Frame 1 (162 bytes on wire, 162 bytes captured) Arrival Time: Feb 2, 2011 15:23:21.205420000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 162 bytes Capture Length: 162 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:23:f8:10:29:12 (00:23:f8:10:29:12), Dst: 00:00:00:00:00:19 (00:00:00:00:00:19) Destination: 00:00:00:00:00:19 (00:00:00:00:00:19) Address: 00:00:00:00:00:19 (00:00:00:00:00:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.156 (165.227.249.156), Dst: 165.227.249.155 (165.227.249.155) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 148 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb59 [correct] [Good: True] [Bad : False] Source: 165.227.249.156 (165.227.249.156) Destination: 165.227.249.155 (165.227.249.155) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 128 Checksum: 0x366a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: DDE3BE46B8BA53C0 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 120 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 44 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 0 Next payload: NONE (0) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Encryption-Algorithm (1): AES-CBC (7) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Key-Length (14): Key-Length (128) Vendor ID: 4F457E717F6B5A4E727D576B Next payload: Vendor ID (13) Payload length: 16 Vendor ID: 4F457E717F6B5A4E727D576B Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 00 00 00 00 19 00 23 f8 10 29 12 08 00 45 00 .......#..)...E. 0010 00 94 00 00 40 00 40 11 fb 59 a5 e3 f9 9c a5 e3 ....@.@..Y...... 0020 f9 9b 01 f4 01 f4 00 80 36 6a dd e3 be 46 b8 ba ........6j...F.. 0030 53 c0 00 00 00 00 00 00 00 00 01 10 02 00 00 00 S............... 0040 00 00 00 00 00 78 0d 00 00 38 00 00 00 01 00 00 .....x...8...... 0050 00 01 00 00 00 2c 00 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 0b 00 01 80 0c 70 80 80 01 00 07 80 02 ........p....... 0070 00 02 80 03 00 01 80 04 00 02 80 0e 00 80 0d 00 ................ 0080 00 10 4f 45 7e 71 7f 6b 5a 4e 72 7d 57 6b 00 00 ..OE~q.kZNr}Wk.. 0090 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00a0 01 00 .. Frame 2 (166 bytes on wire, 166 bytes captured) Arrival Time: Feb 2, 2011 15:23:21.266707000 [Time delta from previous captured frame: 0.061287000 seconds] [Time delta from previous displayed frame: 0.061287000 seconds] [Time since reference or first frame: 0.061287000 seconds] Frame Number: 2 Frame Length: 166 bytes Capture Length: 166 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:00:00:00:00:19 (00:00:00:00:00:19), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:00:00:00:00:19 (00:00:00:00:00:19) Address: 00:00:00:00:00:19 (00:00:00:00:00:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.155 (165.227.249.155), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb55 [correct] [Good: True] [Bad : False] Source: 165.227.249.155 (165.227.249.155) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0xf383 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: DDE3BE46B8BA53C0 Responder cookie: 1C4E5D2632B814C8 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 44 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 0 Next payload: NONE (0) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Encryption-Algorithm (1): AES-CBC (7) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Key-Length (14): Key-Length (128) Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 23 f8 10 29 12 00 00 00 00 00 19 08 00 45 00 .#..).........E. 0010 00 98 00 00 40 00 40 11 fb 55 a5 e3 f9 9b a5 e3 ....@.@..U...... 0020 f9 9c 01 f4 01 f4 00 84 f3 83 dd e3 be 46 b8 ba .............F.. 0030 53 c0 1c 4e 5d 26 32 b8 14 c8 01 10 02 00 00 00 S..N]&2......... 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 00 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 0b 00 01 80 0c 70 80 80 01 00 07 80 02 ........p....... 0070 00 02 80 03 00 01 80 04 00 02 80 0e 00 80 0d 00 ................ 0080 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 0090 01 00 00 00 00 14 70 03 cb c1 09 7d be 9c 26 00 ......p....}..&. 00a0 ba 69 83 bc 8b 35 .i...5 Frame 3 (222 bytes on wire, 222 bytes captured) Arrival Time: Feb 2, 2011 15:23:21.299810000 [Time delta from previous captured frame: 0.033103000 seconds] [Time delta from previous displayed frame: 0.033103000 seconds] [Time since reference or first frame: 0.094390000 seconds] Frame Number: 3 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:23:f8:10:29:12 (00:23:f8:10:29:12), Dst: 00:00:00:00:00:19 (00:00:00:00:00:19) Destination: 00:00:00:00:00:19 (00:00:00:00:00:19) Address: 00:00:00:00:00:19 (00:00:00:00:00:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.156 (165.227.249.156), Dst: 165.227.249.155 (165.227.249.155) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb1d [correct] [Good: True] [Bad : False] Source: 165.227.249.156 (165.227.249.156) Destination: 165.227.249.155 (165.227.249.155) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x16f7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: DDE3BE46B8BA53C0 Responder cookie: 1C4E5D2632B814C8 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 00 00 00 00 19 00 23 f8 10 29 12 08 00 45 00 .......#..)...E. 0010 00 d0 00 00 40 00 40 11 fb 1d a5 e3 f9 9c a5 e3 ....@.@......... 0020 f9 9b 01 f4 01 f4 00 bc 16 f7 dd e3 be 46 b8 ba .............F.. 0030 53 c0 1c 4e 5d 26 32 b8 14 c8 04 10 02 00 00 00 S..N]&2......... 0040 00 00 00 00 00 b4 0a 00 00 84 e8 a3 75 43 a8 df ............uC.. 0050 4e 5d 70 81 94 a7 6b 5c 45 e1 c6 b1 43 da b2 50 N]p...k\E...C..P 0060 f4 6f 92 74 f2 cd d5 5d 09 3d 0e cb 2d f6 02 31 .o.t...].=..-..1 0070 38 6e cc de ba 48 2f cb b4 71 16 cd ad b1 19 4d 8n...H/..q.....M 0080 2d 78 6d 9c 27 53 39 b6 76 b6 80 35 dc ed f8 ad -xm.'S9.v..5.... 0090 ec 15 18 c4 99 fe 6d ea 49 df 55 9a e9 83 3f ce ......m.I.U...?. 00a0 42 3f e6 a8 2e f9 85 6d 17 33 1c 62 cc f1 61 94 B?.....m.3.b..a. 00b0 40 42 e5 55 d9 5a 42 44 4d 64 fa 09 19 c4 b1 0b @B.U.ZBDMd...... 00c0 da a8 e8 21 a3 bb 2f 19 bf e0 00 00 00 14 03 76 ...!../........v 00d0 ed 43 fc 66 e6 7a 09 55 94 8c 0a d4 45 75 .C.f.z.U....Eu Frame 4 (242 bytes on wire, 242 bytes captured) Arrival Time: Feb 2, 2011 15:23:21.460735000 [Time delta from previous captured frame: 0.160925000 seconds] [Time delta from previous displayed frame: 0.160925000 seconds] [Time since reference or first frame: 0.255315000 seconds] Frame Number: 4 Frame Length: 242 bytes Capture Length: 242 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:00:00:00:00:19 (00:00:00:00:00:19), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:00:00:00:00:19 (00:00:00:00:00:19) Address: 00:00:00:00:00:19 (00:00:00:00:00:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.155 (165.227.249.155), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb09 [correct] [Good: True] [Bad : False] Source: 165.227.249.155 (165.227.249.155) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0xfa8a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: DDE3BE46B8BA53C0 Responder cookie: 1C4E5D2632B814C8 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 20 Nonce Data Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 23 f8 10 29 12 00 00 00 00 00 19 08 00 45 00 .#..).........E. 0010 00 e4 00 00 40 00 40 11 fb 09 a5 e3 f9 9b a5 e3 ....@.@......... 0020 f9 9c 01 f4 01 f4 00 d0 fa 8a dd e3 be 46 b8 ba .............F.. 0030 53 c0 1c 4e 5d 26 32 b8 14 c8 04 10 02 00 00 00 S..N]&2......... 0040 00 00 00 00 00 c8 0a 00 00 84 fe 73 1b 1b 15 b2 ...........s.... 0050 49 2f a7 a8 07 2e 17 2d fc a1 5b 83 80 8e b4 ee I/.....-..[..... 0060 f3 14 8b b1 44 b7 52 f0 97 35 3c 44 ec 7c c3 b2 ....D.R..5Kxx.bm 00b0 91 49 d8 23 5e c2 58 fc 9d 26 55 01 55 6d 43 7d .I.#^.X..&U.UmC} 00c0 61 67 95 83 f1 f7 36 9c 54 e2 0d 00 00 14 ff 18 ag....6.T....... 00d0 bb d4 31 60 24 c8 b1 e6 6c 22 83 f3 29 52 00 00 ..1`$...l"..)R.. 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 5 (118 bytes on wire, 118 bytes captured) Arrival Time: Feb 2, 2011 15:23:21.488165000 [Time delta from previous captured frame: 0.027430000 seconds] [Time delta from previous displayed frame: 0.027430000 seconds] [Time since reference or first frame: 0.282745000 seconds] Frame Number: 5 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:23:f8:10:29:12 (00:23:f8:10:29:12), Dst: 00:00:00:00:00:19 (00:00:00:00:00:19) Destination: 00:00:00:00:00:19 (00:00:00:00:00:19) Address: 00:00:00:00:00:19 (00:00:00:00:00:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.156 (165.227.249.156), Dst: 165.227.249.155 (165.227.249.155) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb85 [correct] [Good: True] [Bad : False] Source: 165.227.249.156 (165.227.249.156) Destination: 165.227.249.155 (165.227.249.155) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xdcab [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: DDE3BE46B8BA53C0 Responder cookie: 1C4E5D2632B814C8 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 00 00 00 00 19 00 23 f8 10 29 12 08 00 45 00 .......#..)...E. 0010 00 68 00 00 40 00 40 11 fb 85 a5 e3 f9 9c a5 e3 .h..@.@......... 0020 f9 9b 01 f4 01 f4 00 54 dc ab dd e3 be 46 b8 ba .......T.....F.. 0030 53 c0 1c 4e 5d 26 32 b8 14 c8 05 10 02 01 00 00 S..N]&2......... 0040 00 00 00 00 00 4c 13 1f 2f 8e 28 88 d6 39 c6 48 .....L../.(..9.H 0050 5b 9b 75 fb ce ba 00 6c ec 0b e2 60 37 e5 80 e0 [.u....l...`7... 0060 ba 21 65 d5 b0 7b 85 76 1e 19 8f 0f 25 2d 32 14 .!e..{.v....%-2. 0070 98 bf 95 66 b6 99 ...f.. Frame 6 (118 bytes on wire, 118 bytes captured) Arrival Time: Feb 2, 2011 15:23:21.689995000 [Time delta from previous captured frame: 0.201830000 seconds] [Time delta from previous displayed frame: 0.201830000 seconds] [Time since reference or first frame: 0.484575000 seconds] Frame Number: 6 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:00:00:00:00:19 (00:00:00:00:00:19), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:00:00:00:00:19 (00:00:00:00:00:19) Address: 00:00:00:00:00:19 (00:00:00:00:00:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.155 (165.227.249.155), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb85 [correct] [Good: True] [Bad : False] Source: 165.227.249.155 (165.227.249.155) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xaa53 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: DDE3BE46B8BA53C0 Responder cookie: 1C4E5D2632B814C8 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 23 f8 10 29 12 00 00 00 00 00 19 08 00 45 00 .#..).........E. 0010 00 68 00 00 40 00 40 11 fb 85 a5 e3 f9 9b a5 e3 .h..@.@......... 0020 f9 9c 01 f4 01 f4 00 54 aa 53 dd e3 be 46 b8 ba .......T.S...F.. 0030 53 c0 1c 4e 5d 26 32 b8 14 c8 05 10 02 01 00 00 S..N]&2......... 0040 00 00 00 00 00 4c 8a f6 be cd 32 ca e6 0a 04 fc .....L....2..... 0050 42 d5 0e 29 8d 9f 2b be 55 ab e7 44 1c c3 f8 f0 B..)..+.U..D.... 0060 d3 b4 4b 26 cb b4 28 89 ef a3 87 61 66 e5 a9 5c ..K&..(....af..\ 0070 29 c1 f2 a2 25 b9 )...%. Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 2, 2011 15:23:21.713099000 [Time delta from previous captured frame: 0.023104000 seconds] [Time delta from previous displayed frame: 0.023104000 seconds] [Time since reference or first frame: 0.507679000 seconds] Frame Number: 7 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:00:00:00:00:19 (00:00:00:00:00:19), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:00:00:00:00:19 (00:00:00:00:00:19) Address: 00:00:00:00:00:19 (00:00:00:00:00:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.155 (165.227.249.155), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb75 [correct] [Good: True] [Bad : False] Source: 165.227.249.155 (165.227.249.155) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xdd20 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: DDE3BE46B8BA53C0 Responder cookie: 1C4E5D2632B814C8 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xa1001c9c Length: 92 Encrypted payload (64 bytes) 0000 00 23 f8 10 29 12 00 00 00 00 00 19 08 00 45 00 .#..).........E. 0010 00 78 00 00 40 00 40 11 fb 75 a5 e3 f9 9b a5 e3 .x..@.@..u...... 0020 f9 9c 01 f4 01 f4 00 64 dd 20 dd e3 be 46 b8 ba .......d. ...F.. 0030 53 c0 1c 4e 5d 26 32 b8 14 c8 08 10 05 01 a1 00 S..N]&2......... 0040 1c 9c 00 00 00 5c e4 ff f9 45 c7 27 c0 d8 88 64 .....\...E.'...d 0050 12 a3 7e 03 03 e5 85 24 69 f9 cc cc c3 ee 75 0b ..~....$i.....u. 0060 a4 65 7f f3 a0 3c f2 bc 0f 86 96 68 72 ad b7 04 .e...<.....hr... 0070 13 e3 66 c5 25 0f 55 c1 a9 0e 92 c6 90 84 5a 72 ..f.%.U.......Zr 0080 f6 19 72 ee 26 1d ..r.&. Frame 8 (342 bytes on wire, 342 bytes captured) Arrival Time: Feb 2, 2011 15:23:21.727192000 [Time delta from previous captured frame: 0.014093000 seconds] [Time delta from previous displayed frame: 0.014093000 seconds] [Time since reference or first frame: 0.521772000 seconds] Frame Number: 8 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:23:f8:10:29:12 (00:23:f8:10:29:12), Dst: 00:00:00:00:00:19 (00:00:00:00:00:19) Destination: 00:00:00:00:00:19 (00:00:00:00:00:19) Address: 00:00:00:00:00:19 (00:00:00:00:00:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.156 (165.227.249.156), Dst: 165.227.249.155 (165.227.249.155) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaa5 [correct] [Good: True] [Bad : False] Source: 165.227.249.156 (165.227.249.156) Destination: 165.227.249.155 (165.227.249.155) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x27c3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: DDE3BE46B8BA53C0 Responder cookie: 1C4E5D2632B814C8 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xb43cf14d Length: 300 Encrypted payload (272 bytes) 0000 00 00 00 00 00 19 00 23 f8 10 29 12 08 00 45 00 .......#..)...E. 0010 01 48 00 00 40 00 40 11 fa a5 a5 e3 f9 9c a5 e3 .H..@.@......... 0020 f9 9b 01 f4 01 f4 01 34 27 c3 dd e3 be 46 b8 ba .......4'....F.. 0030 53 c0 1c 4e 5d 26 32 b8 14 c8 08 10 20 01 b4 3c S..N]&2..... ..< 0040 f1 4d 00 00 01 2c c6 64 87 06 45 46 f7 7c 65 90 .M...,.d..EF.|e. 0050 ee 68 f4 93 06 0b 5a 81 4a 1c 01 67 22 9b 73 99 .h....Z.J..g".s. 0060 01 e9 fd c3 18 88 0d c8 86 00 e0 2a 3b 09 4f bb ...........*;.O. 0070 8b b5 c1 67 8f b8 bf 09 93 70 6f b4 0d a3 4e 61 ...g.....po...Na 0080 8c a6 d5 c1 8f 8b 92 79 c8 c2 49 7d 84 df 45 78 .......y..I}..Ex 0090 d9 85 d8 92 58 02 1c 32 d4 41 4b 99 e4 48 79 fb ....X..2.AK..Hy. 00a0 ee 4b 38 73 09 6f 45 b0 89 3f 49 f6 44 49 08 a9 .K8s.oE..?I.DI.. 00b0 d1 c0 81 96 d2 26 0e 7b e6 61 71 5f 31 a6 f4 71 .....&.{.aq_1..q 00c0 d6 0f 07 10 41 c0 d5 11 94 2c 9e 43 7a 88 d8 d6 ....A....,.Cz... 00d0 fd 0b 62 bc 78 68 fe 0f 56 a8 30 6f 75 d6 9d fa ..b.xh..V.0ou... 00e0 b4 3f a2 0a ab e2 d3 a5 1f a2 22 0d 6c 82 80 7d .?........".l..} 00f0 3a d2 9b 5c 21 41 ba 15 32 2d bf 83 70 fa 79 7e :..\!A..2-..p.y~ 0100 69 64 b2 11 51 f1 85 95 c6 2d e5 d5 24 6b 7c 76 id..Q....-..$k|v 0110 2d 2d 99 88 87 8d ca 5f ec 21 30 a5 57 e5 cd 89 --....._.!0.W... 0120 e1 63 34 6f 6b 6c 74 53 19 ea 2d 26 2f aa 45 e2 .c4okltS..-&/.E. 0130 1c b0 60 68 2c 22 4b d5 05 ce d5 2f 57 50 98 34 ..`h,"K..../WP.4 0140 31 72 b2 45 e8 cc 4b 65 0e 39 3a 0b 93 87 4b cc 1r.E..Ke.9:...K. 0150 a3 f8 83 75 f5 ac ...u.. Frame 9 (342 bytes on wire, 342 bytes captured) Arrival Time: Feb 2, 2011 15:23:22.020867000 [Time delta from previous captured frame: 0.293675000 seconds] [Time delta from previous displayed frame: 0.293675000 seconds] [Time since reference or first frame: 0.815447000 seconds] Frame Number: 9 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:00:00:00:00:19 (00:00:00:00:00:19), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:00:00:00:00:19 (00:00:00:00:00:19) Address: 00:00:00:00:00:19 (00:00:00:00:00:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.155 (165.227.249.155), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaa5 [correct] [Good: True] [Bad : False] Source: 165.227.249.155 (165.227.249.155) Destination: 165.227.249.156 (165.227.249.156) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x18aa [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: DDE3BE46B8BA53C0 Responder cookie: 1C4E5D2632B814C8 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xb43cf14d Length: 300 Encrypted payload (272 bytes) 0000 00 23 f8 10 29 12 00 00 00 00 00 19 08 00 45 00 .#..).........E. 0010 01 48 00 00 40 00 40 11 fa a5 a5 e3 f9 9b a5 e3 .H..@.@......... 0020 f9 9c 01 f4 01 f4 01 34 18 aa dd e3 be 46 b8 ba .......4.....F.. 0030 53 c0 1c 4e 5d 26 32 b8 14 c8 08 10 20 01 b4 3c S..N]&2..... ..< 0040 f1 4d 00 00 01 2c f3 98 16 a1 32 fa 91 7f 88 3d .M...,....2....= 0050 d7 62 11 e0 4a d1 df 37 38 9a 78 db 47 a2 c5 a8 .b..J..78.x.G... 0060 86 b9 9a 78 fa 56 63 d2 7f b1 45 e4 3b 5f 19 99 ...x.Vc...E.;_.. 0070 dd 7e 37 86 a3 b5 d4 e2 60 8c 36 20 6f d7 31 1a .~7.....`.6 o.1. 0080 8a 38 c5 e6 0f b0 f2 c2 2f da bc bf 6d 17 2c b4 .8....../...m.,. 0090 dd 01 a2 34 c1 06 e7 bd 64 2b 6b fa 97 2d c1 46 ...4....d+k..-.F 00a0 40 1a 7f b8 3d ed 75 30 c5 3d cf 5e 07 9c 35 93 @...=.u0.=.^..5. 00b0 33 64 d9 cf 32 f8 85 40 15 92 c2 88 8b 38 a2 23 3d..2..@.....8.# 00c0 68 0c 56 d8 bb 6a f8 ea 79 c7 40 54 91 37 18 da h.V..j..y.@T.7.. 00d0 f5 75 8c ea 99 dc 00 8e 6d 64 91 04 9d ad af 54 .u......md.....T 00e0 41 c0 4a 00 fb 40 a4 a6 7c cd 6c bb 4e 7a 3f de A.J..@..|.l.Nz?. 00f0 7a 69 7b f9 a3 fa ed b0 4b a1 a8 c2 eb 3b 59 e7 zi{.....K....;Y. 0100 3c 6a 71 b4 ee 84 31 a2 ec 09 b9 d4 4e ec f7 68 .2x.3[.1. 0040 1d 73 5f 44 6b b8 b2 5e 8b fc 07 a8 f1 9b f1 00 .s_Dk..^........ 0050 cf a7 75 09 24 af e8 17 21 3a f3 e7 54 90 cb dc ..u.$...!:..T... 0060 27 f0 7a 43 59 14 bd 61 54 56 b6 5e e1 86 51 9a '.zCY..aTV.^..Q. 0070 78 14 03 4e 67 a3 65 2f 2d c1 2f 23 fd 75 d1 58 x..Ng.e/-./#.u.X 0080 b5 df 07 d0 d4 60 .....` Frame 13 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 2, 2011 15:23:25.410117000 [Time delta from previous captured frame: 1.000621000 seconds] [Time delta from previous displayed frame: 1.000621000 seconds] [Time since reference or first frame: 4.204697000 seconds] Frame Number: 13 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:23:f8:10:29:12 (00:23:f8:10:29:12), Dst: 00:00:00:00:00:19 (00:00:00:00:00:19) Destination: 00:00:00:00:00:19 (00:00:00:00:00:19) Address: 00:00:00:00:00:19 (00:00:00:00:00:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.156 (165.227.249.156), Dst: 165.227.249.155 (165.227.249.155) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x05d2 (1490) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x3583 [correct] [Good: True] [Bad : False] Source: 165.227.249.156 (165.227.249.156) Destination: 165.227.249.155 (165.227.249.155) Encapsulating Security Payload ESP SPI: 0x04a4a966 ESP Sequence: 2 0000 00 00 00 00 00 19 00 23 f8 10 29 12 08 00 45 00 .......#..)...E. 0010 00 78 05 d2 00 00 40 32 35 83 a5 e3 f9 9c a5 e3 .x....@25....... 0020 f9 9b 04 a4 a9 66 00 00 00 02 f9 43 72 32 db a1 .....f.....Cr2.. 0030 5d 7b 65 8b 02 a9 c3 92 a8 83 ff 1e 80 82 83 2b ]{e............+ 0040 12 ef 49 85 b8 66 84 55 13 5f 1f 59 1f 77 29 65 ..I..f.U._.Y.w)e 0050 2d 05 22 52 95 54 d1 2a 84 04 9d 13 71 85 60 77 -."R.T.*....q.`w 0060 94 72 25 2c 9f 59 67 d0 2b 8d 93 1a 8c 24 38 67 .r%,.Yg.+....$8g 0070 3a f4 52 a5 83 ba 43 bb d9 72 4f 8b c8 39 e9 2f :.R...C..rO..9./ 0080 b5 fb 4d b3 1a 4c ..M..L Frame 14 (134 bytes on wire, 134 bytes captured) Arrival Time: Feb 2, 2011 15:23:25.410142000 [Time delta from previous captured frame: 0.000025000 seconds] [Time delta from previous displayed frame: 0.000025000 seconds] [Time since reference or first frame: 4.204722000 seconds] Frame Number: 14 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:00:00:00:00:19 (00:00:00:00:00:19), Dst: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Destination: 00:23:f8:10:29:12 (00:23:f8:10:29:12) Address: 00:23:f8:10:29:12 (00:23:f8:10:29:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:00:00:00:00:19 (00:00:00:00:00:19) Address: 00:00:00:00:00:19 (00:00:00:00:00:19) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.155 (165.227.249.155), Dst: 165.227.249.156 (165.227.249.156) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0xacd9 (44249) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x8e7b [correct] [Good: True] [Bad : False] Source: 165.227.249.155 (165.227.249.155) Destination: 165.227.249.156 (165.227.249.156) Encapsulating Security Payload ESP SPI: 0x392e54df ESP Sequence: 2 0000 00 23 f8 10 29 12 00 00 00 00 00 19 08 00 45 00 .#..).........E. 0010 00 78 ac d9 00 00 40 32 8e 7b a5 e3 f9 9b a5 e3 .x....@2.{...... 0020 f9 9c 39 2e 54 df 00 00 00 02 27 2f 29 bf e9 b4 ..9.T.....'/)... 0030 25 7b d6 b3 c4 13 e8 45 34 53 cd 15 4d 51 01 b5 %{.....E4S..MQ.. 0040 f8 8a ba 48 ae cd 8e 6b 6d 3e ac 89 fd 2c 18 23 ...H...km>...,.# 0050 3e 3f 5a 79 d0 b2 93 43 02 72 59 e4 50 54 0e 8f >?Zy...C.rY.PT.. 0060 4b e5 2a eb cd 29 01 f9 43 1a 69 5f 98 ee e0 66 K.*..)..C.i_...f 0070 a1 15 79 58 02 bb 57 d2 b7 23 41 40 71 39 94 8f ..yX..W..#A@q9.. 0080 f6 e2 4c 74 4d 2c ..LtM,