Frame 1 (226 bytes on wire, 226 bytes captured) Arrival Time: Aug 29, 2006 14:29:00.620715000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x0294 (660) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf893 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0xa0aa [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0F319796006A0DF6 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 13 c4 80 d3 aa 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 d4 02 94 00 00 80 11 f8 93 a5 e3 f9 96 a5 e3 ................ 0020 f9 93 01 f4 01 f4 00 c0 a0 aa 0f 31 97 96 00 6a ...........1...j 0030 0d f6 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 b8 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0090 45 2f 0d 00 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 E/....}...S..o,. 00a0 9d 92 15 52 9d 56 0d 00 00 14 90 cb 80 91 3e bb ...R.V........>. 00b0 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 in.c...B{.....D. 00c0 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 00 00 .-.......F.y.... 00d0 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00e0 01 00 .. Frame 2 (150 bytes on wire, 150 bytes captured) Arrival Time: Aug 29, 2006 14:29:00.621958000 Time delta from previous packet: 0.001243000 seconds Time since reference or first frame: 0.001243000 seconds Frame Number: 2 Packet Length: 150 bytes Capture Length: 150 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x53c8 (21448) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x28ab [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 116 Checksum: 0x5094 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0F319796006A0DF6 Responder cookie: 0x2A4D308856932935 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 108 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 24 Vendor ID: Microsoft L2TP/IPSec VPN Client 0000 00 0c 29 96 e1 fa 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 88 53 c8 00 00 ff 11 28 ab a5 e3 f9 93 a5 e3 ..S.....(....... 0020 f9 96 01 f4 01 f4 00 74 50 94 0f 31 97 96 00 6a .......tP..1...j 0030 0d f6 2a 4d 30 88 56 93 29 35 01 10 02 00 00 00 ..*M0.V.)5...... 0040 00 00 00 00 00 6c 0d 00 00 38 00 00 00 01 00 00 .....l...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 70 80 00 00 ............p... 0080 00 18 40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 ..@H..n...%..... 0090 c2 d3 c0 00 00 00 ...... Frame 3 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 29, 2006 14:29:00.664165000 Time delta from previous packet: 0.042207000 seconds Time since reference or first frame: 0.043450000 seconds Frame Number: 3 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0295 (661) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf896 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xb88d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0F319796006A0DF6 Responder cookie: 0x2A4D308856932935 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 13 c4 80 d3 aa 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 d0 02 95 00 00 80 11 f8 96 a5 e3 f9 96 a5 e3 ................ 0020 f9 93 01 f4 01 f4 00 bc b8 8d 0f 31 97 96 00 6a ...........1...j 0030 0d f6 2a 4d 30 88 56 93 29 35 04 10 02 00 00 00 ..*M0.V.)5...... 0040 00 00 00 00 00 b4 0a 00 00 84 d1 38 98 c8 e0 d2 ...........8.... 0050 60 c3 f0 13 f4 b8 07 9c f7 4a 93 a0 3e 9a d9 bf `........J..>... 0060 80 4a d4 47 1f 5d 17 6f 75 09 f7 32 3b 6f aa 60 .J.G.].ou..2;o.` 0070 2e ec a4 54 4d 27 05 81 d3 f5 81 d3 1e 02 bd 2c ...TM'........., 0080 07 ed b4 e3 cf 34 02 1c 39 4e 7f f1 8e b7 6c c4 .....4..9N....l. 0090 62 9a 62 b5 4a 48 16 da bb f1 c0 bd 1d 97 ca c2 b.b.JH.......... 00a0 a9 ae 26 92 bf b2 c4 2c 2b 87 53 7a cd ff b3 05 ..&....,+.Sz.... 00b0 7e a6 b9 a7 7d a2 5b 68 55 97 c4 71 63 11 5b f3 ~...}.[hU..qc.[. 00c0 09 97 04 cd 50 a8 93 12 65 25 00 00 00 14 d8 c0 ....P...e%...... 00d0 8f 72 e5 ff 5b f7 bb bd e6 ae 4d c9 f3 ce .r..[.....M... Frame 4 (298 bytes on wire, 298 bytes captured) Arrival Time: Aug 29, 2006 14:29:00.673039000 Time delta from previous packet: 0.008874000 seconds Time since reference or first frame: 0.052324000 seconds Frame Number: 4 Packet Length: 298 bytes Capture Length: 298 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x2700 (9984) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x54df [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xd8fa [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0F319796006A0DF6 Responder cookie: 0x2A4D308856932935 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x12F5F28C457168A9702D9FE274CC0100 Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0xDF8A979556922935F90BCC448AF48E37 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x1F07F70EAA6514D3B0FA96542A500100 0000 00 0c 29 96 e1 fa 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 01 1c 27 00 00 00 ff 11 54 df a5 e3 f9 93 a5 e3 ..'.....T....... 0020 f9 96 01 f4 01 f4 01 08 d8 fa 0f 31 97 96 00 6a ...........1...j 0030 0d f6 2a 4d 30 88 56 93 29 35 04 10 02 00 00 00 ..*M0.V.)5...... 0040 00 00 00 00 01 00 0a 00 00 84 ee 25 21 a4 54 14 ...........%!.T. 0050 46 68 f8 29 3a d9 36 59 3e ca ac 27 b5 85 a7 17 Fh.):.6Y>..'.... 0060 ad fa de 13 2c 26 44 51 19 59 f9 56 26 64 50 58 ....,&DQ.Y.V&dPX 0070 02 ec 6e 0f 14 bc 5b 0d 3e f6 97 43 e4 43 d7 a7 ..n...[.>..C.C.. 0080 93 67 ea 40 ac 7e c3 46 90 4e 4c 4d 70 4b dd 79 .g.@.~.F.NLMpK.y 0090 cb 6d c5 fa d4 b6 cc 10 f9 73 c1 36 47 eb 6b 6d .m.......s.6G.km 00a0 a4 c5 16 f0 fe 2a 87 e6 8f 8c 7d 3f 0c ec 6b d0 .....*....}?..k. 00b0 4f d0 67 64 26 42 c4 07 48 fb 21 47 dd 92 78 8e O.gd&B..H.!G..x. 00c0 77 07 5e 16 b6 ba 20 5d f3 52 0d 00 00 18 63 4c w.^... ].R....cL 00d0 eb 54 a1 eb ab 06 d1 bb c7 37 f5 b9 ac 9f d3 0c .T.......7...... 00e0 70 56 0d 00 00 14 12 f5 f2 8c 45 71 68 a9 70 2d pV........Eqh.p- 00f0 9f e2 74 cc 01 00 0d 00 00 0c 09 00 26 89 df d6 ..t.........&... 0100 b7 12 0d 00 00 14 df 8a 97 95 56 92 29 35 f9 0b ..........V.)5.. 0110 cc 44 8a f4 8e 37 00 00 00 14 1f 07 f7 0e aa 65 .D...7.........e 0120 14 d3 b0 fa 96 54 2a 50 01 00 .....T*P.. Frame 5 (150 bytes on wire, 150 bytes captured) Arrival Time: Aug 29, 2006 14:29:00.681923000 Time delta from previous packet: 0.008884000 seconds Time since reference or first frame: 0.061208000 seconds Frame Number: 5 Packet Length: 150 bytes Capture Length: 150 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x0296 (662) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8dd [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 116 Checksum: 0x7f3c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0F319796006A0DF6 Responder cookie: 0x2A4D308856932935 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 108 Encrypted payload (80 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 88 02 96 00 00 80 11 f8 dd a5 e3 f9 96 a5 e3 ................ 0020 f9 93 01 f4 01 f4 00 74 7f 3c 0f 31 97 96 00 6a .......t.<.1...j 0030 0d f6 2a 4d 30 88 56 93 29 35 05 10 02 01 00 00 ..*M0.V.)5...... 0040 00 00 00 00 00 6c 1b 2b a3 17 ab ea 99 61 2b e0 .....l.+.....a+. 0050 fc 0d e3 d5 b4 51 1e bc 31 ef a8 b1 92 a2 69 bf .....Q..1.....i. 0060 8d 0a 4f 50 31 2a 57 1c 5e 9f f4 82 cd 8c 2c 74 ..OP1*W.^.....,t 0070 36 91 07 63 a4 1f 7b b0 cb 56 1f bb a3 79 84 06 6..c..{..V...y.. 0080 ba 15 85 57 54 b9 2a 25 55 ac 6d fc d1 b1 9c fa ...WT.*%U.m..... 0090 c3 c0 19 36 fc 96 ...6.. Frame 6 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 29, 2006 14:29:00.690825000 Time delta from previous packet: 0.008902000 seconds Time since reference or first frame: 0.070110000 seconds Frame Number: 6 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x4ec7 (20167) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x2dbc [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x072c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0F319796006A0DF6 Responder cookie: 0x2A4D308856932935 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 96 e1 fa 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 78 4e c7 00 00 ff 11 2d bc a5 e3 f9 93 a5 e3 .xN.....-....... 0020 f9 96 01 f4 01 f4 00 64 07 2c 0f 31 97 96 00 6a .......d.,.1...j 0030 0d f6 2a 4d 30 88 56 93 29 35 05 10 02 01 00 00 ..*M0.V.)5...... 0040 00 00 00 00 00 5c 83 82 24 f4 db 1f 52 86 99 ce .....\..$...R... 0050 23 80 eb 54 c8 4d 7a 66 eb 08 b8 06 8a 67 d3 9e #..T.Mzf.....g.. 0060 7c d3 6b d9 a3 d9 aa 64 f2 c9 43 d4 be 48 97 c7 |.k....d..C..H.. 0070 b9 c2 93 bc 9d 3f 2a 37 db ff ce 48 7e 34 40 1b .....?*7...H~4@. 0080 43 89 69 dd 6c d4 C.i.l. Frame 7 (342 bytes on wire, 342 bytes captured) Arrival Time: Aug 29, 2006 14:29:00.734286000 Time delta from previous packet: 0.043461000 seconds Time since reference or first frame: 0.113571000 seconds Frame Number: 7 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0297 (663) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf81c [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x1b3c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0F319796006A0DF6 Responder cookie: 0x2A4D308856932935 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x44F60666 Length: 300 Encrypted payload (272 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 01 48 02 97 00 00 80 11 f8 1c a5 e3 f9 96 a5 e3 .H.............. 0020 f9 93 01 f4 01 f4 01 34 1b 3c 0f 31 97 96 00 6a .......4.<.1...j 0030 0d f6 2a 4d 30 88 56 93 29 35 08 10 20 01 44 f6 ..*M0.V.)5.. .D. 0040 06 66 00 00 01 2c 55 0d dc ec 98 ab 74 65 83 d6 .f...,U.....te.. 0050 6c 7d cf e3 30 31 7b bc ca 24 ed 65 ef 9f 5f c1 l}..01{..$.e.._. 0060 a2 8a a5 2a 35 aa fb 75 94 01 86 f7 6e 8e c6 bf ...*5..u....n... 0070 1a 58 c5 73 4a 4d f9 67 aa 16 8b 1d 7a 28 20 82 .X.sJM.g....z( . 0080 24 ae ce f1 4e b0 b4 81 4d 18 3d e0 0d b2 ce 87 $...N...M.=..... 0090 55 2f e9 9d af 40 3b 49 39 08 9c 99 23 3e a8 c1 U/...@;I9...#>.. 00a0 cd 3c 1f d4 53 ff c6 4a b4 d0 9b 2b 65 93 9f 64 .<..S..J...+e..d 00b0 37 3b 83 1c 79 02 a5 96 18 17 03 ae c1 34 29 59 7;..y........4)Y 00c0 de 4e 67 90 dd f8 bc a3 9e 69 ae 7f 61 9f 65 26 .Ng......i..a.e& 00d0 d8 18 87 3a 0c 6b 14 30 82 3e f3 b6 d6 db 5b 24 ...:.k.0.>....[$ 00e0 ab c1 e0 86 0b 4c b5 8f 9f c4 d1 42 97 6e dc 38 .....L.....B.n.8 00f0 88 00 48 31 26 a7 1f 04 19 f6 84 6c 1c ec b9 95 ..H1&......l.... 0100 de b0 3f 3e 55 e4 b5 13 95 28 b4 50 ab 02 aa 68 ..?>U....(.P...h 0110 65 d1 11 d9 c0 67 a6 a0 bd 8a 52 7f ba 50 d2 c5 e....g....R..P.. 0120 a0 56 7d da 77 66 74 48 98 c6 05 61 0e c1 3c 21 .V}.wftH...a........ 0140 75 74 cf 5a b9 df bd a2 3f 2f e6 31 fd 13 b6 68 ut.Z....?/.1...h 0150 b9 a8 24 5e 09 69 ..$^.i Frame 8 (342 bytes on wire, 342 bytes captured) Arrival Time: Aug 29, 2006 14:29:00.734288000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.113573000 seconds Frame Number: 8 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x71cc (29132) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x09e7 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xc534 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0F319796006A0DF6 Responder cookie: 0x2A4D308856932935 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x44F60666 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 96 e1 fa 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 01 48 71 cc 00 00 ff 11 09 e7 a5 e3 f9 93 a5 e3 .Hq............. 0020 f9 96 01 f4 01 f4 01 34 c5 34 0f 31 97 96 00 6a .......4.4.1...j 0030 0d f6 2a 4d 30 88 56 93 29 35 08 10 20 01 44 f6 ..*M0.V.)5.. .D. 0040 06 66 00 00 01 2c 1b 03 a0 5c 96 47 3a fa c0 5a .f...,...\.G:..Z 0050 a9 17 ac 84 8d 9c 38 58 f4 b1 7f 46 95 d9 7c 48 ......8X...F..|H 0060 56 69 27 46 0c 91 5a 85 44 ba bd bd 4c df ad 66 Vi'F..Z.D...L..f 0070 f0 82 58 13 98 11 0f d1 a6 f2 94 6f 0f 35 f0 12 ..X........o.5.. 0080 f1 03 40 9a af 4d 25 b5 7c 0a 48 d4 03 53 fc c3 ..@..M%.|.H..S.. 0090 62 48 19 90 f8 e4 b2 d8 38 86 f7 90 c1 ab 0f fe bH......8....... 00a0 44 51 74 c0 c8 a7 1a 84 89 f1 10 61 23 64 01 86 DQt........a#d.. 00b0 40 7f 38 63 0e d9 3b 74 55 da b0 72 53 0f d1 a9 @.8c..;tU..rS... 00c0 70 47 7f b9 d5 a8 78 6c 87 6a 5f dd 18 c4 34 e3 pG....xl.j_...4. 00d0 18 fa 12 af 16 48 dc 0c 4e ef 24 12 8f 7f 62 ae .....H..N.$...b. 00e0 25 1a 16 b0 f7 ce 69 71 84 a6 13 38 d7 cb 46 cc %.....iq...8..F. 00f0 f2 12 39 81 60 ae 2c 77 dd a2 a4 ae 97 23 ed d7 ..9.`.,w.....#.. 0100 a3 17 4e 24 3b 67 dd f7 51 1d c7 7d a7 5a bc 13 ..N$;g..Q..}.Z.. 0110 96 cb d8 7b e6 09 74 53 52 f6 88 6c 7f f7 fe 16 ...{..tSR..l.... 0120 e9 0f e5 55 f4 5b 48 e8 2c d5 50 30 1e 12 d9 77 ...U.[H.,.P0...w 0130 6c 84 01 fb 52 04 6f 32 bd 42 73 d6 97 36 4c c4 l...R.o2.Bs..6L. 0140 f4 71 47 ea 34 0f 94 c1 6b fe 52 32 39 c0 26 7d .qG.4...k.R29.&} 0150 12 13 82 88 86 7b .....{ Frame 9 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 29, 2006 14:29:00.818342000 Time delta from previous packet: 0.084054000 seconds Time since reference or first frame: 0.197627000 seconds Frame Number: 9 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0298 (664) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf90b [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x97a0 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0F319796006A0DF6 Responder cookie: 0x2A4D308856932935 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x44F60666 Length: 60 Encrypted payload (32 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 58 02 98 00 00 80 11 f9 0b a5 e3 f9 96 a5 e3 .X.............. 0020 f9 93 01 f4 01 f4 00 44 97 a0 0f 31 97 96 00 6a .......D...1...j 0030 0d f6 2a 4d 30 88 56 93 29 35 08 10 20 01 44 f6 ..*M0.V.)5.. .D. 0040 06 66 00 00 00 3c 55 c6 04 0c 62 36 2e dd 90 85 .f...DsRI.'. 0040 2b bb a9 30 bd 47 75 8d 0f 17 59 4f fb 6d b4 e0 +..0.Gu...YO.m.. 0050 5f af fe aa 7d eb 3c 73 e4 46 e9 72 45 6e 57 93 _...}.....(...,.s. 00d0 e9 f1 b8 2c 42 ad 3b 46 95 8d 67 73 75 95 ea 06 ...,B.;F..gsu... 00e0 0e 79 24 34 0f 1e 31 5a 2b dc 56 d8 64 fc c7 a5 .y$4..1Z+.V.d... 00f0 f3 dd be b6 bf de 0d 2f 13 cc 0b 7b c2 47 2a 04 ......./...{.G*. 0100 e8 70 a6 3f 92 c1 b2 af a4 be b0 97 29 b6 9c 93 .p.?........)... 0110 c3 b6 1b 57 ab 5c 79 02 2e d0 f3 e9 d6 11 ff 46 ...W.\y........F 0120 3c 3b e9 ce da b4 a4 ec cf 65 e0 f8 be 24 79 af <;.......e...$y. 0130 1a 04 d0 87 5e 7c 70 76 3b f8 67 12 ae 37 80 eb ....^|pv;.g..7.. 0140 c5 60 58 e0 48 18 b4 7d 35 43 b5 f6 60 8e dd db .`X.H..}5C..`... 0150 3a 54 13 11 6d ed e3 f4 e3 ad 9f 30 df 38 da 60 :T..m......0.8.` 0160 64 e1 40 16 7b 2d 68 3b ba 72 44 b5 05 bf a0 05 d.@.{-h;.rD..... 0170 5a f5 5f 2e a8 d8 2e c3 b5 4e 4a df 4f 53 4c 51 Z._......NJ.OSLQ 0180 db eb 90 84 86 98 a6 e5 e3 3c 7f d0 64 78 a5 cb .........<..dx.. 0190 5d 7a 47 9e 90 96 ]zG...