Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Jan 27, 2005 17:48:06.645964000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 166 bytes Capture Length: 166 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:e0:4c:69:0a:78 Destination: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0x54c4a234 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.102 (165.227.249.102) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 148 Identification: 0x00c2 (194) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfaf5 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.102 (165.227.249.102) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 128 Checksum: 0x9496 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x04E3A247F5ED5B98 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 120 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 e0 4c 69 0a 78 00 0c 29 00 82 53 08 00 45 00 ..Li.x..)..S..E. 0010 00 94 00 c2 00 00 80 11 fa f5 a5 e3 f9 73 a5 e3 .............s.. 0020 f9 66 01 f4 01 f4 00 80 94 96 04 e3 a2 47 f5 ed .f...........G.. 0030 5b 98 00 00 00 00 00 00 00 00 01 10 02 00 00 00 [............... 0040 00 00 00 00 00 78 0d 00 00 34 00 00 00 01 00 00 .....x...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 0e 10 0d 00 00 14 44 85 ..............D. 0080 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 00 00 .-.......F.y.... 0090 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 ......>.in.c...B 00a0 7b 1f 54 c4 a2 34 {.T..4 Frame 2 (186 bytes on wire, 186 bytes captured) Arrival Time: Jan 27, 2005 17:48:06.664387000 Time delta from previous packet: 0.018423000 seconds Time since reference or first frame: 0.018423000 seconds Frame Number: 2 Packet Length: 186 bytes Capture Length: 186 bytes Ethernet II, Src: 00:e0:4c:69:0a:78, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Type: IP (0x0800) Frame check sequence: 0x1d50df57 (correct) Internet Protocol, Src Addr: 165.227.249.102 (165.227.249.102), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 168 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba3 (correct) Source: 165.227.249.102 (165.227.249.102) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 148 Checksum: 0x18d2 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x04E3A247F5ED5B98 Responder cookie: 0x80D912A84ACBF944 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 140 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-dpd-00.txt Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x648982785BEDBDD66A6DD356F0E160FD 0000 00 0c 29 00 82 53 00 e0 4c 69 0a 78 08 00 45 00 ..)..S..Li.x..E. 0010 00 a8 00 00 40 00 40 11 fb a3 a5 e3 f9 66 a5 e3 ....@.@......f.. 0020 f9 73 01 f4 01 f4 00 94 18 d2 04 e3 a2 47 f5 ed .s...........G.. 0030 5b 98 80 d9 12 a8 4a cb f9 44 01 10 02 00 00 00 [.....J..D...... 0040 00 00 00 00 00 8c 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 0e 10 0d 00 00 14 90 cb ................ 0080 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 ..>.in.c...B{... 0090 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00a0 01 00 00 00 00 14 64 89 82 78 5b ed bd d6 6a 6d ......d..x[...jm 00b0 d3 56 f0 e1 60 fd 1d 50 df 57 .V..`..P.W Frame 3 (350 bytes on wire, 350 bytes captured) Arrival Time: Jan 27, 2005 17:48:08.832679000 Time delta from previous packet: 2.168292000 seconds Time since reference or first frame: 2.186715000 seconds Frame Number: 3 Packet Length: 350 bytes Capture Length: 350 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:e0:4c:69:0a:78 Destination: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0x0aca5548 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.102 (165.227.249.102) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x00c3 (195) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa3c (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.102 (165.227.249.102) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xb33f (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x04E3A247F5ED5B98 Responder cookie: 0x80D912A84ACBF944 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Private USE (130) Length: 24 Nonce Data Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: Vendor ID (13) Length: 24 Payload Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E5... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 e0 4c 69 0a 78 00 0c 29 00 82 53 08 00 45 00 ..Li.x..)..S..E. 0010 01 4c 00 c3 00 00 80 11 fa 3c a5 e3 f9 73 a5 e3 .L.......<...s.. 0020 f9 66 01 f4 01 f4 01 38 b3 3f 04 e3 a2 47 f5 ed .f.....8.?...G.. 0030 5b 98 80 d9 12 a8 4a cb f9 44 04 10 02 00 00 00 [.....J..D...... 0040 00 00 00 00 01 30 0a 00 00 84 f9 45 52 d6 88 85 .....0.....ER... 0050 d0 de 73 fa 87 83 8c 83 73 8f eb 6f e0 c4 59 de ..s.....s..o..Y. 0060 92 89 bc 7f 2c cb e3 dc 7a 33 10 9f 1f 29 53 aa ....,...z3...)S. 0070 ee 9b da fd 67 85 85 6d 35 68 9a 70 60 3e ff 22 ....g..m5h.p`>." 0080 5a 6d 8d 0d f1 84 70 67 04 81 9b c9 2b 4f 7d a6 Zm....pg....+O}. 0090 25 18 03 b5 59 00 1f 04 ac 3f 3f 7b 9f 68 a0 39 %...Y....??{.h.9 00a0 b0 86 8b de 6f 4f 93 a9 5f b0 da 54 89 7f e2 af ....oO.._..T.... 00b0 40 64 de b5 9d df bd f6 ac ec 41 87 68 2b 21 81 @d........A.h+!. 00c0 a2 54 a4 2e 3a 7a 1f 22 7f 94 82 00 00 18 10 1b .T..:z."........ 00d0 22 da 9f 39 1c 77 a1 ff 44 3b ed b2 dd e5 eb 5c "..9.w..D;.....\ 00e0 8a 08 82 00 00 18 c3 be dd 29 ce b7 a7 56 c7 ca .........)...V.. 00f0 25 66 34 fa f5 9a ee a8 82 ca 0d 00 00 18 1e ba %f4............. 0100 fd 85 b9 81 39 c2 ea 48 ac 72 52 ff 34 98 76 1a ....9..H.rR.4.v. 0110 82 80 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 0a ca 55 48 ....&.......UH Frame 4 (314 bytes on wire, 314 bytes captured) Arrival Time: Jan 27, 2005 17:48:08.842485000 Time delta from previous packet: 0.009806000 seconds Time since reference or first frame: 2.196521000 seconds Frame Number: 4 Packet Length: 314 bytes Capture Length: 314 bytes Ethernet II, Src: 00:e0:4c:69:0a:78, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Type: IP (0x0800) Frame check sequence: 0x32217d5d (correct) Internet Protocol, Src Addr: 165.227.249.102 (165.227.249.102), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 296 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb23 (correct) Source: 165.227.249.102 (165.227.249.102) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 276 Checksum: 0x6c0d (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x04E3A247F5ED5B98 Responder cookie: 0x80D912A84ACBF944 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 268 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Private USE (130) Length: 12 Nonce Data Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: NONE (0) Length: 24 Payload 0000 00 0c 29 00 82 53 00 e0 4c 69 0a 78 08 00 45 00 ..)..S..Li.x..E. 0010 01 28 00 00 40 00 40 11 fb 23 a5 e3 f9 66 a5 e3 .(..@.@..#...f.. 0020 f9 73 01 f4 01 f4 01 14 6c 0d 04 e3 a2 47 f5 ed .s......l....G.. 0030 5b 98 80 d9 12 a8 4a cb f9 44 04 10 02 00 00 00 [.....J..D...... 0040 00 00 00 00 01 0c 0a 00 00 84 e7 01 7d 84 8f a2 ............}... 0050 f9 b9 97 cc 8b 7a 8c cf 4f 0d 06 be 7c bd f1 b8 .....z..O...|... 0060 3b 18 b2 90 60 a1 b0 53 b6 92 58 30 ab 95 1d d4 ;...`..S..X0.... 0070 6b e5 ba fd 8d e2 52 e6 98 4d ae 94 33 25 a8 a6 k.....R..M..3%.. 0080 2e d4 49 17 a0 92 ed a1 04 75 4c f4 b5 ce 74 3a ..I......uL...t: 0090 d1 4c 18 37 51 76 52 56 84 cd 48 7b f2 43 9d f1 .L.7QvRV..H{.C.. 00a0 5a 4e 49 34 a3 b0 4c 35 ae 89 31 2c ff a9 a2 07 ZNI4..L5..1,.... 00b0 94 83 90 a9 1d a9 dd 9e 33 eb da 51 bb a4 ba b8 ........3..Q.... 00c0 20 9f b1 07 f9 47 66 e9 64 4c 82 00 00 0c ca c4 ....Gf.dL...... 00d0 03 60 2f b3 3b 2c 82 00 00 18 1e ba fd 85 b9 81 .`/.;,.......... 00e0 39 c2 ea 48 ac 72 52 ff 34 98 76 1a 82 80 82 00 9..H.rR.4.v..... 00f0 00 18 e0 10 6e eb 69 4c f9 41 c9 d0 4f 34 a7 78 ....n.iL.A..O4.x 0100 53 2e 62 6a a2 ad 82 00 00 18 c3 be dd 29 ce b7 S.bj.........).. 0110 a7 56 c7 ca 25 66 34 fa f5 9a ee a8 82 ca 00 00 .V..%f4......... 0120 00 18 0c 5b 09 64 13 8d 74 bb d0 c0 c7 e6 44 3a ...[.d..t.....D: 0130 42 8d 72 b8 4a f3 32 21 7d 5d B.r.J.2!}] Frame 5 (138 bytes on wire, 138 bytes captured) Arrival Time: Jan 27, 2005 17:48:10.477994000 Time delta from previous packet: 1.635509000 seconds Time since reference or first frame: 3.832030000 seconds Frame Number: 5 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:e0:4c:69:0a:78 Destination: 00:e0:4c:69:0a:78 (00:e0:4c:69:0a:78) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0x67451231 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.102 (165.227.249.102) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x00c5 (197) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfb0e (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.102 (165.227.249.102) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x18f8 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x04E3A247F5ED5B98 Responder cookie: 0x80D912A84ACBF944 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 e0 4c 69 0a 78 00 0c 29 00 82 53 08 00 45 00 ..Li.x..)..S..E. 0010 00 78 00 c5 00 00 80 11 fb 0e a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 66 01 f4 01 f4 00 64 18 f8 04 e3 a2 47 f5 ed .f.....d.....G.. 0030 5b 98 80 d9 12 a8 4a cb f9 44 05 10 02 01 00 00 [.....J..D...... 0040 00 00 00 00 00 5c 81 5a 99 66 e2 1d 7b 91 91 dc .....\.Z.f..{... 0050 57 99 f0 f6 d3 c6 dc 86 fd 31 c3 5e a5 06 9e f2 W........1.^.... 0060 6a 1f cb b2 99 ec 74 32 28 df 71 98 ab 3c 4c 31 j.....t2(.q.....8F.s 0060 4b 76 3e 4a 96 ce 29 7c c3 d8 d9 9b c9 6e 07 21 Kv>J..)|.....n.! 0070 6d 9f 6e ea 28 57 a4 4e 01 15 96 75 62 d1 ca 75 m.n.(W.N...ub..u 0080 6e 96 5e ae 14 33 e0 29 13 94 72 0f b4 cb 73 6b n.^..3.)..r...sk 0090 dd 2e ef 93 27 4c 8f 67 70 ef a9 15 52 1d b9 28 ....'L.gp...R..( 00a0 4f 74 c5 e6 19 11 54 7b 1e f6 df 75 3e 73 e7 8b Ot....T{...u>s.. 00b0 03 81 d0 82 a8 0a a8 5a 3f 36 c8 83 9c b7 ea 55 .......Z?6.....U 00c0 6c ba 99 b5 39 78 4a 33 06 c0 ff 43 7a 84 a2 3c l...9xJ3...Cz..< 00d0 be 07 c0 9a d7 1a eb ec d1 88 50 2a a8 20 37 e4 ..........P*. 7. 00e0 77 9b ab 10 71 47 fa e0 01 18 0f 39 65 81 cd 5a w...qG.....9e..Z 00f0 b7 3d 64 d3 d9 03 66 e8 b0 d6 e6 c7 15 50 40 2a .=d...f......P@* 0100 b9 75 27 d4 63 c3 9b 37 ce e3 fb d6 85 c2 89 65 .u'.c..7.......e 0110 a8 63 67 32 02 db b8 b3 21 34 ec c5 e6 3c 41 05 .cg2....!4...