Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Mar 19, 2004 13:42:57.006564000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 166 bytes Capture Length: 166 bytes Ethernet II, Src: 00:0c:29:b1:20:22, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Type: IP (0x0800) Frame check sequence: 0x132c2753 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 148 Identification: 0x0260 (608) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf934 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 128 Checksum: 0x2e17 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE53CCCBC58CD5446 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 120 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 e0 13 00 2c 4a 00 0c 29 b1 20 22 08 00 45 00 ....,J..). "..E. 0010 00 94 02 60 00 00 80 11 f9 34 a5 e3 f9 73 a5 e3 ...`.....4...s.. 0020 f9 89 01 f4 01 f4 00 80 2e 17 e5 3c cc bc 58 cd ...........<..X. 0030 54 46 00 00 00 00 00 00 00 00 01 10 02 00 00 00 TF.............. 0040 00 00 00 00 00 78 0d 00 00 34 00 00 00 01 00 00 .....x...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 0e 10 0d 00 00 14 44 85 ..............D. 0080 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 00 00 .-.......F.y.... 0090 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 ......>.in.c...B 00a0 7b 1f 13 2c 27 53 {..,'S Frame 2 (166 bytes on wire, 166 bytes captured) Arrival Time: Mar 19, 2004 13:42:57.013073000 Time delta from previous packet: 0.006509000 seconds Time since reference or first frame: 0.006509000 seconds Frame Number: 2 Packet Length: 166 bytes Capture Length: 166 bytes Ethernet II, Src: 00:e0:13:00:2c:4a, Dst: 00:0c:29:b1:20:22 Destination: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Source: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Type: IP (0x0800) Frame check sequence: 0xb1973ca8 (correct) Internet Protocol, Src Addr: 165.227.249.137 (165.227.249.137), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 148 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb94 (correct) Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 128 Checksum: 0x1ef5 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE53CCCBC58CD5446 Responder cookie: 0x57248D65E7F6917E Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 120 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-dpd-00.txt 0000 00 0c 29 b1 20 22 00 e0 13 00 2c 4a 08 00 45 00 ..). "....,J..E. 0010 00 94 00 00 40 00 40 11 fb 94 a5 e3 f9 89 a5 e3 ....@.@......... 0020 f9 73 01 f4 01 f4 00 80 1e f5 e5 3c cc bc 58 cd .s.........<..X. 0030 54 46 57 24 8d 65 e7 f6 91 7e 01 10 02 00 00 00 TFW$.e...~...... 0040 00 00 00 00 00 78 0d 00 00 34 00 00 00 01 00 00 .....x...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 0e 10 0d 00 00 14 44 85 ..............D. 0080 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 00 00 .-.......F.y.... 0090 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00a0 01 00 b1 97 3c a8 ....<. Frame 3 (350 bytes on wire, 350 bytes captured) Arrival Time: Mar 19, 2004 13:42:59.052617000 Time delta from previous packet: 2.039544000 seconds Time since reference or first frame: 2.046053000 seconds Frame Number: 3 Packet Length: 350 bytes Capture Length: 350 bytes Ethernet II, Src: 00:0c:29:b1:20:22, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Type: IP (0x0800) Frame check sequence: 0x9c238530 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x0262 (610) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf87a (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0x97f4 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE53CCCBC58CD5446 Responder cookie: 0x57248D65E7F6917E Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Private USE (130) Length: 24 Nonce Data Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: Vendor ID (13) Length: 24 Payload Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E5... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 e0 13 00 2c 4a 00 0c 29 b1 20 22 08 00 45 00 ....,J..). "..E. 0010 01 4c 02 62 00 00 80 11 f8 7a a5 e3 f9 73 a5 e3 .L.b.....z...s.. 0020 f9 89 01 f4 01 f4 01 38 97 f4 e5 3c cc bc 58 cd .......8...<..X. 0030 54 46 57 24 8d 65 e7 f6 91 7e 04 10 02 00 00 00 TFW$.e...~...... 0040 00 00 00 00 01 30 0a 00 00 84 68 77 59 fe a9 cb .....0....hwY... 0050 16 40 25 23 30 8a 58 86 2e 12 e5 e6 aa 21 65 f7 .@%#0.X......!e. 0060 3d e5 c7 11 48 af 6e 76 76 ae 49 07 38 b2 35 33 =...H.nvv.I.8.53 0070 95 11 be cd 6e 46 91 29 ab ea 16 a7 f7 f1 48 86 ....nF.)......H. 0080 0e 2c f6 64 49 ba 05 8b 81 c8 d9 c2 14 9c 55 75 .,.dI.........Uu 0090 ad 0a 99 96 14 94 f3 cc d6 ad 51 97 87 bc b5 40 ..........Q....@ 00a0 22 63 96 26 9e 0e 41 88 47 3b f1 5b cc 27 e8 df "c.&..A.G;.[.'.. 00b0 19 04 e5 e3 74 f8 0e 99 da be 83 13 cc 2a 65 cb ....t........*e. 00c0 49 47 75 7b 9f 76 98 67 16 e6 82 00 00 18 39 ba IGu{.v.g......9. 00d0 e1 b6 55 59 dc 61 52 d0 ad 0b d9 5e ae b2 9f 0b ..UY.aR....^.... 00e0 2d 26 82 00 00 18 e6 ce 27 92 b9 bc 08 7d c2 26 -&......'....}.& 00f0 3f 55 d3 0e 57 17 8f df 4b 40 0d 00 00 18 4c bd ?U..W...K@....L. 0100 e1 b7 5a 27 00 6d 5d 2e 7d 28 3e b0 65 7c ae 2b ..Z'.m].}(>.e|.+ 0110 35 d7 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 5....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 9c 23 85 30 ....&......#.0 Frame 4 (274 bytes on wire, 274 bytes captured) Arrival Time: Mar 19, 2004 13:42:59.070567000 Time delta from previous packet: 0.017950000 seconds Time since reference or first frame: 2.064003000 seconds Frame Number: 4 Packet Length: 274 bytes Capture Length: 274 bytes Ethernet II, Src: 00:e0:13:00:2c:4a, Dst: 00:0c:29:b1:20:22 Destination: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Source: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Type: IP (0x0800) Frame check sequence: 0x083317fe (correct) Internet Protocol, Src Addr: 165.227.249.137 (165.227.249.137), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb28 (correct) Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0xa982 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE53CCCBC58CD5446 Responder cookie: 0x57248D65E7F6917E Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Private USE (130) Length: 20 Nonce Data Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: NONE (0) Length: 24 Payload 0000 00 0c 29 b1 20 22 00 e0 13 00 2c 4a 08 00 45 00 ..). "....,J..E. 0010 01 00 00 00 40 00 40 11 fb 28 a5 e3 f9 89 a5 e3 ....@.@..(...... 0020 f9 73 01 f4 01 f4 00 ec a9 82 e5 3c cc bc 58 cd .s.........<..X. 0030 54 46 57 24 8d 65 e7 f6 91 7e 04 10 02 00 00 00 TFW$.e...~...... 0040 00 00 00 00 00 e4 0a 00 00 84 eb e5 9f 8d e4 4c ...............L 0050 c2 f9 f6 de 5e 13 90 1f b1 cd 4e 59 08 4b 62 a8 ....^.....NY.Kb. 0060 d8 d3 a7 55 81 20 f8 11 bd c0 af 2c 69 b1 d8 a4 ...U. .....,i... 0070 9f 21 9b eb 95 88 e2 aa 4b 1e 06 41 47 b5 03 ee .!......K..AG... 0080 95 f0 5f 87 50 f5 35 86 ba 48 31 5a 13 40 fc 0d .._.P.5..H1Z.@.. 0090 14 d1 1b c6 91 a1 83 4d f5 6f b9 06 79 a5 fd 74 .......M.o..y..t 00a0 5a fb 79 db ec 92 ef 07 31 a8 e6 27 c1 c5 e4 d4 Z.y.....1..'.... 00b0 4f 6f 01 87 b7 af bd 62 6b e7 63 be 90 a4 c4 a7 Oo.....bk.c..... 00c0 a6 da 06 27 68 fd 15 f1 be 48 82 00 00 14 3b 64 ...'h....H....;d 00d0 a6 b5 b2 60 2a 2b af c6 cb bd 2e 30 72 00 82 00 ...`*+.....0r... 00e0 00 18 4c bd e1 b7 5a 27 00 6d 5d 2e 7d 28 3e b0 ..L...Z'.m].}(>. 00f0 65 7c ae 2b 35 d7 00 00 00 18 e6 ce 27 92 b9 bc e|.+5.......'... 0100 08 7d c2 26 3f 55 d3 0e 57 17 8f df 4b 40 08 33 .}.&?U..W...K@.3 0110 17 fe .. Frame 5 (138 bytes on wire, 138 bytes captured) Arrival Time: Mar 19, 2004 13:43:00.931299000 Time delta from previous packet: 1.860732000 seconds Time since reference or first frame: 3.924735000 seconds Frame Number: 5 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:0c:29:b1:20:22, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Type: IP (0x0800) Frame check sequence: 0xef4d84aa (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0263 (611) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf94d (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x0b5c (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE53CCCBC58CD5446 Responder cookie: 0x57248D65E7F6917E Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 e0 13 00 2c 4a 00 0c 29 b1 20 22 08 00 45 00 ....,J..). "..E. 0010 00 78 02 63 00 00 80 11 f9 4d a5 e3 f9 73 a5 e3 .x.c.....M...s.. 0020 f9 89 01 f4 01 f4 00 64 0b 5c e5 3c cc bc 58 cd .......d.\.<..X. 0030 54 46 57 24 8d 65 e7 f6 91 7e 05 10 02 01 00 00 TFW$.e...~...... 0040 00 00 00 00 00 5c 9a f2 ed 29 54 99 3e b6 0c c4 .....\...)T.>... 0050 5c ec ca 76 9b 88 38 41 05 33 d7 5b 51 c0 ce b9 \..v..8A.3.[Q... 0060 55 10 f8 87 4a 77 76 86 58 1d 29 8e 79 da 48 61 U...Jwv.X.).y.Ha 0070 02 a7 e1 cd 6c 33 58 e9 2d e9 d7 84 74 20 e0 c7 ....l3X.-...t .. 0080 bc b9 37 14 82 0a ef 4d 84 aa ..7....M.. Frame 6 (114 bytes on wire, 114 bytes captured) Arrival Time: Mar 19, 2004 13:43:00.934433000 Time delta from previous packet: 0.003134000 seconds Time since reference or first frame: 3.927869000 seconds Frame Number: 6 Packet Length: 114 bytes Capture Length: 114 bytes Ethernet II, Src: 00:e0:13:00:2c:4a, Dst: 00:0c:29:b1:20:22 Destination: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Source: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Type: IP (0x0800) Frame check sequence: 0x2b18274c (correct) Internet Protocol, Src Addr: 165.227.249.137 (165.227.249.137), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc8 (correct) Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x7b7c (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE53CCCBC58CD5446 Responder cookie: 0x57248D65E7F6917E Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 b1 20 22 00 e0 13 00 2c 4a 08 00 45 00 ..). "....,J..E. 0010 00 60 00 00 40 00 40 11 fb c8 a5 e3 f9 89 a5 e3 .`..@.@......... 0020 f9 73 01 f4 01 f4 00 4c 7b 7c e5 3c cc bc 58 cd .s.....L{|.<..X. 0030 54 46 57 24 8d 65 e7 f6 91 7e 05 10 02 01 00 00 TFW$.e...~...... 0040 00 00 00 00 00 44 06 c7 89 c8 e4 ec 51 f2 72 70 .....D......Q.rp 0050 86 07 3d 41 50 5b 98 aa 3b b0 72 82 12 a1 5a 5f ..=AP[..;.r...Z_ 0060 cb 63 d3 5f e5 7b e7 8a 28 4d d8 96 0e bc 2b 18 .c._.{..(M....+. 0070 27 4c 'L Frame 7 (338 bytes on wire, 338 bytes captured) Arrival Time: Mar 19, 2004 13:43:03.213101000 Time delta from previous packet: 2.278668000 seconds Time since reference or first frame: 6.206537000 seconds Frame Number: 7 Packet Length: 338 bytes Capture Length: 338 bytes Ethernet II, Src: 00:0c:29:b1:20:22, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Type: IP (0x0800) Frame check sequence: 0x2cf850be (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x0265 (613) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf883 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x64e9 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE53CCCBC58CD5446 Responder cookie: 0x57248D65E7F6917E Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x2567218D Length: 292 Encrypted payload (264 bytes) 0000 00 e0 13 00 2c 4a 00 0c 29 b1 20 22 08 00 45 00 ....,J..). "..E. 0010 01 40 02 65 00 00 80 11 f8 83 a5 e3 f9 73 a5 e3 .@.e.........s.. 0020 f9 89 01 f4 01 f4 01 2c 64 e9 e5 3c cc bc 58 cd .......,d..<..X. 0030 54 46 57 24 8d 65 e7 f6 91 7e 08 10 20 01 25 67 TFW$.e...~.. .%g 0040 21 8d 00 00 01 24 6d e7 0a 31 77 0d 98 76 db ba !....$m..1w..v.. 0050 72 ac 2f dd d7 46 45 1f 31 72 16 09 86 13 0b 2b r./..FE.1r.....+ 0060 bb b2 fe fc 27 1b ee 4c 6b 2f 63 89 3f 4c f1 c4 ....'..Lk/c.?L.. 0070 ef e7 a5 f7 b4 76 b5 0d de aa 4d 4e e7 e6 2b 01 .....v....MN..+. 0080 06 79 3c eb 79 b0 f9 b6 b2 28 ab 5c 79 ba ec d6 .y<.y....(.\y... 0090 fe 23 a1 cd b0 94 4c bc 47 d4 91 07 73 c6 45 37 .#....L.G...s.E7 00a0 2b ff b3 d8 cc 66 0d 1c 18 28 c6 70 e2 2b c6 83 +....f...(.p.+.. 00b0 13 43 94 06 84 ad 20 b7 8c ac 66 66 de a3 34 54 .C.... ...ff..4T 00c0 0e e5 54 26 09 1f e0 4b 0d c0 50 b1 36 f0 cc bd ..T&...K..P.6... 00d0 d5 77 a1 b8 3b 2e 11 21 f0 e2 07 85 28 9b a7 6f .w..;..!....(..o 00e0 6d 51 7d 26 31 21 da ca 4e 23 73 15 00 6e 59 58 mQ}&1!..N#s..nYX 00f0 75 be ce 11 39 4e a6 48 87 3c 7e 65 29 da a9 ae u...9N.H.<~e)... 0100 c8 5d 68 2b 6a c8 f5 21 4d e2 db 83 c4 17 59 2a .]h+j..!M.....Y* 0110 f1 a7 50 24 47 ce d5 05 a2 b8 f3 d7 c8 27 3c 35 ..P$G........'<5 0120 a0 6c ff 97 dd d3 b8 ad a1 fd 63 3e 7f bd 8f f8 .l........c>.... 0130 88 af 62 1a 9a 64 18 c1 c9 d4 40 74 6d 70 39 66 ..b..d....@tmp9f 0140 53 ce ae e8 b2 ac 7f e6 8f 9c 06 6b 63 46 2c f8 S..........kcF,. 0150 50 be P. Frame 8 (330 bytes on wire, 330 bytes captured) Arrival Time: Mar 19, 2004 13:43:03.235418000 Time delta from previous packet: 0.022317000 seconds Time since reference or first frame: 6.228854000 seconds Frame Number: 8 Packet Length: 330 bytes Capture Length: 330 bytes Ethernet II, Src: 00:e0:13:00:2c:4a, Dst: 00:0c:29:b1:20:22 Destination: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Source: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Type: IP (0x0800) Frame check sequence: 0xc8461468 (correct) Internet Protocol, Src Addr: 165.227.249.137 (165.227.249.137), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaf0 (correct) Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xefcc (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE53CCCBC58CD5446 Responder cookie: 0x57248D65E7F6917E Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x2567218D Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 b1 20 22 00 e0 13 00 2c 4a 08 00 45 00 ..). "....,J..E. 0010 01 38 00 00 40 00 40 11 fa f0 a5 e3 f9 89 a5 e3 .8..@.@......... 0020 f9 73 01 f4 01 f4 01 24 ef cc e5 3c cc bc 58 cd .s.....$...<..X. 0030 54 46 57 24 8d 65 e7 f6 91 7e 08 10 20 01 25 67 TFW$.e...~.. .%g 0040 21 8d 00 00 01 1c fb 6c 65 4a 9f 44 3b b8 2d 8a !......leJ.D;.-. 0050 3d 60 a1 12 17 61 2a d5 5f a0 11 6a 7b 5b 9f b5 =`...a*._..j{[.. 0060 72 5f 9d 97 a1 93 eb ac 96 ca 09 b5 28 1a 0c 53 r_..........(..S 0070 b2 e4 d2 25 82 1d 7e 7a fc b9 34 37 c1 1c a0 cd ...%..~z..47.... 0080 62 0e b3 a1 34 84 8f 5d 30 95 ed 7f 8f ab 5a a7 b...4..]0.....Z. 0090 d1 ac d5 1d a0 ba ff 2b 70 b8 b4 63 c8 13 c1 aa .......+p..c.... 00a0 bd a2 97 1c 47 25 e9 71 8a a0 10 a7 c9 fc ee 52 ....G%.q.......R 00b0 6d cf 47 fa 6f 49 97 db f4 8b f9 e0 d1 82 2f 4b m.G.oI......../K 00c0 0c 1c ae 17 72 f3 43 a8 42 8b d7 80 ea ee 25 18 ....r.C.B.....%. 00d0 33 96 4b 29 2a 5b e0 39 84 e1 60 32 3e ea b4 75 3.K)*[.9..`2>..u 00e0 29 ea 06 2a 6c c3 16 8d b8 75 c6 2a 4d 91 de d6 )..*l....u.*M... 00f0 c4 ae 5a 06 ee 2e 3e f1 9c 27 75 70 88 a1 72 3f ..Z...>..'up..r? 0100 ac a3 69 1d 5c 05 21 c9 66 a2 c8 60 28 12 bb 59 ..i.\.!.f..`(..Y 0110 c7 98 a6 cb cc c1 cf 7f a3 53 de 99 ce 3d 09 22 .........S...=." 0120 8c 43 d6 ef 4d 1c ce 0c 35 6a ed e7 9f fc bf 40 .C..M...5j.....@ 0130 fd 89 50 46 d4 e4 56 2f 79 6e b7 13 68 48 73 1d ..PF..V/yn..hHs. 0140 12 8d e9 0b 62 11 c8 46 14 68 ....b..F.h Frame 9 (98 bytes on wire, 98 bytes captured) Arrival Time: Mar 19, 2004 13:43:03.265375000 Time delta from previous packet: 0.029957000 seconds Time since reference or first frame: 6.258811000 seconds Frame Number: 9 Packet Length: 98 bytes Capture Length: 98 bytes Ethernet II, Src: 00:0c:29:b1:20:22, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Type: IP (0x0800) Frame check sequence: 0x43e73555 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 80 Identification: 0x0267 (615) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf971 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 60 Checksum: 0xea69 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE53CCCBC58CD5446 Responder cookie: 0x57248D65E7F6917E Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x2567218D Length: 52 Encrypted payload (24 bytes) 0000 00 e0 13 00 2c 4a 00 0c 29 b1 20 22 08 00 45 00 ....,J..). "..E. 0010 00 50 02 67 00 00 80 11 f9 71 a5 e3 f9 73 a5 e3 .P.g.....q...s.. 0020 f9 89 01 f4 01 f4 00 3c ea 69 e5 3c cc bc 58 cd .......<.i.<..X. 0030 54 46 57 24 8d 65 e7 f6 91 7e 08 10 20 01 25 67 TFW$.e...~.. .%g 0040 21 8d 00 00 00 34 b0 92 44 f2 91 14 b9 ee 4d 30 !....4..D.....M0 0050 89 fa a1 3d 21 0c 26 ee 74 ce bb 76 74 e9 43 e7 ...=!.&.t..vt.C. 0060 35 55 5U Frame 10 (130 bytes on wire, 130 bytes captured) Arrival Time: Mar 19, 2004 13:43:07.176869000 Time delta from previous packet: 3.911494000 seconds Time since reference or first frame: 10.170305000 seconds Frame Number: 10 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0c:29:b1:20:22, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Type: IP (0x0800) Frame check sequence: 0xc7d7e584 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0001 (1) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb96 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) Encapsulating Security Payload SPI: 0x69876b09 Sequence: 1 Data (84 bytes) 0000 00 e0 13 00 2c 4a 00 0c 29 b1 20 22 08 00 45 00 ....,J..). "..E. 0010 00 70 00 01 00 00 80 32 fb 96 a5 e3 f9 73 a5 e3 .p.....2.....s.. 0020 f9 89 69 87 6b 09 00 00 00 01 9d 25 ed 5e 00 00 ..i.k......%.^.. 0030 34 b8 3c 0a 73 a1 4a c7 e7 9d c8 0e 44 d5 90 76 4.<.s.J.....D..v 0040 be 68 5f 42 2b fa a5 35 b7 bc 1a 90 f2 57 22 dd .h_B+..5.....W". 0050 75 5c b9 9d 9b 47 8e 46 d8 fb 51 5d 5b f6 bc 21 u\...G.F..Q][..! 0060 65 90 e6 6d 80 2c ed 46 5e 35 b0 0e e0 12 6e 27 e..m.,.F^5....n' 0070 1d 0e bc e3 01 0c b8 41 49 3f f2 6d 44 74 c7 d7 .......AI?.mDt.. 0080 e5 84 .. Frame 11 (130 bytes on wire, 130 bytes captured) Arrival Time: Mar 19, 2004 13:43:07.178268000 Time delta from previous packet: 0.001399000 seconds Time since reference or first frame: 10.171704000 seconds Frame Number: 11 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:e0:13:00:2c:4a, Dst: 00:0c:29:b1:20:22 Destination: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Source: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Type: IP (0x0800) Frame check sequence: 0x73d6055d (correct) Internet Protocol, Src Addr: 165.227.249.137 (165.227.249.137), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x326d (12909) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x092b (correct) Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x25ed7896 Sequence: 1 Data (84 bytes) 0000 00 0c 29 b1 20 22 00 e0 13 00 2c 4a 08 00 45 00 ..). "....,J..E. 0010 00 70 32 6d 00 00 40 32 09 2b a5 e3 f9 89 a5 e3 .p2m..@2.+...... 0020 f9 73 25 ed 78 96 00 00 00 01 8d 6b 32 c3 42 63 .s%.x......k2.Bc 0030 55 e8 c4 f8 83 5b 30 11 12 f6 75 71 01 8a da c8 U....[0...uq.... 0040 18 b2 f2 00 59 0b 14 8a 49 97 ce b1 58 ed af 99 ....Y...I...X... 0050 33 84 7f 91 7e 13 3b 86 fb 00 46 d5 39 fa ea b9 3...~.;...F.9... 0060 de b7 a1 01 4c 68 24 5f c5 90 75 bd 20 9e 06 5b ....Lh$_..u. ..[ 0070 22 f9 c9 2a 6c ba 31 7c 4b 8b 20 f8 06 f5 73 d6 "..*l.1|K. ...s. 0080 05 5d .] Frame 12 (130 bytes on wire, 130 bytes captured) Arrival Time: Mar 19, 2004 13:43:08.180029000 Time delta from previous packet: 1.001761000 seconds Time since reference or first frame: 11.173465000 seconds Frame Number: 12 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0c:29:b1:20:22, Dst: 00:e0:13:00:2c:4a Destination: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Source: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Type: IP (0x0800) Frame check sequence: 0xfd2dce8e (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0002 (2) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb95 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.137 (165.227.249.137) Encapsulating Security Payload SPI: 0x69876b09 Sequence: 2 Data (84 bytes) 0000 00 e0 13 00 2c 4a 00 0c 29 b1 20 22 08 00 45 00 ....,J..). "..E. 0010 00 70 00 02 00 00 80 32 fb 95 a5 e3 f9 73 a5 e3 .p.....2.....s.. 0020 f9 89 69 87 6b 09 00 00 00 02 b0 0e e0 12 6e 27 ..i.k.........n' 0030 1d 0e ae c9 4e b9 74 be 86 a8 8c 80 47 55 7c d3 ....N.t.....GU|. 0040 1e 79 6e c5 3f de 2e f5 76 7e 66 c4 57 c6 c2 73 .yn.?...v~f.W..s 0050 02 cd 6a 3a cc 7c 67 5c 59 70 ee 1a f5 95 bc b0 ..j:.|g\Yp...... 0060 b8 ee 6f de ad 9a fa d5 70 03 c7 0d 16 0e a1 b6 ..o.....p....... 0070 39 9e cb a8 38 86 e4 e1 fb fc b9 3d 69 1b fd 2d 9...8......=i..- 0080 ce 8e .. Frame 13 (130 bytes on wire, 130 bytes captured) Arrival Time: Mar 19, 2004 13:43:08.181575000 Time delta from previous packet: 0.001546000 seconds Time since reference or first frame: 11.175011000 seconds Frame Number: 13 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:e0:13:00:2c:4a, Dst: 00:0c:29:b1:20:22 Destination: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Source: 00:e0:13:00:2c:4a (00:e0:13:00:2c:4a) Type: IP (0x0800) Frame check sequence: 0x2bf20f9a (correct) Internet Protocol, Src Addr: 165.227.249.137 (165.227.249.137), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x326e (12910) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x092a (correct) Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x25ed7896 Sequence: 2 Data (84 bytes) 0000 00 0c 29 b1 20 22 00 e0 13 00 2c 4a 08 00 45 00 ..). "....,J..E. 0010 00 70 32 6e 00 00 40 32 09 2a a5 e3 f9 89 a5 e3 .p2n..@2.*...... 0020 f9 73 25 ed 78 96 00 00 00 02 75 bd 20 9e 06 5b .s%.x.....u. ..[ 0030 22 f9 60 f2 db 43 1a 14 41 3b 3e 55 cf 8d c5 1d ".`..C..A;>U.... 0040 08 eb 00 bd f3 74 18 85 5f 2d 24 df ed 4d 92 84 .....t.._-$..M.. 0050 65 20 0b 0b f2 49 6d ec 6f 02 05 c5 b5 cf 48 e4 e ...Im.o.....H. 0060 50 07 3c 3e 7b db b1 86 18 7a 85 77 e1 01 7f aa P.<>{....z.w.... 0070 3f 53 e1 61 53 99 20 d1 f4 33 20 16 97 b4 2b f2 ?S.aS. ..3 ...+. 0080 0f 9a ..