Frame 1 (162 bytes on wire, 162 bytes captured) Arrival Time: Nov 25, 2006 16:45:59.294939000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 162 bytes Capture Length: 162 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Destination: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.105 (165.227.249.105) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 148 Identification: 0x0193 (403) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa21 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.105 (165.227.249.105) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 128 Checksum: 0x7ce6 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE89CAF6C89A0EEB3 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 120 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 18 4d 09 98 ab 00 0c 29 ab 06 ab 08 00 45 00 ..M.....).....E. 0010 00 94 01 93 00 00 80 11 fa 21 a5 e3 f9 73 a5 e3 .........!...s.. 0020 f9 69 01 f4 01 f4 00 80 7c e6 e8 9c af 6c 89 a0 .i......|....l.. 0030 ee b3 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 78 0d 00 00 34 00 00 00 01 00 00 .....x...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 0e 10 0d 00 00 14 44 85 ..............D. 0080 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 00 00 .-.......F.y.... 0090 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 ......>.in.c...B 00a0 7b 1f {. Frame 2 (142 bytes on wire, 142 bytes captured) Arrival Time: Nov 25, 2006 16:45:59.562623000 Time delta from previous packet: 0.267684000 seconds Time since reference or first frame: 0.267684000 seconds Frame Number: 2 Packet Length: 142 bytes Capture Length: 142 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:18:4d:09:98:ab (00:18:4d:09:98:ab), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.105 (165.227.249.105), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc8 [correct] Good: True Bad : False Source: 165.227.249.105 (165.227.249.105) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0x4aef [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE89CAF6C89A0EEB3 Responder cookie: 0x4E6A461D43CF0B79 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 ab 06 ab 00 18 4d 09 98 ab 08 00 45 00 ..).....M.....E. 0010 00 80 00 00 40 00 40 11 fb c8 a5 e3 f9 69 a5 e3 ....@.@......i.. 0020 f9 73 01 f4 01 f4 00 6c 4a ef e8 9c af 6c 89 a0 .s.....lJ....l.. 0030 ee b3 4e 6a 46 1d 43 cf 0b 79 01 10 02 00 00 00 ..NjF.C..y...... 0040 00 00 00 00 00 64 0d 00 00 34 00 00 00 01 00 00 .....d...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 0e 10 00 00 00 14 af ca ................ 0080 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 3 (298 bytes on wire, 298 bytes captured) Arrival Time: Nov 25, 2006 16:46:01.698727000 Time delta from previous packet: 2.136104000 seconds Time since reference or first frame: 2.403788000 seconds Frame Number: 3 Packet Length: 298 bytes Capture Length: 298 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Destination: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.105 (165.227.249.105) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x0194 (404) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf998 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.105 (165.227.249.105) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0x28e5 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE89CAF6C89A0EEB3 Responder cookie: 0x4E6A461D43CF0B79 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 18 4d 09 98 ab 00 0c 29 ab 06 ab 08 00 45 00 ..M.....).....E. 0010 01 1c 01 94 00 00 80 11 f9 98 a5 e3 f9 73 a5 e3 .............s.. 0020 f9 69 01 f4 01 f4 01 08 28 e5 e8 9c af 6c 89 a0 .i......(....l.. 0030 ee b3 4e 6a 46 1d 43 cf 0b 79 04 10 02 00 00 00 ..NjF.C..y...... 0040 00 00 00 00 01 00 0a 00 00 84 64 96 9f 61 d9 92 ..........d..a.. 0050 11 b5 70 89 70 76 4d 6c 2b cb 4e e7 1f 2d b9 22 ..p.pvMl+.N..-." 0060 ff bb 0a 89 36 7e 44 ce eb d2 53 c9 97 08 b1 b8 ....6~D...S..... 0070 6a ee 84 06 a0 02 31 6e 57 e4 3a 63 57 a6 4c 49 j.....1nW.:cW.LI 0080 9c 86 c2 20 8b e9 0c e1 17 5d f9 a9 40 10 39 df ... .....]..@.9. 0090 63 aa df e3 1c 1b 83 bf 48 52 41 c4 63 ce d4 bc c.......HRA.c... 00a0 1a b6 9e 09 b0 cf 11 c4 b7 d1 4b b6 9f 72 d1 89 ..........K..r.. 00b0 3c 85 db d7 18 32 59 f1 57 c0 f0 0c c1 bd 52 72 <....2Y.W.....Rr 00c0 10 47 49 50 ae e9 83 d2 13 49 0d 00 00 18 b0 03 .GIP.....I...... 00d0 27 a8 e4 07 47 fd f9 9f c6 42 4f 6f eb ee 16 6a '...G....BOo...j 00e0 80 24 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 .$...0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Nov 25, 2006 16:46:01.996188000 Time delta from previous packet: 0.297461000 seconds Time since reference or first frame: 2.701249000 seconds Frame Number: 4 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:18:4d:09:98:ab (00:18:4d:09:98:ab), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.105 (165.227.249.105), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb78 [correct] Good: True Bad : False Source: 165.227.249.105 (165.227.249.105) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x7441 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE89CAF6C89A0EEB3 Responder cookie: 0x4E6A461D43CF0B79 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 ab 06 ab 00 18 4d 09 98 ab 08 00 45 00 ..).....M.....E. 0010 00 d0 00 00 40 00 40 11 fb 78 a5 e3 f9 69 a5 e3 ....@.@..x...i.. 0020 f9 73 01 f4 01 f4 00 bc 74 41 e8 9c af 6c 89 a0 .s......tA...l.. 0030 ee b3 4e 6a 46 1d 43 cf 0b 79 04 10 02 00 00 00 ..NjF.C..y...... 0040 00 00 00 00 00 b4 0a 00 00 84 d4 25 9e 90 e8 f8 ...........%.... 0050 9e 3e 4d 4e 08 88 03 a2 91 d9 b3 2b 6a ca 2b fe .>MN.......+j.+. 0060 ba 9a 63 2a ed c2 6b 43 99 6e 45 68 7b ad 5a 82 ..c*..kC.nEh{.Z. 0070 14 fe 30 b4 43 75 52 c5 85 78 78 0c 1d bc 36 09 ..0.CuR..xx...6. 0080 6c 70 c5 12 8a 15 b2 a8 37 78 75 72 84 5a ff a6 lp......7xur.Z.. 0090 9d 2e 7c 32 c5 72 ed 09 1f 9c af 3d 80 e9 9b 15 ..|2.r.....=.... 00a0 59 0f 99 96 bf 73 92 95 c0 e5 a6 d7 49 27 55 fb Y....s......I'U. 00b0 49 52 76 c4 66 68 88 6e c9 f0 9d 6a bd f7 c6 6e IRv.fh.n...j...n 00c0 52 ed 7f 19 3a c9 f5 7b 14 71 00 00 00 14 fb b4 R...:..{.q...... 00d0 3f 7d a7 61 57 00 a0 73 58 bf 4f ea e4 4e ?}.aW..sX.O..N Frame 5 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 25, 2006 16:46:03.707289000 Time delta from previous packet: 1.711101000 seconds Time since reference or first frame: 4.412350000 seconds Frame Number: 5 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Destination: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.105 (165.227.249.105) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0195 (405) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa3b [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.105 (165.227.249.105) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x2ef3 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE89CAF6C89A0EEB3 Responder cookie: 0x4E6A461D43CF0B79 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 18 4d 09 98 ab 00 0c 29 ab 06 ab 08 00 45 00 ..M.....).....E. 0010 00 78 01 95 00 00 80 11 fa 3b a5 e3 f9 73 a5 e3 .x.......;...s.. 0020 f9 69 01 f4 01 f4 00 64 2e f3 e8 9c af 6c 89 a0 .i.....d.....l.. 0030 ee b3 4e 6a 46 1d 43 cf 0b 79 05 10 02 01 00 00 ..NjF.C..y...... 0040 00 00 00 00 00 5c 82 0d a6 0b 26 73 65 8b fe 88 .....\....&se... 0050 a1 24 b7 0e 31 b0 75 22 d3 32 0c a6 6a 3b 2c 3a .$..1.u".2..j;,: 0060 af 3c 8f 17 a1 cc 86 e9 fd 39 96 55 0a 82 69 3b .<.......9.U..i; 0070 c1 3e dc 88 2b 9e 5b f1 28 81 03 1c 82 33 df 68 .>..+.[.(....3.h 0080 31 f9 86 a0 90 94 1..... Frame 6 (110 bytes on wire, 110 bytes captured) Arrival Time: Nov 25, 2006 16:46:03.833688000 Time delta from previous packet: 0.126399000 seconds Time since reference or first frame: 4.538749000 seconds Frame Number: 6 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:18:4d:09:98:ab (00:18:4d:09:98:ab), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.105 (165.227.249.105), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbe8 [correct] Good: True Bad : False Source: 165.227.249.105 (165.227.249.105) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x78c0 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE89CAF6C89A0EEB3 Responder cookie: 0x4E6A461D43CF0B79 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 ab 06 ab 00 18 4d 09 98 ab 08 00 45 00 ..).....M.....E. 0010 00 60 00 00 40 00 40 11 fb e8 a5 e3 f9 69 a5 e3 .`..@.@......i.. 0020 f9 73 01 f4 01 f4 00 4c 78 c0 e8 9c af 6c 89 a0 .s.....Lx....l.. 0030 ee b3 4e 6a 46 1d 43 cf 0b 79 05 10 02 01 00 00 ..NjF.C..y...... 0040 00 00 00 00 00 44 a9 bc 01 f6 b9 d7 d8 0a 94 53 .....D.........S 0050 01 e8 0b 04 31 0e 00 ac 68 d6 80 12 2b 9c 81 34 ....1...h...+..4 0060 d8 df 57 3e fa ce c4 51 11 34 a6 2d fb 9c ..W>...Q.4.-.. Frame 7 (334 bytes on wire, 334 bytes captured) Arrival Time: Nov 25, 2006 16:46:06.059196000 Time delta from previous packet: 2.225508000 seconds Time since reference or first frame: 6.764257000 seconds Frame Number: 7 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Destination: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.105 (165.227.249.105) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x0197 (407) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf971 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.105 (165.227.249.105) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x70cd [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE89CAF6C89A0EEB3 Responder cookie: 0x4E6A461D43CF0B79 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xDCC68695 Length: 292 Encrypted payload (264 bytes) 0000 00 18 4d 09 98 ab 00 0c 29 ab 06 ab 08 00 45 00 ..M.....).....E. 0010 01 40 01 97 00 00 80 11 f9 71 a5 e3 f9 73 a5 e3 .@.......q...s.. 0020 f9 69 01 f4 01 f4 01 2c 70 cd e8 9c af 6c 89 a0 .i.....,p....l.. 0030 ee b3 4e 6a 46 1d 43 cf 0b 79 08 10 20 01 dc c6 ..NjF.C..y.. ... 0040 86 95 00 00 01 24 18 ba 76 e8 b1 2e 5e 68 bb d1 .....$..v...^h.. 0050 cf a3 55 fe 7d 14 81 db 2f 4e 68 73 84 42 95 52 ..U.}.../Nhs.B.R 0060 db 52 ca 14 5a 32 65 0b 47 dc e2 00 26 84 72 73 .R..Z2e.G...&.rs 0070 a8 4f 55 ed 3c 93 a5 78 bf ec e5 d4 31 54 73 4e .OU.<..x....1TsN 0080 7f 87 51 3a b4 bb 09 2f 01 bd 9b e7 be 5b 6e 94 ..Q:.../.....[n. 0090 ce 74 85 5c 8d ce 0f 5b a1 2b 1a 51 ed 21 eb 36 .t.\...[.+.Q.!.6 00a0 13 e9 ad 5a 36 84 e1 7a 0d e7 63 a5 6e 96 25 28 ...Z6..z..c.n.%( 00b0 1d 56 29 c3 b5 7b 9f 70 91 dc 2e 21 72 e0 95 8e .V)..{.p...!r... 00c0 02 32 2e 2f e6 8d 3b 96 5a 47 93 67 8b dd 51 a6 .2./..;.ZG.g..Q. 00d0 d0 73 61 82 e2 a4 bd 79 2e 89 8a 72 43 23 2f e9 .sa....y...rC#/. 00e0 84 2d 1f a4 01 11 ac 2b b6 65 d7 88 fe 53 0d 55 .-.....+.e...S.U 00f0 2d da 82 f6 3a b0 a6 5a f4 de c2 24 3a bc 7a 61 -...:..Z...$:.za 0100 81 33 68 dc 06 0b b0 51 a1 88 de cb 3f 0b 89 56 .3h....Q....?..V 0110 f4 d2 d2 6f 3e da 7c e7 f0 82 c4 8f 19 a6 7e 1a ...o>.|.......~. 0120 8e 8a 6c 29 32 8f 0c bc 88 33 f4 aa 6e 74 2b 02 ..l)2....3..nt+. 0130 3f 93 e8 b5 d7 e8 c2 68 1c a0 81 e8 04 30 01 98 ?......h.....0.. 0140 64 02 e1 7f 87 94 2d 5a c3 15 e7 48 0b cd d.....-Z...H.. Frame 8 (326 bytes on wire, 326 bytes captured) Arrival Time: Nov 25, 2006 16:46:06.424300000 Time delta from previous packet: 0.365104000 seconds Time since reference or first frame: 7.129361000 seconds Frame Number: 8 Packet Length: 326 bytes Capture Length: 326 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:18:4d:09:98:ab (00:18:4d:09:98:ab), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.105 (165.227.249.105), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb10 [correct] Good: True Bad : False Source: 165.227.249.105 (165.227.249.105) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xde9b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE89CAF6C89A0EEB3 Responder cookie: 0x4E6A461D43CF0B79 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xDCC68695 Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 ab 06 ab 00 18 4d 09 98 ab 08 00 45 00 ..).....M.....E. 0010 01 38 00 00 40 00 40 11 fb 10 a5 e3 f9 69 a5 e3 .8..@.@......i.. 0020 f9 73 01 f4 01 f4 01 24 de 9b e8 9c af 6c 89 a0 .s.....$.....l.. 0030 ee b3 4e 6a 46 1d 43 cf 0b 79 08 10 20 01 dc c6 ..NjF.C..y.. ... 0040 86 95 00 00 01 1c 6d e4 fd b9 26 7e 19 ef 2a 5e ......m...&~..*^ 0050 5e a8 7b 2d 5d 4e cd 69 59 8f b2 2b fb bf 84 57 ^.{-]N.iY..+...W 0060 f6 46 19 88 59 9c c9 9f 6c 43 8c 95 dd bf 23 8f .F..Y...lC....#. 0070 ff f5 69 40 0a 26 b1 0b d7 99 17 85 14 70 70 7a ..i@.&.......ppz 0080 c2 07 0f ac f5 e2 6c 61 0f fb 3a c1 31 5d 49 27 ......la..:.1]I' 0090 1d 44 26 3e 0a bc ca 1f 3a 9b b0 4d e6 0a e6 79 .D&>....:..M...y 00a0 cc 26 99 65 54 59 b6 89 07 4b 19 de a4 b5 9c c2 .&.eTY...K...... 00b0 99 c5 f8 60 9d fe 55 d2 5f 4f 87 7a 61 81 37 d4 ...`..U._O.za.7. 00c0 7e ac 9c cf b8 bd 15 5a e5 46 04 f5 6e df c9 45 ~......Z.F..n..E 00d0 ce 70 37 cf 85 ef 20 99 1f 37 5c 20 ec 26 42 62 .p7... ..7\ .&Bb 00e0 fa 0a 5b ef 9d fe 9d 06 14 b0 76 59 81 11 ce a7 ..[.......vY.... 00f0 4c 40 70 d5 91 15 b2 84 b2 83 80 fb c7 27 89 89 L@p..........'.. 0100 a3 71 7f 66 08 be 68 7a b5 af 1e 15 0a 97 ad d2 .q.f..hz........ 0110 ae e0 55 62 d6 f9 1d 51 af c2 77 bc bb 4b 3f aa ..Ub...Q..w..K?. 0120 d4 80 89 eb 06 9a 23 6d c7 fd c1 c0 86 4d cd 23 ......#m.....M.# 0130 1f 59 95 c7 7d a7 77 23 a9 69 44 3b 5f db 3d 2b .Y..}.w#.iD;_.=+ 0140 ce f3 7a 87 1a f1 ..z... Frame 9 (94 bytes on wire, 94 bytes captured) Arrival Time: Nov 25, 2006 16:46:06.426120000 Time delta from previous packet: 0.001820000 seconds Time since reference or first frame: 7.131181000 seconds Frame Number: 9 Packet Length: 94 bytes Capture Length: 94 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Destination: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.105 (165.227.249.105) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 80 Identification: 0x0199 (409) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa5f [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.105 (165.227.249.105) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 60 Checksum: 0xed5f [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xE89CAF6C89A0EEB3 Responder cookie: 0x4E6A461D43CF0B79 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xDCC68695 Length: 52 Encrypted payload (24 bytes) 0000 00 18 4d 09 98 ab 00 0c 29 ab 06 ab 08 00 45 00 ..M.....).....E. 0010 00 50 01 99 00 00 80 11 fa 5f a5 e3 f9 73 a5 e3 .P......._...s.. 0020 f9 69 01 f4 01 f4 00 3c ed 5f e8 9c af 6c 89 a0 .i.....<._...l.. 0030 ee b3 4e 6a 46 1d 43 cf 0b 79 08 10 20 01 dc c6 ..NjF.C..y.. ... 0040 86 95 00 00 00 34 f5 9b 42 68 ca 69 76 7c c0 ff .....4..Bh.iv|.. 0050 25 b4 f8 46 06 bc c8 a4 14 06 c8 af 4b be %..F........K. Frame 10 (126 bytes on wire, 126 bytes captured) Arrival Time: Nov 25, 2006 16:46:09.939176000 Time delta from previous packet: 3.513056000 seconds Time since reference or first frame: 10.644237000 seconds Frame Number: 10 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Destination: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.105 (165.227.249.105) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfbb6 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.105 (165.227.249.105) Encapsulating Security Payload SPI: 0x4d5b0f9d Sequence: 1 Data (84 bytes) 0000 00 18 4d 09 98 ab 00 0c 29 ab 06 ab 08 00 45 00 ..M.....).....E. 0010 00 70 00 01 00 00 80 32 fb b6 a5 e3 f9 73 a5 e3 .p.....2.....s.. 0020 f9 69 4d 5b 0f 9d 00 00 00 01 7a 3c 71 56 b1 d0 .iM[......z