Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Apr 1, 2005 13:07:32.556047000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 166 bytes Capture Length: 166 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:d0:c9:94:ef:f7 Destination: 00:d0:c9:94:ef:f7 (00:d0:c9:94:ef:f7) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0x9fff3129 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.103 (165.227.249.103) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 148 Identification: 0x00b2 (178) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfb04 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.103 (165.227.249.103) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 128 Checksum: 0xcecb (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x75437062C295163F Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 120 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 d0 c9 94 ef f7 00 0c 29 00 82 53 08 00 45 00 ........)..S..E. 0010 00 94 00 b2 00 00 80 11 fb 04 a5 e3 f9 73 a5 e3 .............s.. 0020 f9 67 01 f4 01 f4 00 80 ce cb 75 43 70 62 c2 95 .g........uCpb.. 0030 16 3f 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .?.............. 0040 00 00 00 00 00 78 0d 00 00 34 00 00 00 01 00 00 .....x...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 0e 10 0d 00 00 14 44 85 ..............D. 0080 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 00 00 .-.......F.y.... 0090 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 ......>.in.c...B 00a0 7b 1f 9f ff 31 29 {...1) Frame 2 (186 bytes on wire, 186 bytes captured) Arrival Time: Apr 1, 2005 13:07:32.560980000 Time delta from previous packet: 0.004933000 seconds Time since reference or first frame: 0.004933000 seconds Frame Number: 2 Packet Length: 186 bytes Capture Length: 186 bytes Ethernet II, Src: 00:d0:c9:94:ef:f7, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:d0:c9:94:ef:f7 (00:d0:c9:94:ef:f7) Type: IP (0x0800) Frame check sequence: 0xbc661281 (correct) Internet Protocol, Src Addr: 165.227.249.103 (165.227.249.103), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 168 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba2 (correct) Source: 165.227.249.103 (165.227.249.103) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 148 Checksum: 0x4fe9 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x75437062C295163F Responder cookie: 0xB708A655CDA5AFAB Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 140 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-dpd-00.txt Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x648982785BEDBDD66A6DD356F0E160FD 0000 00 0c 29 00 82 53 00 d0 c9 94 ef f7 08 00 45 00 ..)..S........E. 0010 00 a8 00 00 40 00 40 11 fb a2 a5 e3 f9 67 a5 e3 ....@.@......g.. 0020 f9 73 01 f4 01 f4 00 94 4f e9 75 43 70 62 c2 95 .s......O.uCpb.. 0030 16 3f b7 08 a6 55 cd a5 af ab 01 10 02 00 00 00 .?...U.......... 0040 00 00 00 00 00 8c 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 0e 10 0d 00 00 14 90 cb ................ 0080 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 ..>.in.c...B{... 0090 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00a0 01 00 00 00 00 14 64 89 82 78 5b ed bd d6 6a 6d ......d..x[...jm 00b0 d3 56 f0 e1 60 fd bc 66 12 81 .V..`..f.. Frame 3 (350 bytes on wire, 350 bytes captured) Arrival Time: Apr 1, 2005 13:07:34.771618000 Time delta from previous packet: 2.210638000 seconds Time since reference or first frame: 2.215571000 seconds Frame Number: 3 Packet Length: 350 bytes Capture Length: 350 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:d0:c9:94:ef:f7 Destination: 00:d0:c9:94:ef:f7 (00:d0:c9:94:ef:f7) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0xbc02e7f0 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.103 (165.227.249.103) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x00b3 (179) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa4b (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.103 (165.227.249.103) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0x526e (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x75437062C295163F Responder cookie: 0xB708A655CDA5AFAB Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Private USE (130) Length: 24 Nonce Data Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: Vendor ID (13) Length: 24 Payload Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E5... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 d0 c9 94 ef f7 00 0c 29 00 82 53 08 00 45 00 ........)..S..E. 0010 01 4c 00 b3 00 00 80 11 fa 4b a5 e3 f9 73 a5 e3 .L.......K...s.. 0020 f9 67 01 f4 01 f4 01 38 52 6e 75 43 70 62 c2 95 .g.....8RnuCpb.. 0030 16 3f b7 08 a6 55 cd a5 af ab 04 10 02 00 00 00 .?...U.......... 0040 00 00 00 00 01 30 0a 00 00 84 c7 8b 30 03 ab 7a .....0......0..z 0050 25 d5 2d 88 59 6e 83 0d d9 9d 87 ef 2a 92 b7 fe %.-.Yn......*... 0060 09 9d cb 4f 3d 64 b7 0e 07 79 bd d0 44 bb dc f0 ...O=d...y..D... 0070 34 9e d8 ad 63 fe 53 2b 3e df 03 a0 fd 41 f4 ad 4...c.S+>....A.. 0080 77 db af 75 83 b1 6c 1c 4b ee da 4d 84 d2 ea 61 w..u..l.K..M...a 0090 c7 9e 79 7e 9e 49 18 79 eb 38 ff 20 67 3a be 02 ..y~.I.y.8. g:.. 00a0 97 ec e1 02 18 b1 a3 8f 1e 60 9d e7 87 2e 6c ad .........`....l. 00b0 ae f1 67 d0 bb cc 55 b0 48 d7 fe 7d 81 ca e3 6d ..g...U.H..}...m 00c0 8d ed a0 79 74 40 ec 6f cd 7e 82 00 00 18 b8 06 ...yt@.o.~...... 00d0 ba 39 6a c8 f5 cf 87 9e 8e dd 8c e0 00 04 b1 d7 .9j............. 00e0 4b f9 82 00 00 18 ba 74 3a a3 87 ef ed eb 70 4e K......t:.....pN 00f0 80 9d 51 a8 24 5b 41 94 8b 87 0d 00 00 18 6a b3 ..Q.$[A.......j. 0100 14 b3 49 b8 0b 68 bc b5 21 89 fa 36 51 17 25 03 ..I..h..!..6Q.%. 0110 14 c2 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 bc 02 e7 f0 ....&......... Frame 4 (290 bytes on wire, 290 bytes captured) Arrival Time: Apr 1, 2005 13:07:34.913270000 Time delta from previous packet: 0.141652000 seconds Time since reference or first frame: 2.357223000 seconds Frame Number: 4 Packet Length: 290 bytes Capture Length: 290 bytes Ethernet II, Src: 00:d0:c9:94:ef:f7, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:d0:c9:94:ef:f7 (00:d0:c9:94:ef:f7) Type: IP (0x0800) Frame check sequence: 0x4fe998c3 (correct) Internet Protocol, Src Addr: 165.227.249.103 (165.227.249.103), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 272 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb3a (correct) Source: 165.227.249.103 (165.227.249.103) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 252 Checksum: 0xe813 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x75437062C295163F Responder cookie: 0xB708A655CDA5AFAB Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 244 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Private USE (130) Length: 12 Nonce Data Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: NONE (0) Length: 24 Payload 0000 00 0c 29 00 82 53 00 d0 c9 94 ef f7 08 00 45 00 ..)..S........E. 0010 01 10 00 00 40 00 40 11 fb 3a a5 e3 f9 67 a5 e3 ....@.@..:...g.. 0020 f9 73 01 f4 01 f4 00 fc e8 13 75 43 70 62 c2 95 .s........uCpb.. 0030 16 3f b7 08 a6 55 cd a5 af ab 04 10 02 00 00 00 .?...U.......... 0040 00 00 00 00 00 f4 0a 00 00 84 46 bb 6e 6d 17 3e ..........F.nm.> 0050 10 06 5c f4 5a 06 90 f8 4f 1f 1f 7d 23 cd 1b a1 ..\.Z...O..}#... 0060 42 2e ed 1e c8 63 e5 b2 03 59 45 78 7a 7f 11 12 B....c...YExz... 0070 0b 73 e6 79 17 3d 1d 3a 93 de 2c 0e 11 68 ea 22 .s.y.=.:..,..h." 0080 5a c1 a6 83 7d f9 7c 2e c8 c3 19 ba d1 01 ea 8b Z...}.|......... 0090 1a 35 92 4c 73 9a ec bc b3 7c 73 a2 2c 3d c0 88 .5.Ls....|s.,=.. 00a0 42 70 b9 b6 b3 44 8f d2 3a 5b 7d 9e 93 07 e7 f9 Bp...D..:[}..... 00b0 07 b8 b6 b1 8c ce 47 89 20 72 7d 2a e0 ab 89 09 ......G. r}*.... 00c0 8b 7e f1 3d 0d 6a c5 24 49 cc 82 00 00 0c eb 7c .~.=.j.$I......| 00d0 99 7e 90 e2 3d dd 82 00 00 18 6a b3 14 b3 49 b8 .~..=.....j...I. 00e0 0b 68 bc b5 21 89 fa 36 51 17 25 03 14 c2 82 00 .h..!..6Q.%..... 00f0 00 18 17 aa 97 71 ef a1 b2 7f 5f ee ae bf 46 08 .....q...._...F. 0100 4d 06 6c ac 52 6d 00 00 00 18 ba 74 3a a3 87 ef M.l.Rm.....t:... 0110 ed eb 70 4e 80 9d 51 a8 24 5b 41 94 8b 87 4f e9 ..pN..Q.$[A...O. 0120 98 c3 .. Frame 5 (138 bytes on wire, 138 bytes captured) Arrival Time: Apr 1, 2005 13:07:36.659662000 Time delta from previous packet: 1.746392000 seconds Time since reference or first frame: 4.103615000 seconds Frame Number: 5 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:d0:c9:94:ef:f7 Destination: 00:d0:c9:94:ef:f7 (00:d0:c9:94:ef:f7) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0xf8d0d066 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.103 (165.227.249.103) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x00b5 (181) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfb1d (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.103 (165.227.249.103) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x2ecc (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x75437062C295163F Responder cookie: 0xB708A655CDA5AFAB Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 d0 c9 94 ef f7 00 0c 29 00 82 53 08 00 45 00 ........)..S..E. 0010 00 78 00 b5 00 00 80 11 fb 1d a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 67 01 f4 01 f4 00 64 2e cc 75 43 70 62 c2 95 .g.....d..uCpb.. 0030 16 3f b7 08 a6 55 cd a5 af ab 05 10 02 01 00 00 .?...U.......... 0040 00 00 00 00 00 5c d7 3b 85 8b 39 23 8a 68 01 8a .....\.;..9#.h.. 0050 ee a2 a1 5a d7 39 66 0d 0d c7 7a 81 0d d2 15 82 ...Z.9f...z..... 0060 51 63 7f 54 19 87 1d c0 13 64 20 9d 0e fa eb 0f Qc.T.....d ..... 0070 6b 64 d8 f6 53 b7 08 a3 ee 79 48 61 cb 38 a9 c1 kd..S....yHa.8.. 0080 bf 6f 2c 2b e4 48 f8 d0 d0 66 .o,+.H...f Frame 6 (138 bytes on wire, 138 bytes captured) Arrival Time: Apr 1, 2005 13:07:36.827251000 Time delta from previous packet: 0.167589000 seconds Time since reference or first frame: 4.271204000 seconds Frame Number: 6 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:d0:c9:94:ef:f7, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:d0:c9:94:ef:f7 (00:d0:c9:94:ef:f7) Type: IP (0x0800) Frame check sequence: 0x01f22d74 (correct) Internet Protocol, Src Addr: 165.227.249.103 (165.227.249.103), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbd2 (correct) Source: 165.227.249.103 (165.227.249.103) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xe4a3 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x75437062C295163F Responder cookie: 0xB708A655CDA5AFAB Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 00 82 53 00 d0 c9 94 ef f7 08 00 45 00 ..)..S........E. 0010 00 78 00 00 40 00 40 11 fb d2 a5 e3 f9 67 a5 e3 .x..@.@......g.. 0020 f9 73 01 f4 01 f4 00 64 e4 a3 75 43 70 62 c2 95 .s.....d..uCpb.. 0030 16 3f b7 08 a6 55 cd a5 af ab 05 10 02 01 00 00 .?...U.......... 0040 00 00 00 00 00 5c 8e 76 43 cb eb 12 fe 4f a6 b0 .....\.vC....O.. 0050 85 82 dc 00 b9 ba 1d 8c 13 44 7a bb 7a cd cb 76 .........Dz.z..v 0060 5f b7 bc b2 34 a7 b9 82 5b 24 de ef fe cf 29 86 _...4...[$....). 0070 64 19 b7 31 9b e3 6a be 28 89 7c 89 30 56 2f c6 d..1..j.(.|.0V/. 0080 51 0f 02 7c e0 56 01 f2 2d 74 Q..|.V..-t Frame 7 (338 bytes on wire, 338 bytes captured) Arrival Time: Apr 1, 2005 13:07:39.029654000 Time delta from previous packet: 2.202403000 seconds Time since reference or first frame: 6.473607000 seconds Frame Number: 7 Packet Length: 338 bytes Capture Length: 338 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:d0:c9:94:ef:f7 Destination: 00:d0:c9:94:ef:f7 (00:d0:c9:94:ef:f7) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0x09804259 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.103 (165.227.249.103) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x00b7 (183) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa53 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.103 (165.227.249.103) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x4927 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x75437062C295163F Responder cookie: 0xB708A655CDA5AFAB Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x81576574 Length: 292 Encrypted payload (264 bytes) 0000 00 d0 c9 94 ef f7 00 0c 29 00 82 53 08 00 45 00 ........)..S..E. 0010 01 40 00 b7 00 00 80 11 fa 53 a5 e3 f9 73 a5 e3 .@.......S...s.. 0020 f9 67 01 f4 01 f4 01 2c 49 27 75 43 70 62 c2 95 .g.....,I'uCpb.. 0030 16 3f b7 08 a6 55 cd a5 af ab 08 10 20 01 81 57 .?...U...... ..W 0040 65 74 00 00 01 24 32 7a 6e 44 f5 b8 2d fc 81 f6 et...$2znD..-... 0050 e2 9e 35 cd 1e e9 ef 5a 50 72 a2 67 0b 99 0e 62 ..5....ZPr.g...b 0060 78 09 81 3c 76 c7 6b 8c c7 94 b5 77 3b ee dc d9 x...{.......... 00a0 dd b5 a0 38 13 86 f9 88 b4 c4 dc 67 c4 03 1f 72 ...8.......g...r 00b0 c7 9c 20 fd 39 7c 9f 71 ee af 0d 5b 36 51 6e c6 .. .9|.q...[6Qn. 00c0 59 a2 7e 80 cd b6 13 26 1c f8 3b 29 03 66 54 a2 Y.~....&..;).fT. 00d0 ca 51 d0 73 2f 82 41 85 5b 21 c6 00 fd 46 6b f9 .Q.s/.A.[!...Fk. 00e0 26 58 f9 1b cb 0c 8c 4e 28 02 4c 0f 2a 92 0b a4 &X.....N(.L.*... 00f0 8e 4a 18 15 20 f3 01 b7 2e 5f 40 6e 67 dd fe f3 .J.. ...._@ng... 0100 48 53 0f 13 f6 48 63 80 b8 03 64 2c 88 fa e9 21 HS...Hc...d,...! 0110 01 0d c4 df 60 2e 6c 7f 5b 95 cf 57 27 2e 36 cb ....`.l.[..W'.6. 0120 0c fe 47 f3 bf 48 dd da 69 87 2b 1c 35 60 76 39 ..G..H..i.+.5`v9 0130 e5 c7 67 ed ad 10 3d a7 d4 2b 1c 79 95 f2 11 eb ..g...=..+.y.... 0140 5f db e7 8b 14 39 94 60 85 e8 92 d8 9b 82 09 80 _....9.`........ 0150 42 59 BY Frame 8 (322 bytes on wire, 322 bytes captured) Arrival Time: Apr 1, 2005 13:07:39.173088000 Time delta from previous packet: 0.143434000 seconds Time since reference or first frame: 6.617041000 seconds Frame Number: 8 Packet Length: 322 bytes Capture Length: 322 bytes Ethernet II, Src: 00:d0:c9:94:ef:f7, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:d0:c9:94:ef:f7 (00:d0:c9:94:ef:f7) Type: IP (0x0800) Frame check sequence: 0x989b1630 (correct) Internet Protocol, Src Addr: 165.227.249.103 (165.227.249.103), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 304 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb1a (correct) Source: 165.227.249.103 (165.227.249.103) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 284 Checksum: 0x51e4 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x75437062C295163F Responder cookie: 0xB708A655CDA5AFAB Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x81576574 Length: 276 Encrypted payload (248 bytes) 0000 00 0c 29 00 82 53 00 d0 c9 94 ef f7 08 00 45 00 ..)..S........E. 0010 01 30 00 00 40 00 40 11 fb 1a a5 e3 f9 67 a5 e3 .0..@.@......g.. 0020 f9 73 01 f4 01 f4 01 1c 51 e4 75 43 70 62 c2 95 .s......Q.uCpb.. 0030 16 3f b7 08 a6 55 cd a5 af ab 08 10 20 01 81 57 .?...U...... ..W 0040 65 74 00 00 01 14 7d 9b 88 ad 8f 02 5f 52 ac 3f et....}....._R.? 0050 bd de d1 d7 8c 09 16 5f 0e fc 1d 10 5f e2 b6 83 ......._...._... 0060 88 88 73 c2 73 09 d5 d6 d1 c5 19 92 5f fa 88 25 ..s.s......._..% 0070 81 47 46 f1 ed 09 0d c8 a0 22 0a 1f 5a 1e 83 98 .GF......"..Z... 0080 54 e2 6f 8f 97 22 a9 68 7d 02 a3 21 56 12 86 1a T.o..".h}..!V... 0090 bd 10 bc 94 60 61 f1 8b 7b 4d 27 17 cb 4d e0 48 ....`a..{M'..M.H 00a0 86 23 6c b0 17 46 58 ba 32 f6 c4 d6 82 40 b0 f4 .#l..FX.2....@.. 00b0 15 bd 09 ab 0e e0 26 48 90 b0 30 aa a0 fe c0 93 ......&H..0..... 00c0 ce 9c df 44 62 fa a6 dc a0 91 ca 32 7e 93 9d 9c ...Db......2~... 00d0 99 0c 36 0c ad 6d 2f 4d 53 0b 46 57 cc 9b 47 b5 ..6..m/MS.FW..G. 00e0 e1 db bf 9a 15 0e d6 0d 17 55 33 02 5d 8a e4 77 .........U3.]..w 00f0 e5 a5 7a 5d 06 97 e4 92 6c 3f a6 e9 0d de 76 9f ..z]....l?....v. 0100 75 dc af fb 19 24 9a 64 eb 25 30 5e fd 16 d8 a1 u....$.d.%0^.... 0110 df 1d 64 ca b9 b8 42 2a fd 0b 93 ab e6 df a3 a7 ..d...B*........ 0120 37 2c 2c ef 1a 4b bd 3e dd 43 f0 72 9b 75 69 e9 7,,..K.>.C.r.ui. 0130 f4 1d 20 17 4e b0 a3 61 ab 31 09 4c a3 c9 98 9b .. .N..a.1.L.... 0140 16 30 .0 Frame 9 (98 bytes on wire, 98 bytes captured) Arrival Time: Apr 1, 2005 13:07:39.183306000 Time delta from previous packet: 0.010218000 seconds Time since reference or first frame: 6.627259000 seconds Frame Number: 9 Packet Length: 98 bytes Capture Length: 98 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:d0:c9:94:ef:f7 Destination: 00:d0:c9:94:ef:f7 (00:d0:c9:94:ef:f7) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0x97dbcfce (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.103 (165.227.249.103) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 80 Identification: 0x00b8 (184) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfb42 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.103 (165.227.249.103) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 60 Checksum: 0x8782 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x75437062C295163F Responder cookie: 0xB708A655CDA5AFAB Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x81576574 Length: 52 Encrypted payload (24 bytes) 0000 00 d0 c9 94 ef f7 00 0c 29 00 82 53 08 00 45 00 ........)..S..E. 0010 00 50 00 b8 00 00 80 11 fb 42 a5 e3 f9 73 a5 e3 .P.......B...s.. 0020 f9 67 01 f4 01 f4 00 3c 87 82 75 43 70 62 c2 95 .g.....<..uCpb.. 0030 16 3f b7 08 a6 55 cd a5 af ab 08 10 20 01 81 57 .?...U...... ..W 0040 65 74 00 00 00 34 b9 b8 1d 85 2e bf f9 f8 1b 08 et...4.......... 0050 3d ea f2 2d 6c ef 6a 39 69 17 63 45 9e 91 97 db =..-l.j9i.cE.... 0060 cf ce .. Frame 10 (130 bytes on wire, 130 bytes captured) Arrival Time: Apr 1, 2005 13:07:42.844360000 Time delta from previous packet: 3.661054000 seconds Time since reference or first frame: 10.288313000 seconds Frame Number: 10 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:d0:c9:94:ef:f7 Destination: 00:d0:c9:94:ef:f7 (00:d0:c9:94:ef:f7) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0x2bda8e52 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.103 (165.227.249.103) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0001 (1) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfbb8 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.103 (165.227.249.103) Encapsulating Security Payload SPI: 0xc63a4ac6 Sequence: 1 Data (84 bytes) 0000 00 d0 c9 94 ef f7 00 0c 29 00 82 53 08 00 45 00 ........)..S..E. 0010 00 70 00 01 00 00 80 32 fb b8 a5 e3 f9 73 a5 e3 .p.....2.....s.. 0020 f9 67 c6 3a 4a c6 00 00 00 01 dc 69 f6 5e ea b5 .g.:J......i.^.. 0030 1d 2f f7 4e 56 f7 a0 64 08 1c 9c 2d 91 b1 b1 9c ./.NV..d...-.... 0040 d8 73 06 d6 d5 d5 b6 3c 1c 44 03 e7 3d c6 e5 3c .s.....<.D..=..< 0050 89 27 b1 a3 57 d4 49 23 46 ae d6 03 de c6 2d 68 .'..W.I#F.....-h 0060 ee 78 3f 5e 6f 2b 2f 50 95 26 21 00 06 74 86 7c .x?^o+/P.&!..t.| 0070 45 e1 3a 6f 29 e3 d6 76 e8 1d 18 fa 47 91 2b da E.:o)..v....G.+. 0080 8e 52 .R Frame 11 (130 bytes on wire, 130 bytes captured) Arrival Time: Apr 1, 2005 13:07:42.845746000 Time delta from previous packet: 0.001386000 seconds Time since reference or first frame: 10.289699000 seconds Frame Number: 11 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:d0:c9:94:ef:f7, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:d0:c9:94:ef:f7 (00:d0:c9:94:ef:f7) Type: IP (0x0800) Frame check sequence: 0x116bf3b4 (correct) Internet Protocol, Src Addr: 165.227.249.103 (165.227.249.103), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x000c (12) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 30 Protocol: ESP (0x32) Header checksum: 0x5dae (correct) Source: 165.227.249.103 (165.227.249.103) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x1577535f Sequence: 1 Data (84 bytes) 0000 00 0c 29 00 82 53 00 d0 c9 94 ef f7 08 00 45 00 ..)..S........E. 0010 00 70 00 0c 00 00 1e 32 5d ae a5 e3 f9 67 a5 e3 .p.....2]....g.. 0020 f9 73 15 77 53 5f 00 00 00 01 87 b7 8c 31 4d 60 .s.wS_.......1M` 0030 da a1 0f da 58 fb 1a 2b be fd b2 88 32 41 df 81 ....X..+....2A.. 0040 f1 5c b2 cb c5 b4 96 79 55 37 5f 35 ff cb 3e 06 .\.....yU7_5..>. 0050 28 80 d8 44 79 07 2e 01 5d 60 67 d7 d1 81 99 69 (..Dy...]`g....i 0060 28 9a b7 5a 01 db 21 52 7b 32 83 3d 18 2d b1 64 (..Z..!R{2.=.-.d 0070 f8 b2 3d 0f f6 f0 34 97 45 d6 e0 a2 b1 7b 11 6b ..=...4.E....{.k 0080 f3 b4 .. Frame 12 (130 bytes on wire, 130 bytes captured) Arrival Time: Apr 1, 2005 13:07:43.859762000 Time delta from previous packet: 1.014016000 seconds Time since reference or first frame: 11.303715000 seconds Frame Number: 12 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0c:29:00:82:53, Dst: 00:d0:c9:94:ef:f7 Destination: 00:d0:c9:94:ef:f7 (00:d0:c9:94:ef:f7) Source: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Type: IP (0x0800) Frame check sequence: 0x83d02a21 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.103 (165.227.249.103) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0002 (2) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfbb7 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.103 (165.227.249.103) Encapsulating Security Payload SPI: 0xc63a4ac6 Sequence: 2 Data (84 bytes) 0000 00 d0 c9 94 ef f7 00 0c 29 00 82 53 08 00 45 00 ........)..S..E. 0010 00 70 00 02 00 00 80 32 fb b7 a5 e3 f9 73 a5 e3 .p.....2.....s.. 0020 f9 67 c6 3a 4a c6 00 00 00 02 21 00 06 74 86 7c .g.:J.....!..t.| 0030 45 e1 7b e3 22 b1 c2 2b 56 e9 d5 c8 f5 7f 13 da E.{."..+V....... 0040 c5 87 a2 c4 99 21 72 25 f6 31 54 77 fb 21 65 f0 .....!r%.1Tw.!e. 0050 dd 47 65 b8 2a b1 0d fe f7 ff 69 95 60 68 f8 14 .Ge.*.....i.`h.. 0060 2e 57 9a 51 c9 58 9a dd 79 f2 e0 cb e3 d7 f9 10 .W.Q.X..y....... 0070 db 98 26 1d be f4 1c 34 37 32 b1 54 e3 66 83 d0 ..&....472.T.f.. 0080 2a 21 *! Frame 13 (130 bytes on wire, 130 bytes captured) Arrival Time: Apr 1, 2005 13:07:43.860723000 Time delta from previous packet: 0.000961000 seconds Time since reference or first frame: 11.304676000 seconds Frame Number: 13 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:d0:c9:94:ef:f7, Dst: 00:0c:29:00:82:53 Destination: 00:0c:29:00:82:53 (00:0c:29:00:82:53) Source: 00:d0:c9:94:ef:f7 (00:d0:c9:94:ef:f7) Type: IP (0x0800) Frame check sequence: 0x8b1d9a64 (correct) Internet Protocol, Src Addr: 165.227.249.103 (165.227.249.103), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x000d (13) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 30 Protocol: ESP (0x32) Header checksum: 0x5dad (correct) Source: 165.227.249.103 (165.227.249.103) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x1577535f Sequence: 2 Data (84 bytes) 0000 00 0c 29 00 82 53 00 d0 c9 94 ef f7 08 00 45 00 ..)..S........E. 0010 00 70 00 0d 00 00 1e 32 5d ad a5 e3 f9 67 a5 e3 .p.....2]....g.. 0020 f9 73 15 77 53 5f 00 00 00 02 b6 b5 78 76 01 86 .s.wS_......xv.. 0030 60 cd c0 46 17 1a 0f 82 35 da 21 29 d9 05 49 4a `..F....5.!)..IJ 0040 c4 56 51 53 bd 34 10 62 43 e1 7d ec 8d c0 9f a2 .VQS.4.bC.}..... 0050 0a e0 cd c8 c8 ee 29 42 dd 55 ae 30 23 f1 24 cb ......)B.U.0#.$. 0060 ab b5 f6 3c f1 36 be 34 8d 79 41 52 c9 67 24 3d ...<.6.4.yAR.g$= 0070 f9 ca a7 69 6b b8 f6 00 fa 8f a2 da bc 4d 8b 1d ...ik........M.. 0080 9a 64 .d