Frame 1 (146 bytes on wire, 146 bytes captured) Arrival Time: Jan 23, 2006 09:43:11.890188000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 146 bytes Capture Length: 146 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Type: IP (0x0800) Trailer: D0C336F1 Internet Protocol, Src: 165.227.249.106 (165.227.249.106), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x1979 (6521) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x222f [correct] Good: True Bad : False Source: 165.227.249.106 (165.227.249.106) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0x4401 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCA824D3F94B3EC14 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 13 c4 80 d3 aa 00 a0 8e 72 1e 40 08 00 45 00 .........r.@..E. 0010 00 80 19 79 00 00 40 11 22 2f a5 e3 f9 6a a5 e3 ...y..@."/...j.. 0020 f9 93 01 f4 01 f4 00 6c 44 01 ca 82 4d 3f 94 b3 .......lD...M?.. 0030 ec 14 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 64 0d 00 00 34 00 00 00 01 00 00 .....d...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 00 00 00 14 af ca ........p....... 0080 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 d0 c3 ..h...k...wW.... 0090 36 f1 6. Frame 2 (150 bytes on wire, 150 bytes captured) Arrival Time: Jan 23, 2006 09:43:11.891013000 Time delta from previous packet: 0.000825000 seconds Time since reference or first frame: 0.000825000 seconds Frame Number: 2 Packet Length: 150 bytes Capture Length: 150 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Destination: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 629DE520 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.106 (165.227.249.106) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x252e (9518) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x5775 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.106 (165.227.249.106) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0x368c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCA824D3F94B3EC14 Responder cookie: 0xFB10F48FC34EDF27 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 24 Vendor ID: Microsoft L2TP/IPSec VPN Client 0000 00 a0 8e 72 1e 40 00 13 c4 80 d3 aa 08 00 45 00 ...r.@........E. 0010 00 84 25 2e 00 00 ff 11 57 75 a5 e3 f9 93 a5 e3 ..%.....Wu...... 0020 f9 6a 01 f4 01 f4 00 70 36 8c ca 82 4d 3f 94 b3 .j.....p6...M?.. 0030 ec 14 fb 10 f4 8f c3 4e df 27 01 10 02 00 00 00 .......N.'...... 0040 00 00 00 00 00 68 0d 00 00 34 00 00 00 01 00 00 .....h...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 00 00 00 18 40 48 ........p.....@H 0080 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3 c0 00 ..n...%......... 0090 00 00 62 9d e5 20 ..b.. Frame 3 (262 bytes on wire, 262 bytes captured) Arrival Time: Jan 23, 2006 09:43:12.015674000 Time delta from previous packet: 0.124661000 seconds Time since reference or first frame: 0.125486000 seconds Frame Number: 3 Packet Length: 262 bytes Capture Length: 262 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Type: IP (0x0800) Trailer: 4EF8472D Internet Protocol, Src: 165.227.249.106 (165.227.249.106), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 244 Identification: 0x197a (6522) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x21ba [correct] Good: True Bad : False Source: 165.227.249.106 (165.227.249.106) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 224 Checksum: 0x8767 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCA824D3F94B3EC14 Responder cookie: 0xFB10F48FC34EDF27 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 216 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: NONE (0) Length: 32 Vendor ID: unknown vendor ID: 0x03000014CCBFB92C051AF5B6A1715CF3864C808800000008... 0000 00 13 c4 80 d3 aa 00 a0 8e 72 1e 40 08 00 45 00 .........r.@..E. 0010 00 f4 19 7a 00 00 40 11 21 ba a5 e3 f9 6a a5 e3 ...z..@.!....j.. 0020 f9 93 01 f4 01 f4 00 e0 87 67 ca 82 4d 3f 94 b3 .........g..M?.. 0030 ec 14 fb 10 f4 8f c3 4e df 27 04 10 02 00 00 00 .......N.'...... 0040 00 00 00 00 00 d8 0a 00 00 84 65 49 90 dd 7c 43 ..........eI..|C 0050 1b 34 c0 c7 64 87 10 c4 e3 dd a6 ae 0a c6 da b4 .4..d........... 0060 63 8e 8c 27 e5 b8 cf 5e ae 3f 67 92 44 fb 6d 74 c..'...^.?g.D.mt 0070 53 75 c0 0d ad d4 53 1d 1d aa 51 bc b6 00 e4 fb Su....S...Q..... 0080 b2 02 66 a8 63 91 c2 dd 05 08 4f d1 59 42 4d 4c ..f.c.....O.YBML 0090 de f1 85 f3 a3 7e 1c 6f 2b 83 af ba a9 ee ca f7 .....~.o+....... 00a0 0f 39 0c 0d 5b 0c c1 09 b3 7e 1a bd 1e a7 0b 34 .9..[....~.....4 00b0 a6 f6 ab fa 22 1d c6 8d af e6 ba 57 d2 c7 d6 9f ...."......W.... 00c0 b1 f6 84 db 5a 4e 9e 86 70 f3 0d 00 00 18 7e 53 ....ZN..p.....~S 00d0 95 f7 75 1a fd ad 8f 51 b5 f2 0b 71 b5 d3 c0 5d ..u....Q...q...] 00e0 85 51 00 00 00 20 03 00 00 14 cc bf b9 2c 05 1a .Q... .......,.. 00f0 f5 b6 a1 71 5c f3 86 4c 80 88 00 00 00 08 00 06 ...q\..L........ 0100 00 03 4e f8 47 2d ..N.G- Frame 4 (302 bytes on wire, 302 bytes captured) Arrival Time: Jan 23, 2006 09:43:12.017259000 Time delta from previous packet: 0.001585000 seconds Time since reference or first frame: 0.127071000 seconds Frame Number: 4 Packet Length: 302 bytes Capture Length: 302 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Destination: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: CD6EFE83 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.106 (165.227.249.106) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x252f (9519) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x56dc [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.106 (165.227.249.106) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xe879 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCA824D3F94B3EC14 Responder cookie: 0xFB10F48FC34EDF27 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x12F5F28C457168A9702D9FE274CC0100 Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x0ED75392C34FDF27184EAB7910F96D00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x1F07F70EAA6514D3B0FA96542A500100 0000 00 a0 8e 72 1e 40 00 13 c4 80 d3 aa 08 00 45 00 ...r.@........E. 0010 01 1c 25 2f 00 00 ff 11 56 dc a5 e3 f9 93 a5 e3 ..%/....V....... 0020 f9 6a 01 f4 01 f4 01 08 e8 79 ca 82 4d 3f 94 b3 .j.......y..M?.. 0030 ec 14 fb 10 f4 8f c3 4e df 27 04 10 02 00 00 00 .......N.'...... 0040 00 00 00 00 01 00 0a 00 00 84 73 ac cc 94 93 bc ..........s..... 0050 05 a9 24 fc 9f e8 4a ff 05 3e 28 87 c3 7d bb ce ..$...J..>(..}.. 0060 a0 1c 72 a8 ea c1 ef f1 61 31 95 4f ab 1d be 61 ..r.....a1.O...a 0070 32 dc 95 07 b6 ce da 64 cc 72 e5 3f 4f cb fd 8a 2......d.r.?O... 0080 e8 7c 2a 9c d4 c6 66 8c 0d d1 e4 5b f8 50 b2 a9 .|*...f....[.P.. 0090 64 e5 34 e2 44 26 34 68 5c ce 35 c6 b1 e3 f8 19 d.4.D&4h\.5..... 00a0 92 bc e6 b1 1d de 75 46 44 00 9c b9 db 8a ab a8 ......uFD....... 00b0 ad e9 09 3f 0b e0 a2 ae 7a c0 11 0a ad c3 91 ee ...?....z....... 00c0 78 5c 1a 80 f3 7c 71 85 0e 49 0d 00 00 18 38 94 x\...|q..I....8. 00d0 60 c3 07 89 e2 9f 5c f5 62 8b 2b 5d 85 1f ef 31 `.....\.b.+]...1 00e0 ce 64 0d 00 00 14 12 f5 f2 8c 45 71 68 a9 70 2d .d........Eqh.p- 00f0 9f e2 74 cc 01 00 0d 00 00 0c 09 00 26 89 df d6 ..t.........&... 0100 b7 12 0d 00 00 14 0e d7 53 92 c3 4f df 27 18 4e ........S..O.'.N 0110 ab 79 10 f9 6d 00 00 00 00 14 1f 07 f7 0e aa 65 .y..m..........e 0120 14 d3 b0 fa 96 54 2a 50 01 00 cd 6e fe 83 .....T*P...n.. Frame 5 (138 bytes on wire, 138 bytes captured) Arrival Time: Jan 23, 2006 09:43:12.171177000 Time delta from previous packet: 0.153918000 seconds Time since reference or first frame: 0.280989000 seconds Frame Number: 5 Packet Length: 138 bytes Capture Length: 138 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Type: IP (0x0800) Trailer: 5B85B1FF Internet Protocol, Src: 165.227.249.106 (165.227.249.106), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x197b (6523) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x2235 [correct] Good: True Bad : False Source: 165.227.249.106 (165.227.249.106) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x08e0 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCA824D3F94B3EC14 Responder cookie: 0xFB10F48FC34EDF27 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 13 c4 80 d3 aa 00 a0 8e 72 1e 40 08 00 45 00 .........r.@..E. 0010 00 78 19 7b 00 00 40 11 22 35 a5 e3 f9 6a a5 e3 .x.{..@."5...j.. 0020 f9 93 01 f4 01 f4 00 64 08 e0 ca 82 4d 3f 94 b3 .......d....M?.. 0030 ec 14 fb 10 f4 8f c3 4e df 27 05 10 02 01 00 00 .......N.'...... 0040 00 00 00 00 00 5c 8b 70 36 7e 53 02 e1 fb 20 01 .....\.p6~S... . 0050 ce 83 e2 02 39 d5 f2 85 57 7d 63 2c 89 1b b6 31 ....9...W}c,...1 0060 79 d1 8d aa d2 19 6b c6 4c d6 ff 2c fa 48 07 4c y.....k.L..,.H.L 0070 e2 97 90 0a 3d 61 e3 e8 57 dc 54 f0 73 55 83 bd ....=a..W.T.sU.. 0080 c1 94 f0 e9 16 83 5b 85 b1 ff ......[... Frame 6 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 23, 2006 09:43:12.171995000 Time delta from previous packet: 0.000818000 seconds Time since reference or first frame: 0.281807000 seconds Frame Number: 6 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Destination: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 486015A9 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.106 (165.227.249.106) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x2530 (9520) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x5787 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.106 (165.227.249.106) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0xd792 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCA824D3F94B3EC14 Responder cookie: 0xFB10F48FC34EDF27 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 84 Encrypted payload (56 bytes) 0000 00 a0 8e 72 1e 40 00 13 c4 80 d3 aa 08 00 45 00 ...r.@........E. 0010 00 70 25 30 00 00 ff 11 57 87 a5 e3 f9 93 a5 e3 .p%0....W....... 0020 f9 6a 01 f4 01 f4 00 5c d7 92 ca 82 4d 3f 94 b3 .j.....\....M?.. 0030 ec 14 fb 10 f4 8f c3 4e df 27 05 10 02 01 00 00 .......N.'...... 0040 00 00 00 00 00 54 43 2f f2 46 27 4a 88 be 13 10 .....TC/.F'J.... 0050 8c 8d 73 0b c1 b3 91 60 bc a9 29 c8 fc a6 86 87 ..s....`..)..... 0060 d7 50 83 cb 5f b6 3f f0 bc da 26 e9 fd 61 23 a0 .P.._.?...&..a#. 0070 92 63 9a 8a 37 ef 26 ab f2 48 c9 eb b6 cb 48 60 .c..7.&..H....H` 0080 15 a9 .. Frame 7 (338 bytes on wire, 338 bytes captured) Arrival Time: Jan 23, 2006 09:43:12.299655000 Time delta from previous packet: 0.127660000 seconds Time since reference or first frame: 0.409467000 seconds Frame Number: 7 Packet Length: 338 bytes Capture Length: 338 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Type: IP (0x0800) Trailer: 21A40858 Internet Protocol, Src: 165.227.249.106 (165.227.249.106), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x197c (6524) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x216c [correct] Good: True Bad : False Source: 165.227.249.106 (165.227.249.106) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x8d72 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCA824D3F94B3EC14 Responder cookie: 0xFB10F48FC34EDF27 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x92699BCB Length: 292 Encrypted payload (264 bytes) 0000 00 13 c4 80 d3 aa 00 a0 8e 72 1e 40 08 00 45 00 .........r.@..E. 0010 01 40 19 7c 00 00 40 11 21 6c a5 e3 f9 6a a5 e3 .@.|..@.!l...j.. 0020 f9 93 01 f4 01 f4 01 2c 8d 72 ca 82 4d 3f 94 b3 .......,.r..M?.. 0030 ec 14 fb 10 f4 8f c3 4e df 27 08 10 20 01 92 69 .......N.'.. ..i 0040 9b cb 00 00 01 24 07 3b 5a 1a 2b 4e 8f 10 6b 94 .....$.;Z.+N..k. 0050 17 90 54 7c 11 b2 30 29 e7 06 4a 1d 53 60 bb e9 ..T|..0)..J.S`.. 0060 66 89 3e 3e e0 2d 6f 9d 6a 99 ec 54 34 10 d1 92 f.>>.-o.j..T4... 0070 ea 69 84 5b 09 74 00 24 25 f9 6e b9 b7 b1 74 98 .i.[.t.$%.n...t. 0080 62 80 ad 05 ae 93 cb 67 c7 16 55 45 69 ac 38 71 b......g..UEi.8q 0090 ba 20 d6 7e 85 9e 0b a0 3f 2d 6c 0c 77 0f e5 77 . .~....?-l.w..w 00a0 62 c9 06 43 f0 8c 00 c1 79 d0 f7 57 ee 3d 5b ac b..C....y..W.=[. 00b0 cc 48 7e cc b4 20 e0 d3 5a 8d 87 40 ce c2 5e 02 .H~.. ..Z..@..^. 00c0 4b 96 1e a6 30 33 5f e8 8d c7 9d 6c c1 08 81 6e K...03_....l...n 00d0 ef a8 34 d6 a8 cf 63 ea eb 07 88 91 d0 21 22 06 ..4...c......!". 00e0 36 31 c6 c0 f5 64 e5 ac c6 61 69 cc 65 3b 75 11 61...d...ai.e;u. 00f0 3e 74 b3 f4 a0 ca bf db cf 4c 60 38 c7 95 d5 42 >t.......L`8...B 0100 10 ec 2b b8 e4 82 40 92 57 86 27 54 13 c2 6b c9 ..+...@.W.'T..k. 0110 bb 3e 8b 9c 7c f4 bc 78 6d 2d c9 e3 7b ac 05 ad .>..|..xm-..{... 0120 8e ca 9d 58 41 4a 55 18 e1 45 4a ce c5 15 ff 59 ...XAJU..EJ....Y 0130 19 11 5b 13 ba 88 62 8b 89 3e 02 81 64 4f 87 35 ..[...b..>..dO.5 0140 e4 e2 d6 29 0c 54 1b 84 11 5e d2 1d 1a 04 21 a4 ...).T...^....!. 0150 08 58 .X Frame 8 (338 bytes on wire, 338 bytes captured) Arrival Time: Jan 23, 2006 09:43:12.301872000 Time delta from previous packet: 0.002217000 seconds Time since reference or first frame: 0.411684000 seconds Frame Number: 8 Packet Length: 338 bytes Capture Length: 338 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Destination: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 4B492096 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.106 (165.227.249.106) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x2531 (9521) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x56b6 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.106 (165.227.249.106) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0xbe6a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCA824D3F94B3EC14 Responder cookie: 0xFB10F48FC34EDF27 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x92699BCB Length: 292 Encrypted payload (264 bytes) 0000 00 a0 8e 72 1e 40 00 13 c4 80 d3 aa 08 00 45 00 ...r.@........E. 0010 01 40 25 31 00 00 ff 11 56 b6 a5 e3 f9 93 a5 e3 .@%1....V....... 0020 f9 6a 01 f4 01 f4 01 2c be 6a ca 82 4d 3f 94 b3 .j.....,.j..M?.. 0030 ec 14 fb 10 f4 8f c3 4e df 27 08 10 20 01 92 69 .......N.'.. ..i 0040 9b cb 00 00 01 24 73 35 32 ec 88 16 40 7b 1e 6f .....$s52...@{.o 0050 f2 e7 91 32 1c 2c 0a 45 74 a5 8c 5d 52 67 2a cf ...2.,.Et..]Rg*. 0060 c0 71 c3 12 35 01 68 2f 71 8b 3e 08 ea dd c4 c9 .q..5.h/q.>..... 0070 0b 72 bc 59 57 3a ad 04 4c 2d ca e2 95 45 ff a2 .r.YW:..L-...E.. 0080 ea 96 fe b2 50 8f ac 37 da 91 7d 2f 99 14 64 3b ....P..7..}/..d; 0090 ed b3 90 17 4d 5d f7 04 44 70 63 f4 84 ef 47 90 ....M]..Dpc...G. 00a0 95 a6 e9 3d 7f e2 8e e0 72 43 5e 3e 07 5d 4c 9d ...=....rC^>.]L. 00b0 0f 74 8b 4b f8 b7 bd 31 d2 24 05 f1 fa 5a e0 f4 .t.K...1.$...Z.. 00c0 96 f2 94 da 21 70 64 b7 55 53 d7 b6 94 25 58 5c ....!pd.US...%X\ 00d0 f0 48 2a 4e dd 7f 43 bf 87 1c c6 e9 fc b8 55 14 .H*N..C.......U. 00e0 a5 43 a5 2b a0 25 8d 0f 27 1a 59 eb 86 9a f7 db .C.+.%..'.Y..... 00f0 98 1e 34 62 82 71 9e fe ef a9 c1 a2 86 bd a1 80 ..4b.q.......... 0100 d6 57 88 a2 e7 03 af 52 4c 94 8e 71 f5 f4 e3 60 .W.....RL..q...` 0110 5e ee 05 19 c8 f9 b6 db 37 18 3d d3 88 27 10 40 ^.......7.=..'.@ 0120 17 c6 9a 50 a6 49 6f c6 77 b2 74 51 82 62 9c 33 ...P.Io.w.tQ.b.3 0130 fc cd e1 65 a6 3f fd 27 bf 57 fc 14 5b 30 8a 92 ...e.?.'.W..[0.. 0140 c1 4e 63 d1 c0 14 6d fc 98 21 ca 60 78 4b 4b 49 .Nc...m..!.`xKKI 0150 20 96 . Frame 9 (98 bytes on wire, 98 bytes captured) Arrival Time: Jan 23, 2006 09:43:12.463059000 Time delta from previous packet: 0.161187000 seconds Time since reference or first frame: 0.572871000 seconds Frame Number: 9 Packet Length: 98 bytes Capture Length: 98 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Type: IP (0x0800) Trailer: 6896F0F0 Internet Protocol, Src: 165.227.249.106 (165.227.249.106), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 80 Identification: 0x197d (6525) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x225b [correct] Good: True Bad : False Source: 165.227.249.106 (165.227.249.106) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 60 Checksum: 0xb648 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCA824D3F94B3EC14 Responder cookie: 0xFB10F48FC34EDF27 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x92699BCB Length: 52 Encrypted payload (24 bytes) 0000 00 13 c4 80 d3 aa 00 a0 8e 72 1e 40 08 00 45 00 .........r.@..E. 0010 00 50 19 7d 00 00 40 11 22 5b a5 e3 f9 6a a5 e3 .P.}..@."[...j.. 0020 f9 93 01 f4 01 f4 00 3c b6 48 ca 82 4d 3f 94 b3 .......<.H..M?.. 0030 ec 14 fb 10 f4 8f c3 4e df 27 08 10 20 01 92 69 .......N.'.. ..i 0040 9b cb 00 00 00 34 50 54 48 85 51 5e a2 4d 88 4f .....4PTH.Q^.M.O 0050 02 ca c0 11 71 a7 e1 dc 8c 1c df 05 ef 0b 68 96 ....q.........h. 0060 f0 f0 .. Frame 10 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 23, 2006 09:43:12.967608000 Time delta from previous packet: 0.504549000 seconds Time since reference or first frame: 1.077420000 seconds Frame Number: 10 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Type: IP (0x0800) Trailer: 975005E3 Internet Protocol, Src: 165.227.249.106 (165.227.249.106), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x197e (6526) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x2219 [correct] Good: True Bad : False Source: 165.227.249.106 (165.227.249.106) Destination: 165.227.249.147 (165.227.249.147) Encapsulating Security Payload SPI: 0x851c40b6 Sequence: 1 Data (84 bytes) 0000 00 13 c4 80 d3 aa 00 a0 8e 72 1e 40 08 00 45 00 .........r.@..E. 0010 00 70 19 7e 00 00 40 32 22 19 a5 e3 f9 6a a5 e3 .p.~..@2"....j.. 0020 f9 93 85 1c 40 b6 00 00 00 01 61 6d 0d 3f 11 d5 ....@.....am.?.. 0030 80 3e 59 11 33 00 d9 b8 b2 e2 bb 3b 36 f9 b2 bd .>Y.3......;6... 0040 eb 69 5b 04 02 2c 08 e4 eb 99 25 b4 8e 56 10 6e .i[..,....%..V.n 0050 5f 2c 16 b3 77 9b 26 50 da cd 4a 5a a5 f3 d5 9f _,..w.&P..JZ.... 0060 28 ec 42 23 b2 1f 86 24 f2 cc 18 3c 2f 9a 4d 42 (.B#...$...*.......x|. 0060 13 c0 8a 9b 9d 0b b1 a0 df 64 ec ff 94 32 31 24 .........d...21$ 0070 7c 75 03 02 ee 8c 2b 4d 1d c8 bc 0e c0 eb f1 17 |u....+M........ 0080 19 66 .f Frame 13 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 23, 2006 09:43:12.976814000 Time delta from previous packet: 0.000222000 seconds Time since reference or first frame: 1.086626000 seconds Frame Number: 13 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Destination: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 49873376 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.106 (165.227.249.106) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x3325 (13093) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x0872 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.106 (165.227.249.106) Encapsulating Security Payload SPI: 0x76e34800 Sequence: 2 Data (84 bytes) 0000 00 a0 8e 72 1e 40 00 13 c4 80 d3 aa 08 00 45 00 ...r.@........E. 0010 00 70 33 25 00 00 40 32 08 72 a5 e3 f9 93 a5 e3 .p3%..@2.r...... 0020 f9 6a 76 e3 48 00 00 00 00 02 cf d9 9b bc 06 9f .jv.H........... 0030 8c 67 f6 53 8b 92 1f a3 a8 d6 fa 6c cb cc 42 fd .g.S.......l..B. 0040 f3 92 bf 5b d1 a5 13 2c 29 69 cb 61 54 8a 1e 01 ...[...,)i.aT... 0050 88 3f 33 a4 bd 21 31 67 2b 47 49 41 58 e3 b9 a3 .?3..!1g+GIAX... 0060 56 17 1b 9e 44 58 c1 2c 67 de 83 ed d7 ef 79 58 V...DX.,g.....yX 0070 df fe d0 e0 8f 64 55 4a 12 4b db 3d 0c 4c 49 87 .....dUJ.K.=.LI. 0080 33 76 3v Frame 14 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 23, 2006 09:43:13.984258000 Time delta from previous packet: 1.007444000 seconds Time since reference or first frame: 2.094070000 seconds Frame Number: 14 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Type: IP (0x0800) Trailer: 97109435 Internet Protocol, Src: 165.227.249.106 (165.227.249.106), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x1980 (6528) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x2217 [correct] Good: True Bad : False Source: 165.227.249.106 (165.227.249.106) Destination: 165.227.249.147 (165.227.249.147) Encapsulating Security Payload SPI: 0x851c40b6 Sequence: 3 Data (84 bytes) 0000 00 13 c4 80 d3 aa 00 a0 8e 72 1e 40 08 00 45 00 .........r.@..E. 0010 00 70 19 80 00 00 40 32 22 17 a5 e3 f9 6a a5 e3 .p....@2"....j.. 0020 f9 93 85 1c 40 b6 00 00 00 03 22 6e 31 43 5d 37 ....@....."n1C]7 0030 64 70 e1 3d cd 2b 7a f3 ff f1 c8 a7 ec 23 9f 67 dp.=.+z......#.g 0040 68 66 85 18 01 9d ae 8e ed e9 db fe b6 c7 4f 1a hf............O. 0050 63 77 e8 52 72 57 5f 0a b1 9b 38 25 b4 18 66 7d cw.RrW_...8%..f} 0060 78 33 22 b5 86 2e 69 c2 aa f1 a1 25 03 2c 50 4a x3"...i....%.,PJ 0070 ba fe db 4d 69 b6 f9 62 44 25 f4 0e 1b ef 97 10 ...Mi..bD%...... 0080 94 35 .5 Frame 15 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 23, 2006 09:43:13.984550000 Time delta from previous packet: 0.000292000 seconds Time since reference or first frame: 2.094362000 seconds Frame Number: 15 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Destination: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: F1F3A9F9 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.106 (165.227.249.106) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x3425 (13349) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x0772 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.106 (165.227.249.106) Encapsulating Security Payload SPI: 0x76e34800 Sequence: 3 Data (84 bytes) 0000 00 a0 8e 72 1e 40 00 13 c4 80 d3 aa 08 00 45 00 ...r.@........E. 0010 00 70 34 25 00 00 40 32 07 72 a5 e3 f9 93 a5 e3 .p4%..@2.r...... 0020 f9 6a 76 e3 48 00 00 00 00 03 ea f8 6c bf ee 90 .jv.H.......l... 0030 c5 17 47 c9 e5 9d 84 48 cd ce b1 5a 50 dc 8a 68 ..G....H...ZP..h 0040 b4 23 c1 73 e8 28 67 21 e6 dc 34 f4 fa b2 f2 6d .#.s.(g!..4....m 0050 63 01 56 8f bb df 50 c2 55 1f 29 29 2d d3 7b 2c c.V...P.U.))-.{, 0060 fb 55 16 5e 5f 11 43 7e 9a 6f af bf 2c 8d 9e 8e .U.^_.C~.o..,... 0070 d0 86 51 8b 9e 43 c2 ab 58 93 81 5a 09 46 f1 f3 ..Q..C..X..Z.F.. 0080 a9 f9 .. Frame 16 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 23, 2006 09:43:14.984269000 Time delta from previous packet: 0.999719000 seconds Time since reference or first frame: 3.094081000 seconds Frame Number: 16 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Type: IP (0x0800) Trailer: 95E760D6 Internet Protocol, Src: 165.227.249.106 (165.227.249.106), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x1981 (6529) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x2216 [correct] Good: True Bad : False Source: 165.227.249.106 (165.227.249.106) Destination: 165.227.249.147 (165.227.249.147) Encapsulating Security Payload SPI: 0x851c40b6 Sequence: 4 Data (84 bytes) 0000 00 13 c4 80 d3 aa 00 a0 8e 72 1e 40 08 00 45 00 .........r.@..E. 0010 00 70 19 81 00 00 40 32 22 16 a5 e3 f9 6a a5 e3 .p....@2"....j.. 0020 f9 93 85 1c 40 b6 00 00 00 04 33 5e e0 67 8a a4 ....@.....3^.g.. 0030 de 19 c8 a5 46 13 db 40 f2 69 2d 9b ee ac 78 71 ....F..@.i-...xq 0040 0d 63 82 59 0b 09 a3 1a e8 0b 5e bd 41 33 47 8d .c.Y......^.A3G. 0050 9b 19 19 7d eb b9 89 ea 6a 92 69 a1 98 e9 d6 5f ...}....j.i...._ 0060 ec 24 cd f7 6d 6b 35 25 32 a7 6d 94 01 d1 22 43 .$..mk5%2.m..."C 0070 b2 e4 d4 6c d2 bb 9d 42 28 a3 c4 2c ce 15 95 e7 ...l...B(..,.... 0080 60 d6 `. Frame 17 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 23, 2006 09:43:14.984594000 Time delta from previous packet: 0.000325000 seconds Time since reference or first frame: 3.094406000 seconds Frame Number: 17 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Destination: 00:a0:8e:72:1e:40 (00:a0:8e:72:1e:40) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: F74521A6 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.106 (165.227.249.106) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x3525 (13605) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x0672 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.106 (165.227.249.106) Encapsulating Security Payload SPI: 0x76e34800 Sequence: 4 Data (84 bytes) 0000 00 a0 8e 72 1e 40 00 13 c4 80 d3 aa 08 00 45 00 ...r.@........E. 0010 00 70 35 25 00 00 40 32 06 72 a5 e3 f9 93 a5 e3 .p5%..@2.r...... 0020 f9 6a 76 e3 48 00 00 00 00 04 3e 54 89 7b a0 26 .jv.H.....>T.{.& 0030 98 98 0d 8d 26 28 64 ec 33 f4 7a 20 1a e7 d8 c1 ....&(d.3.z .... 0040 c0 e4 34 cf 0b 55 35 dd 25 18 83 d8 ef a9 3e 30 ..4..U5.%.....>0 0050 26 1c 8c 9a f1 b6 03 79 4e d0 ea 50 f1 9c de c3 &......yN..P.... 0060 22 b9 82 82 a6 be 71 83 f2 fc 1e ad 8a 04 24 1d ".....q.......$. 0070 f6 0d 32 14 c3 1b 0e db f0 52 53 76 aa da f7 45 ..2......RSv...E 0080 21 a6 !.