00 4d b3 28 72 a6 19 78 df 5d ed 90 *W...M.(r..x.].. 0060 4a ae 34 a0 7b b1 4c 1f 63 52 f6 43 00 3a 75 94 J.4.{.L.cR.C.:u. 0070 ba e5 55 66 41 6a 6b 50 54 28 bb 57 3e d2 e9 53 ..UfAjkPT(.W>..S 0080 1e 33 20 98 c0 05 d2 45 a9 73 a6 06 d5 b1 98 cf .3 ....E.s...... 0090 98 00 86 e8 cb af ...... Frame 10 (150 bytes on wire, 150 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.504648000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 0.010296000 seconds] Frame Number: 10 Frame Length: 150 bytes Capture Length: 150 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x0fad (4013) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xebdd [correct] [Good: True] [Bad : False] Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 116 Checksum: 0x8916 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: D3E3CB2998D09863 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 108 Encrypted payload (80 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 93 b9 00 08 00 45 00 ..)H./..).....E. 0010 00 88 0f ad 00 00 80 11 eb dd a5 e3 f9 96 a5 e3 ................ 0020 f9 7c 01 f4 01 f4 00 74 89 16 0e 94 ec 59 98 7c .|.....t.....Y.| 0030 30 bc d3 e3 cb 29 98 d0 98 63 05 10 02 01 00 00 0....)...c...... 0040 00 00 00 00 00 6c 71 09 9b 85 68 44 87 04 22 b4 .....lq...hD..". 0050 2a 57 bd 04 00 4d b3 28 72 a6 19 78 df 5d ed 90 *W...M.(r..x.].. 0060 4a ae 34 a0 7b b1 4c 1f 63 52 f6 43 00 3a 75 94 J.4.{.L.cR.C.:u. 0070 ba e5 55 66 41 6a 6b 50 54 28 bb 57 3e d2 e9 53 ..UfAjkPT(.W>..S 0080 1e 33 20 98 c0 05 d2 45 a9 73 a6 06 d5 b1 98 cf .3 ....E.s...... 0090 98 00 86 e8 cb af ...... Frame 11 (118 bytes on wire, 118 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.505089000 [Time delta from previous captured frame: 0.000441000 seconds] [Time delta from previous displayed frame: 0.000441000 seconds] [Time since reference or first frame: 0.010737000 seconds] Frame Number: 11 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Destination: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbaa [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x31c4 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: D3E3CB2998D09863 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 93 b9 00 00 0c 29 48 f8 2f 08 00 45 00 ..).....)H./..E. 0010 00 68 00 00 40 00 40 11 fb aa a5 e3 f9 7c a5 e3 .h..@.@......|.. 0020 f9 96 01 f4 01 f4 00 54 31 c4 0e 94 ec 59 98 7c .......T1....Y.| 0030 30 bc d3 e3 cb 29 98 d0 98 63 05 10 02 01 00 00 0....)...c...... 0040 00 00 00 00 00 4c 17 d6 f8 27 17 cc 15 2b eb 0d .....L...'...+.. 0050 e9 96 07 99 62 b7 4a c4 84 24 70 59 71 19 4b 46 ....b.J..$pYq.KF 0060 39 0f 01 4f 55 51 06 66 d9 0d 4e 80 c7 76 db 2b 9..OUQ.f..N..v.+ 0070 7f 1b e4 db b3 2f ...../ Frame 12 (118 bytes on wire, 118 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.505098000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 0.010746000 seconds] Frame Number: 12 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Destination: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbaa [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x31c4 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: D3E3CB2998D09863 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 93 b9 00 00 0c 29 48 f8 2f 08 00 45 00 ..).....)H./..E. 0010 00 68 00 00 40 00 40 11 fb aa a5 e3 f9 7c a5 e3 .h..@.@......|.. 0020 f9 96 01 f4 01 f4 00 54 31 c4 0e 94 ec 59 98 7c .......T1....Y.| 0030 30 bc d3 e3 cb 29 98 d0 98 63 05 10 02 01 00 00 0....)...c...... 0040 00 00 00 00 00 4c 17 d6 f8 27 17 cc 15 2b eb 0d .....L...'...+.. 0050 e9 96 07 99 62 b7 4a c4 84 24 70 59 71 19 4b 46 ....b.J..$pYq.KF 0060 39 0f 01 4f 55 51 06 66 d9 0d 4e 80 c7 76 db 2b 9..OUQ.f..N..v.+ 0070 7f 1b e4 db b3 2f ...../ Frame 13 (390 bytes on wire, 390 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.507186000 [Time delta from previous captured frame: 0.002088000 seconds] [Time delta from previous displayed frame: 0.002088000 seconds] [Time since reference or first frame: 0.012834000 seconds] Frame Number: 13 Frame Length: 390 bytes Capture Length: 390 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 376 Identification: 0x0fae (4014) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xeaec [correct] [Good: True] [Bad : False] Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 356 Checksum: 0xc85a [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: D3E3CB2998D09863 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xc070a915 Length: 348 Encrypted payload (320 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 93 b9 00 08 00 45 00 ..)H./..).....E. 0010 01 78 0f ae 00 00 80 11 ea ec a5 e3 f9 96 a5 e3 .x.............. 0020 f9 7c 01 f4 01 f4 01 64 c8 5a 0e 94 ec 59 98 7c .|.....d.Z...Y.| 0030 30 bc d3 e3 cb 29 98 d0 98 63 08 10 20 01 c0 70 0....)...c.. ..p 0040 a9 15 00 00 01 5c 7f 61 41 5d 98 4c e9 fc 63 10 .....\.aA].L..c. 0050 8b 2a 2f 47 84 3c e3 4d 2a 1d fc a5 59 b4 75 3c .*/G.<.M*...Y.u< 0060 24 5e 1c d9 71 65 ad a4 7c 75 aa 83 60 ed 6c e7 $^..qe..|u..`.l. 0070 a3 ca c8 85 b9 80 a7 44 ff 15 06 ec eb 48 08 95 .......D.....H.. 0080 5f d7 bd b5 1d 02 38 bc 2e ff 24 88 97 3b 7e 7b _.....8...$..;~{ 0090 39 0a bf 22 8f 08 39 eb 22 b5 2c 2e 41 85 b3 de 9.."..9.".,.A... 00a0 46 e2 dd e6 b5 ff 81 5f d2 a7 a3 2c c1 56 6c 1e F......_...,.Vl. 00b0 2f 30 f4 ec f3 47 5d ea ff 63 ef b2 ee b7 9e a1 /0...G]..c...... 00c0 a3 fe 72 d4 2b 62 24 3d eb 65 3c 6c 97 82 d8 99 ..r.+b$=.e.. 0120 c3 c8 9c 4d 74 8a 87 7c 56 4e dc 2c aa 37 20 b6 ...Mt..|VN.,.7 . 0130 84 18 1d 1e 26 b1 ec e3 9f dd 0d 55 de b3 7d e3 ....&......U..}. 0140 92 d9 06 38 44 61 7b 36 24 61 5f 14 56 40 9e b7 ...8Da{6$a_.V@.. 0150 68 2e 35 3a b7 ce 78 80 3e 4a 19 58 05 f5 8a 8f h.5:..x.>J.X.... 0160 b6 a2 53 51 8d 16 21 7a cc 80 65 a2 39 1b 6d 38 ..SQ..!z..e.9.m8 0170 12 f5 80 51 c5 f1 b8 d4 b2 d2 5e c7 cd 50 28 6f ...Q......^..P(o 0180 db fc e6 3e 53 f2 ...>S. Frame 14 (390 bytes on wire, 390 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.507197000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 0.012845000 seconds] Frame Number: 14 Frame Length: 390 bytes Capture Length: 390 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 376 Identification: 0x0fae (4014) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xeaec [correct] [Good: True] [Bad : False] Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 356 Checksum: 0xc85a [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: D3E3CB2998D09863 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xc070a915 Length: 348 Encrypted payload (320 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 93 b9 00 08 00 45 00 ..)H./..).....E. 0010 01 78 0f ae 00 00 80 11 ea ec a5 e3 f9 96 a5 e3 .x.............. 0020 f9 7c 01 f4 01 f4 01 64 c8 5a 0e 94 ec 59 98 7c .|.....d.Z...Y.| 0030 30 bc d3 e3 cb 29 98 d0 98 63 08 10 20 01 c0 70 0....)...c.. ..p 0040 a9 15 00 00 01 5c 7f 61 41 5d 98 4c e9 fc 63 10 .....\.aA].L..c. 0050 8b 2a 2f 47 84 3c e3 4d 2a 1d fc a5 59 b4 75 3c .*/G.<.M*...Y.u< 0060 24 5e 1c d9 71 65 ad a4 7c 75 aa 83 60 ed 6c e7 $^..qe..|u..`.l. 0070 a3 ca c8 85 b9 80 a7 44 ff 15 06 ec eb 48 08 95 .......D.....H.. 0080 5f d7 bd b5 1d 02 38 bc 2e ff 24 88 97 3b 7e 7b _.....8...$..;~{ 0090 39 0a bf 22 8f 08 39 eb 22 b5 2c 2e 41 85 b3 de 9.."..9.".,.A... 00a0 46 e2 dd e6 b5 ff 81 5f d2 a7 a3 2c c1 56 6c 1e F......_...,.Vl. 00b0 2f 30 f4 ec f3 47 5d ea ff 63 ef b2 ee b7 9e a1 /0...G]..c...... 00c0 a3 fe 72 d4 2b 62 24 3d eb 65 3c 6c 97 82 d8 99 ..r.+b$=.e.. 0120 c3 c8 9c 4d 74 8a 87 7c 56 4e dc 2c aa 37 20 b6 ...Mt..|VN.,.7 . 0130 84 18 1d 1e 26 b1 ec e3 9f dd 0d 55 de b3 7d e3 ....&......U..}. 0140 92 d9 06 38 44 61 7b 36 24 61 5f 14 56 40 9e b7 ...8Da{6$a_.V@.. 0150 68 2e 35 3a b7 ce 78 80 3e 4a 19 58 05 f5 8a 8f h.5:..x.>J.X.... 0160 b6 a2 53 51 8d 16 21 7a cc 80 65 a2 39 1b 6d 38 ..SQ..!z..e.9.m8 0170 12 f5 80 51 c5 f1 b8 d4 b2 d2 5e c7 cd 50 28 6f ...Q......^..P(o 0180 db fc e6 3e 53 f2 ...>S. Frame 15 (342 bytes on wire, 342 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.509923000 [Time delta from previous captured frame: 0.002726000 seconds] [Time delta from previous displayed frame: 0.002726000 seconds] [Time since reference or first frame: 0.015571000 seconds] Frame Number: 15 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Destination: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaca [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x4e66 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: D3E3CB2998D09863 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xc070a915 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 93 b9 00 00 0c 29 48 f8 2f 08 00 45 00 ..).....)H./..E. 0010 01 48 00 00 40 00 40 11 fa ca a5 e3 f9 7c a5 e3 .H..@.@......|.. 0020 f9 96 01 f4 01 f4 01 34 4e 66 0e 94 ec 59 98 7c .......4Nf...Y.| 0030 30 bc d3 e3 cb 29 98 d0 98 63 08 10 20 01 c0 70 0....)...c.. ..p 0040 a9 15 00 00 01 2c 2b 3e 82 38 bc 7d b5 dd f4 c8 .....,+>.8.}.... 0050 74 b7 e1 76 9f eb 8d e6 66 e1 0b 44 7d b2 d9 71 t..v....f..D}..q 0060 36 d8 81 31 29 0d ad 91 93 43 1b c4 5b 5c eb a4 6..1)....C..[\.. 0070 fb d0 a8 43 90 71 aa 6a 44 52 98 63 c8 13 40 fe ...C.q.jDR.c..@. 0080 f4 a9 0f d8 72 a4 5f ae b9 84 78 00 ee cf 70 08 ....r._...x...p. 0090 3f b3 55 0d 10 d9 4a e7 a0 58 47 2d 3c ee 2c 34 ?.U...J..XG-<.,4 00a0 f8 d6 e6 c4 c8 c3 e7 75 d0 66 a6 ca 8b a8 20 22 .......u.f.... " 00b0 fb 7b 7d 55 5c f1 18 e5 54 19 13 1a 16 5c 35 0a .{}U\...T....\5. 00c0 f4 ca 45 c3 d1 fe 6a a2 db 24 c7 6a 46 95 87 03 ..E...j..$.jF... 00d0 c9 98 9a 83 81 59 aa 26 d3 91 9a 2b b4 a6 09 40 .....Y.&...+...@ 00e0 a3 ec fe 5a 46 37 ee 94 45 5e c8 0a e3 e3 0d d8 ...ZF7..E^...... 00f0 1f 95 0d f8 5b da b0 c1 73 b9 0d d3 7d ce d2 b5 ....[...s...}... 0100 84 0a 8d 1f cd 1a 24 38 f4 da 57 eb ac 0f bd 51 ......$8..W....Q 0110 95 40 18 8f eb a6 b4 18 4f 33 4d 29 55 4f 26 d2 .@......O3M)UO&. 0120 3f 8d df 3f ad 38 83 df 53 60 71 f4 0d 6e 6c 10 ?..?.8..S`q..nl. 0130 fc 65 66 47 0d 8a 63 48 78 ed fc d9 c3 8a d1 03 .efG..cHx....... 0140 fd 27 aa 81 83 22 4e 75 36 bd 96 81 ef 48 cc ce .'..."Nu6....H.. 0150 23 51 67 66 ff d6 #Qgf.. Frame 16 (342 bytes on wire, 342 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.509932000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 0.015580000 seconds] Frame Number: 16 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Destination: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaca [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x4e66 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: D3E3CB2998D09863 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xc070a915 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 93 b9 00 00 0c 29 48 f8 2f 08 00 45 00 ..).....)H./..E. 0010 01 48 00 00 40 00 40 11 fa ca a5 e3 f9 7c a5 e3 .H..@.@......|.. 0020 f9 96 01 f4 01 f4 01 34 4e 66 0e 94 ec 59 98 7c .......4Nf...Y.| 0030 30 bc d3 e3 cb 29 98 d0 98 63 08 10 20 01 c0 70 0....)...c.. ..p 0040 a9 15 00 00 01 2c 2b 3e 82 38 bc 7d b5 dd f4 c8 .....,+>.8.}.... 0050 74 b7 e1 76 9f eb 8d e6 66 e1 0b 44 7d b2 d9 71 t..v....f..D}..q 0060 36 d8 81 31 29 0d ad 91 93 43 1b c4 5b 5c eb a4 6..1)....C..[\.. 0070 fb d0 a8 43 90 71 aa 6a 44 52 98 63 c8 13 40 fe ...C.q.jDR.c..@. 0080 f4 a9 0f d8 72 a4 5f ae b9 84 78 00 ee cf 70 08 ....r._...x...p. 0090 3f b3 55 0d 10 d9 4a e7 a0 58 47 2d 3c ee 2c 34 ?.U...J..XG-<.,4 00a0 f8 d6 e6 c4 c8 c3 e7 75 d0 66 a6 ca 8b a8 20 22 .......u.f.... " 00b0 fb 7b 7d 55 5c f1 18 e5 54 19 13 1a 16 5c 35 0a .{}U\...T....\5. 00c0 f4 ca 45 c3 d1 fe 6a a2 db 24 c7 6a 46 95 87 03 ..E...j..$.jF... 00d0 c9 98 9a 83 81 59 aa 26 d3 91 9a 2b b4 a6 09 40 .....Y.&...+...@ 00e0 a3 ec fe 5a 46 37 ee 94 45 5e c8 0a e3 e3 0d d8 ...ZF7..E^...... 00f0 1f 95 0d f8 5b da b0 c1 73 b9 0d d3 7d ce d2 b5 ....[...s...}... 0100 84 0a 8d 1f cd 1a 24 38 f4 da 57 eb ac 0f bd 51 ......$8..W....Q 0110 95 40 18 8f eb a6 b4 18 4f 33 4d 29 55 4f 26 d2 .@......O3M)UO&. 0120 3f 8d df 3f ad 38 83 df 53 60 71 f4 0d 6e 6c 10 ?..?.8..S`q..nl. 0130 fc 65 66 47 0d 8a 63 48 78 ed fc d9 c3 8a d1 03 .efG..cHx....... 0140 fd 27 aa 81 83 22 4e 75 36 bd 96 81 ef 48 cc ce .'..."Nu6....H.. 0150 23 51 67 66 ff d6 #Qgf.. Frame 17 (102 bytes on wire, 102 bytes captured) Arrival Time: Oct 26, 2009 14:59:22.512839000 [Time delta from previous captured frame: 0.002907000 seconds] [Time delta from previous displayed frame: 0.002907000 seconds] [Time since reference or first frame: 0.018487000 seconds] Frame Number: 17 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0faf (4015) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xec0b [correct] [Good: True] [Bad : False] Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x9bb3 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0E94EC59987C30BC Responder cookie: D3E3CB2998D09863 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xc070a915 Length: 60 Encrypted payload (32 bytes) 0000 00 0c 29 48 f8 2f 00 0c 29 93 b9 00 08 00 45 00 ..)H./..).....E. 0010 00 58 0f af 00 00 80 11 ec 0b a5 e3 f9 96 a5 e3 .X.............. 0020 f9 7c 01 f4 01 f4 00 44 9b b3 0e 94 ec 59 98 7c .|.....D.....Y.| 0030 30 bc d3 e3 cb 29 98 d0 98 63 08 10 20 01 c0 70 0....)...c.. ..p 0040 a9 15 00 00 00 3c 4d 68 7e c7 6c 41 6a 47 13 78 .........M.. 0120 23 52 d5 3d ad d6 55 2c 21 ee 89 a5 8a 35 99 96 #R.=..U,!....5.. 0130 be 36 74 0a 00 de 8b 04 37 a7 a7 53 7a 9a 5c b3 .6t.....7..Sz.\. 0140 43 cf c9 c0 5a 13 30 03 66 2d f1 a8 f3 35 11 1c C...Z.0.f-...5.. 0150 24 d2 bb 3f bb ae a4 77 c2 18 7e cf 7a da bb f5 $..?...w..~.z... 0160 0b ce f7 28 05 7d f2 0f ce d4 ba 22 ce 2e db 90 ...(.}.....".... 0170 b9 c0 00 34 ef 01 8e 4d aa 21 7b f7 02 5e 01 84 ...4...M.!{..^.. 0180 74 8e 3a 96 eb 91 3c b2 dd ba ea f5 70 1a 58 df t.:...<.....p.X. 0190 1c f5 da 0b ee 5e .....^ Frame 20 (406 bytes on wire, 406 bytes captured) Arrival Time: Oct 26, 2009 14:59:28.628956000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 6.134604000 seconds] Frame Number: 20 Frame Length: 406 bytes Capture Length: 406 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 392 Identification: 0x0fb0 (4016) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xeab9 [correct] [Good: True] [Bad : False] Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0x4e7d0215 ESP Sequence: 1 0000 00 0c 29 48 f8 2f 00 0c 29 93 b9 00 08 00 45 00 ..)H./..).....E. 0010 01 88 0f b0 00 00 80 32 ea b9 a5 e3 f9 96 a5 e3 .......2........ 0020 f9 7c 4e 7d 02 15 00 00 00 01 21 10 2d 22 b4 c9 .|N}......!.-".. 0030 4c 64 ee 67 65 71 eb 47 4c bd 02 8a a0 82 cb 34 Ld.geq.GL......4 0040 bd 52 39 a9 a9 72 3d e3 ab bf 12 1a 5c f4 81 a4 .R9..r=.....\... 0050 54 6e 5a 28 c9 d2 bb d4 51 c1 ee bb 72 4c 67 47 TnZ(....Q...rLgG 0060 b4 2b 9a 99 a5 10 92 48 5c d0 b3 ca ce fe a7 ee .+.....H\....... 0070 b1 50 40 9b 89 ad 2f df b3 0f 78 db d9 78 fe 65 .P@.../...x..x.e 0080 18 5f 97 b1 de f9 48 01 31 e3 76 9a 8b cc 3c 73 ._....H.1.v.......M.. 0120 23 52 d5 3d ad d6 55 2c 21 ee 89 a5 8a 35 99 96 #R.=..U,!....5.. 0130 be 36 74 0a 00 de 8b 04 37 a7 a7 53 7a 9a 5c b3 .6t.....7..Sz.\. 0140 43 cf c9 c0 5a 13 30 03 66 2d f1 a8 f3 35 11 1c C...Z.0.f-...5.. 0150 24 d2 bb 3f bb ae a4 77 c2 18 7e cf 7a da bb f5 $..?...w..~.z... 0160 0b ce f7 28 05 7d f2 0f ce d4 ba 22 ce 2e db 90 ...(.}.....".... 0170 b9 c0 00 34 ef 01 8e 4d aa 21 7b f7 02 5e 01 84 ...4...M.!{..^.. 0180 74 8e 3a 96 eb 91 3c b2 dd ba ea f5 70 1a 58 df t.:...<.....p.X. 0190 1c f5 da 0b ee 5e .....^ Frame 21 (406 bytes on wire, 406 bytes captured) Arrival Time: Oct 26, 2009 14:59:28.631018000 [Time delta from previous captured frame: 0.002062000 seconds] [Time delta from previous displayed frame: 0.002062000 seconds] [Time since reference or first frame: 6.136666000 seconds] Frame Number: 21 Frame Length: 406 bytes Capture Length: 406 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Destination: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) Address: 00:0c:29:93:b9:00 (00:0c:29:93:b9:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 392 Identification: 0x001b (27) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8a4e [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload ESP SPI: 0xfc4a4000 ESP Sequence: 1 0000 00 0c 29 93 b9 00 00 0c 29 48 f8 2f 08 00 45 00 ..).....)H./..E. 0010 01 88 00 1b 00 00 f0 32 8a 4e a5 e3 f9 7c a5 e3 .......2.N...|.. 0020 f9 96 fc 4a 40 00 00 00 00 01 29 2b 43 64 5f d0 ...J@.....)+Cd_. 0030 97 ef 52 44 8f fd a8 31 97 89 ac de cf 02 10 66 ..RD...1.......f 0040 d7 c3 18 00 31 d6 fd d3 1e 68 c2 08 96 fc 68 c0 ....1....h....h. 0050 dc 2f df 8a c2 7a 64 a2 ba a2 82 cd f1 55 80 bb ./...zd......U.. 0060 e2 fe 85 2f b6 a1 be 5a 33 ba 60 57 04 0b 1f e5 .../...Z3.`W.... 0070 40 7c 7f 56 50 45 92 88 5a b6 4e 4e 8e c0 ae 28 @|.VPE..Z.NN...( 0080 d1 60 3c 12 15 d6 4b 19 e7 6e 38 c9 1e 2d 02 06 .`<...K..n8..-.. 0090 a6 e6 00 2d 5c c2 05 10 92 64 6e e5 6b 3e 8a 06 ...-\....dn.k>.. 00a0 ff 27 53 aa f4 4e cd b7 52 36 e1 21 85 17 d5 04 .'S..N..R6.!.... 00b0 a4 cc 56 69 26 c4 b8 bf a0 ab 27 f2 d9 a5 15 73 ..Vi&.....'....s 00c0 c9 91 a3 5b 83 50 a8 a6 03 b1 3c c1 53 a9 2f d3 ...[.P....<.S./. 00d0 0b 73 9a f8 b1 ef 63 0e 3c 57 46 61 ce 68 87 8f .s....c... 00a0 ff 27 53 aa f4 4e cd b7 52 36 e1 21 85 17 d5 04 .'S..N..R6.!.... 00b0 a4 cc 56 69 26 c4 b8 bf a0 ab 27 f2 d9 a5 15 73 ..Vi&.....'....s 00c0 c9 91 a3 5b 83 50 a8 a6 03 b1 3c c1 53 a9 2f d3 ...[.P....<.S./. 00d0 0b 73 9a f8 b1 ef 63 0e 3c 57 46 61 ce 68 87 8f .s....c.