Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Mar 16, 2004 17:22:51.279062000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 166 bytes Capture Length: 166 bytes Ethernet II, Src: 00:0c:29:b1:20:22, Dst: 00:d0:cf:01:f5:33 Destination: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Source: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Type: IP (0x0800) Frame check sequence: 0x10431e8d (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 148 Identification: 0x025b (603) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf937 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 128 Checksum: 0xeae7 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xB9C84DF1909309ED Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 120 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 d0 cf 01 f5 33 00 0c 29 b1 20 22 08 00 45 00 .....3..). "..E. 0010 00 94 02 5b 00 00 80 11 f9 37 a5 e3 f9 73 a5 e3 ...[.....7...s.. 0020 f9 8b 01 f4 01 f4 00 80 ea e7 b9 c8 4d f1 90 93 ............M... 0030 09 ed 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 78 0d 00 00 34 00 00 00 01 00 00 .....x...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 0e 10 0d 00 00 14 44 85 ..............D. 0080 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 00 00 .-.......F.y.... 0090 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 ......>.in.c...B 00a0 7b 1f 10 43 1e 8d {..C.. Frame 2 (166 bytes on wire, 166 bytes captured) Arrival Time: Mar 16, 2004 17:22:51.283746000 Time delta from previous packet: 0.004684000 seconds Time since reference or first frame: 0.004684000 seconds Frame Number: 2 Packet Length: 166 bytes Capture Length: 166 bytes Ethernet II, Src: 00:d0:cf:01:f5:33, Dst: 00:0c:29:b1:20:22 Destination: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Source: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Type: IP (0x0800) Frame check sequence: 0x2bac736a (correct) Internet Protocol, Src Addr: 165.227.249.139 (165.227.249.139), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 148 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb92 (correct) Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 128 Checksum: 0xfd47 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xB9C84DF1909309ED Responder cookie: 0xD33422A4DAFA1653 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 120 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-dpd-00.txt 0000 00 0c 29 b1 20 22 00 d0 cf 01 f5 33 08 00 45 00 ..). ".....3..E. 0010 00 94 00 00 40 00 40 11 fb 92 a5 e3 f9 8b a5 e3 ....@.@......... 0020 f9 73 01 f4 01 f4 00 80 fd 47 b9 c8 4d f1 90 93 .s.......G..M... 0030 09 ed d3 34 22 a4 da fa 16 53 01 10 02 00 00 00 ...4"....S...... 0040 00 00 00 00 00 78 0d 00 00 34 00 00 00 01 00 00 .....x...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 0e 10 0d 00 00 14 90 cb ................ 0080 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f 00 00 ..>.in.c...B{... 0090 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00a0 01 00 2b ac 73 6a ..+.sj Frame 3 (350 bytes on wire, 350 bytes captured) Arrival Time: Mar 16, 2004 17:22:53.417913000 Time delta from previous packet: 2.134167000 seconds Time since reference or first frame: 2.138851000 seconds Frame Number: 3 Packet Length: 350 bytes Capture Length: 350 bytes Ethernet II, Src: 00:0c:29:b1:20:22, Dst: 00:d0:cf:01:f5:33 Destination: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Source: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Type: IP (0x0800) Frame check sequence: 0xcfbac5a1 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x025c (604) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf87e (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xce06 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xB9C84DF1909309ED Responder cookie: 0xD33422A4DAFA1653 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Private USE (130) Length: 24 Nonce Data Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: Vendor ID (13) Length: 24 Payload Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E5... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 d0 cf 01 f5 33 00 0c 29 b1 20 22 08 00 45 00 .....3..). "..E. 0010 01 4c 02 5c 00 00 80 11 f8 7e a5 e3 f9 73 a5 e3 .L.\.....~...s.. 0020 f9 8b 01 f4 01 f4 01 38 ce 06 b9 c8 4d f1 90 93 .......8....M... 0030 09 ed d3 34 22 a4 da fa 16 53 04 10 02 00 00 00 ...4"....S...... 0040 00 00 00 00 01 30 0a 00 00 84 b6 45 1d ac 8d 90 .....0.....E.... 0050 4f a3 ea 3f 45 4e ba 06 52 53 bd 2e b6 20 d4 6d O..?EN..RS... .m 0060 a7 4e 9d f0 d0 38 da 3f 95 f6 dc 2d 39 59 d0 dc .N...8.?...-9Y.. 0070 3f 87 14 43 45 fa 6b a4 94 a9 8c 23 84 31 02 f7 ?..CE.k....#.1.. 0080 26 57 c8 ff a1 70 fd 40 07 f8 da bd 45 d1 5a bd &W...p.@....E.Z. 0090 59 f1 a1 c0 2d 30 78 4c 8a 71 77 00 20 a8 da 22 Y...-0xL.qw. .." 00a0 d2 6a cf 8e f5 5d cb df c8 5b eb 9b c3 0e 79 eb .j...]...[....y. 00b0 14 e4 62 f8 af dc 18 b7 bb ac 85 4d c3 61 73 f4 ..b........M.as. 00c0 a7 3b 37 5b 59 ca 78 bd 50 42 82 00 00 18 8d 8b .;7[Y.x.PB...... 00d0 6d ab 67 f7 1e 37 8f 11 eb aa 42 c2 35 83 a0 36 m.g..7....B.5..6 00e0 3d 1e 82 00 00 18 fc 34 a8 d0 2e 09 3f a2 63 ce =......4....?.c. 00f0 8c fd aa dc 3e 54 40 70 f5 8c 0d 00 00 18 ee f6 ....>T@p........ 0100 e0 01 b6 3f 07 b5 30 52 d6 f0 0b 53 c1 d2 18 e9 ...?..0R...S.... 0110 70 01 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 p....0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 cf ba c5 a1 ....&......... Frame 4 (274 bytes on wire, 274 bytes captured) Arrival Time: Mar 16, 2004 17:22:53.701214000 Time delta from previous packet: 0.283301000 seconds Time since reference or first frame: 2.422152000 seconds Frame Number: 4 Packet Length: 274 bytes Capture Length: 274 bytes Ethernet II, Src: 00:d0:cf:01:f5:33, Dst: 00:0c:29:b1:20:22 Destination: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Source: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Type: IP (0x0800) Frame check sequence: 0xd4b25a22 (correct) Internet Protocol, Src Addr: 165.227.249.139 (165.227.249.139), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb26 (correct) Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x3cc8 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xB9C84DF1909309ED Responder cookie: 0xD33422A4DAFA1653 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Private USE (130) Length: 20 Nonce Data Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: NONE (0) Length: 24 Payload 0000 00 0c 29 b1 20 22 00 d0 cf 01 f5 33 08 00 45 00 ..). ".....3..E. 0010 01 00 00 00 40 00 40 11 fb 26 a5 e3 f9 8b a5 e3 ....@.@..&...... 0020 f9 73 01 f4 01 f4 00 ec 3c c8 b9 c8 4d f1 90 93 .s......<...M... 0030 09 ed d3 34 22 a4 da fa 16 53 04 10 02 00 00 00 ...4"....S...... 0040 00 00 00 00 00 e4 0a 00 00 84 4d 86 21 a6 77 8e ..........M.!.w. 0050 d5 99 1e e5 6a 41 c8 4e 7e f5 e2 d2 8f 0d 77 c5 ....jA.N~.....w. 0060 7f e4 d1 40 df 96 65 38 30 7a e6 10 e5 e0 5c 0c ...@..e80z....\. 0070 88 a8 0e 41 de 62 e3 49 85 e6 9c 79 c1 21 34 57 ...A.b.I...y.!4W 0080 f5 c2 58 d3 67 64 e0 54 bf e8 92 89 34 f0 77 37 ..X.gd.T....4.w7 0090 3d 57 60 e6 3b 77 29 50 20 ee dc bf 84 2c 9e 29 =W`.;w)P ....,.) 00a0 96 36 6a 1e c5 ae 1c bf c9 f4 8f 81 b8 8b 41 08 .6j...........A. 00b0 63 c7 0e f7 03 14 be 1c 01 bd 9f f1 a5 cd 47 b3 c.............G. 00c0 e0 83 c6 f9 f2 32 bd 7b 4b 75 82 00 00 14 bd 05 .....2.{Ku...... 00d0 41 c4 3b fd df 41 e7 3e 7a b9 fe 63 2f 6d 82 00 A.;..A.>z..c/m.. 00e0 00 18 ee f6 e0 01 b6 3f 07 b5 30 52 d6 f0 0b 53 .......?..0R...S 00f0 c1 d2 18 e9 70 01 00 00 00 18 fc 34 a8 d0 2e 09 ....p......4.... 0100 3f a2 63 ce 8c fd aa dc 3e 54 40 70 f5 8c d4 b2 ?.c.....>T@p.... 0110 5a 22 Z" Frame 5 (138 bytes on wire, 138 bytes captured) Arrival Time: Mar 16, 2004 17:22:55.429468000 Time delta from previous packet: 1.728254000 seconds Time since reference or first frame: 4.150406000 seconds Frame Number: 5 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:0c:29:b1:20:22, Dst: 00:d0:cf:01:f5:33 Destination: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Source: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Type: IP (0x0800) Frame check sequence: 0x1c8b39fd (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x025e (606) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf950 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x68dd (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xB9C84DF1909309ED Responder cookie: 0xD33422A4DAFA1653 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 d0 cf 01 f5 33 00 0c 29 b1 20 22 08 00 45 00 .....3..). "..E. 0010 00 78 02 5e 00 00 80 11 f9 50 a5 e3 f9 73 a5 e3 .x.^.....P...s.. 0020 f9 8b 01 f4 01 f4 00 64 68 dd b9 c8 4d f1 90 93 .......dh...M... 0030 09 ed d3 34 22 a4 da fa 16 53 05 10 02 01 00 00 ...4"....S...... 0040 00 00 00 00 00 5c 47 07 6e 00 fd bd 50 ef 6b 90 .....\G.n...P.k. 0050 af 6f 9c 8c de 27 22 ed e4 da 4d ae 22 87 17 ab .o...'"...M."... 0060 75 78 8a 93 76 e7 bf ba 12 d1 eb 2d d9 8f 16 bc ux..v......-.... 0070 b2 ac ad e7 0e 3b 91 8f ec 85 34 b4 ee 35 c8 9d .....;....4..5.. 0080 21 5e 37 fb 42 fa 1c 8b 39 fd !^7.B...9. Frame 6 (114 bytes on wire, 114 bytes captured) Arrival Time: Mar 16, 2004 17:22:55.433863000 Time delta from previous packet: 0.004395000 seconds Time since reference or first frame: 4.154801000 seconds Frame Number: 6 Packet Length: 114 bytes Capture Length: 114 bytes Ethernet II, Src: 00:d0:cf:01:f5:33, Dst: 00:0c:29:b1:20:22 Destination: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Source: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Type: IP (0x0800) Frame check sequence: 0xd92fca06 (correct) Internet Protocol, Src Addr: 165.227.249.139 (165.227.249.139), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc6 (correct) Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x06f5 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xB9C84DF1909309ED Responder cookie: 0xD33422A4DAFA1653 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 b1 20 22 00 d0 cf 01 f5 33 08 00 45 00 ..). ".....3..E. 0010 00 60 00 00 40 00 40 11 fb c6 a5 e3 f9 8b a5 e3 .`..@.@......... 0020 f9 73 01 f4 01 f4 00 4c 06 f5 b9 c8 4d f1 90 93 .s.....L....M... 0030 09 ed d3 34 22 a4 da fa 16 53 05 10 02 01 00 00 ...4"....S...... 0040 00 00 00 00 00 44 83 ed 20 32 96 9e e5 e8 60 8a .....D.. 2....`. 0050 23 4a 5c 77 4a 74 ae 3b d2 1f 78 3f 8a ce 38 12 #J\wJt.;..x?..8. 0060 69 2a b0 04 0c 05 7a 9e 83 ca a9 cd 50 ae d9 2f i*....z.....P../ 0070 ca 06 .. Frame 7 (338 bytes on wire, 338 bytes captured) Arrival Time: Mar 16, 2004 17:22:57.609867000 Time delta from previous packet: 2.176004000 seconds Time since reference or first frame: 6.330805000 seconds Frame Number: 7 Packet Length: 338 bytes Capture Length: 338 bytes Ethernet II, Src: 00:0c:29:b1:20:22, Dst: 00:d0:cf:01:f5:33 Destination: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Source: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Type: IP (0x0800) Frame check sequence: 0xa5f07075 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x0260 (608) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf886 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0xc9d0 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xB9C84DF1909309ED Responder cookie: 0xD33422A4DAFA1653 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0xE154F001 Length: 292 Encrypted payload (264 bytes) 0000 00 d0 cf 01 f5 33 00 0c 29 b1 20 22 08 00 45 00 .....3..). "..E. 0010 01 40 02 60 00 00 80 11 f8 86 a5 e3 f9 73 a5 e3 .@.`.........s.. 0020 f9 8b 01 f4 01 f4 01 2c c9 d0 b9 c8 4d f1 90 93 .......,....M... 0030 09 ed d3 34 22 a4 da fa 16 53 08 10 20 01 e1 54 ...4"....S.. ..T 0040 f0 01 00 00 01 24 51 f0 bb ee 61 82 77 3b ee e2 .....$Q...a.w;.. 0050 df 50 9d 84 03 94 bd f8 5e 82 d3 5d 9f 10 12 7f .P......^..].... 0060 2d f5 a6 f1 f3 ef 42 43 5b ad 88 77 6a c2 5c 7b -.....BC[..wj.\{ 0070 ec 84 c7 18 9a 8f 59 88 0e 7f 47 fa 87 e3 6f 3f ......Y...G...o? 0080 9e 79 5a f0 82 a2 bf 0f f3 fc d3 e1 70 47 bc ba .yZ.........pG.. 0090 21 31 0a 7b c8 9a 1a 02 83 e3 47 88 3b 2d a0 6d !1.{......G.;-.m 00a0 54 69 42 4e 4b c0 a4 d2 79 fc 38 cd 68 d1 22 da TiBNK...y.8.h.". 00b0 f4 e4 0f d1 5c 92 a8 2b 65 ab 56 46 d9 b6 71 6f ....\..+e.VF..qo 00c0 0a 84 01 65 b9 29 07 5a 51 80 2b d5 7e de 8b a4 ...e.).ZQ.+.~... 00d0 b6 68 e9 a9 ac 98 55 b2 e5 b3 81 2f 55 f7 99 cc .h....U..../U... 00e0 1b df d7 f9 f5 ed 68 61 f7 ae 1c 8d 33 d5 92 7a ......ha....3..z 00f0 25 61 18 1e b8 87 52 6c 0e 57 9c 3a 39 23 5f 65 %a....Rl.W.:9#_e 0100 79 db b8 69 1e d2 5d e5 24 14 86 1d 45 18 ab 6f y..i..].$...E..o 0110 69 ca 0b 5a 97 ca 64 8a 9d cb 54 3c 7a d9 38 88 i..Z..d...T 00a0 25 5a c0 3e 2f e0 4d ac 9d 95 d8 81 03 bf c9 19 %Z.>/.M......... 00b0 5d 4b 04 5e 4b 49 e5 1e 0a 31 e3 0c d8 97 cf 20 ]K.^KI...1..... 00c0 fd bb e6 55 e8 b9 f7 12 6e 6d a3 90 7f ab 09 2d ...U....nm.....- 00d0 66 82 e5 91 54 80 e7 55 4a 9c 43 8f 36 9e b9 99 f...T..UJ.C.6... 00e0 d6 23 f3 01 06 f1 db 5e a9 9d f1 71 7b 62 5a e7 .#.....^...q{bZ. 00f0 cc 83 a2 40 32 cc aa 31 9e 4d 76 cb 58 68 af a2 ...@2..1.Mv.Xh.. 0100 a9 1b b4 aa 53 b1 68 9e 3c da 0c 1e 36 0d fb c7 ....S.h.<...6... 0110 67 ee 82 47 11 f3 95 6c a6 81 25 32 7f 6c 6e a9 g..G...l..%2.ln. 0120 87 a5 4b 1b 09 e5 e5 b1 e1 86 55 fa 73 45 d9 61 ..K.......U.sE.a 0130 a6 b6 48 d8 86 43 f5 56 93 ae f7 bb 96 d2 9a 9c ..H..C.V........ 0140 ef 6f 55 ce 52 1f 37 88 15 f9 .oU.R.7... Frame 9 (98 bytes on wire, 98 bytes captured) Arrival Time: Mar 16, 2004 17:22:57.900656000 Time delta from previous packet: 0.004932000 seconds Time since reference or first frame: 6.621594000 seconds Frame Number: 9 Packet Length: 98 bytes Capture Length: 98 bytes Ethernet II, Src: 00:0c:29:b1:20:22, Dst: 00:d0:cf:01:f5:33 Destination: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Source: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Type: IP (0x0800) Frame check sequence: 0x2bed400d (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 80 Identification: 0x0261 (609) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf975 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 60 Checksum: 0xc59f (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xB9C84DF1909309ED Responder cookie: 0xD33422A4DAFA1653 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0xE154F001 Length: 52 Encrypted payload (24 bytes) 0000 00 d0 cf 01 f5 33 00 0c 29 b1 20 22 08 00 45 00 .....3..). "..E. 0010 00 50 02 61 00 00 80 11 f9 75 a5 e3 f9 73 a5 e3 .P.a.....u...s.. 0020 f9 8b 01 f4 01 f4 00 3c c5 9f b9 c8 4d f1 90 93 .......<....M... 0030 09 ed d3 34 22 a4 da fa 16 53 08 10 20 01 e1 54 ...4"....S.. ..T 0040 f0 01 00 00 00 34 a6 fa 2d 0f e2 8c 0b 4b f3 1f .....4..-....K.. 0050 21 c1 45 1d 1e 2e 3e b0 3e be c9 5a f3 52 2b ed !.E...>.>..Z.R+. 0060 40 0d @. Frame 10 (130 bytes on wire, 130 bytes captured) Arrival Time: Mar 16, 2004 17:23:01.495314000 Time delta from previous packet: 3.594658000 seconds Time since reference or first frame: 10.216252000 seconds Frame Number: 10 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0c:29:b1:20:22, Dst: 00:d0:cf:01:f5:33 Destination: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Source: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Type: IP (0x0800) Frame check sequence: 0x44bd7676 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0001 (1) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb94 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.139 (165.227.249.139) Encapsulating Security Payload SPI: 0x9f6c0686 Sequence: 1 Data (84 bytes) 0000 00 d0 cf 01 f5 33 00 0c 29 b1 20 22 08 00 45 00 .....3..). "..E. 0010 00 70 00 01 00 00 80 32 fb 94 a5 e3 f9 73 a5 e3 .p.....2.....s.. 0020 f9 8b 9f 6c 06 86 00 00 00 01 6e d5 bd c1 45 2d ...l......n...E- 0030 56 71 22 74 a8 ef d8 f7 7e a5 8a b7 c4 20 e3 a6 Vq"t....~.... .. 0040 f8 aa c9 3c 0a de 54 01 c2 01 92 52 86 37 b1 4f ...<..T....R.7.O 0050 3f 79 fa aa 02 95 1f 05 3b 75 58 44 98 87 89 fd ?y......;uXD.... 0060 02 eb bc 5d 72 7a ee 04 b5 9e ab 59 b1 b8 a7 f0 ...]rz.....Y.... 0070 62 3f 8c 5a 26 f5 e4 59 d9 4b 1b ff 8b 3e 44 bd b?.Z&..Y.K...>D. 0080 76 76 vv Frame 11 (130 bytes on wire, 130 bytes captured) Arrival Time: Mar 16, 2004 17:23:01.497478000 Time delta from previous packet: 0.002164000 seconds Time since reference or first frame: 10.218416000 seconds Frame Number: 11 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:d0:cf:01:f5:33, Dst: 00:0c:29:b1:20:22 Destination: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Source: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Type: IP (0x0800) Frame check sequence: 0x82738bfa (correct) Internet Protocol, Src Addr: 165.227.249.139 (165.227.249.139), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0xb6f3 (46835) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x84a2 (correct) Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x57425f39 Sequence: 1 Data (84 bytes) 0000 00 0c 29 b1 20 22 00 d0 cf 01 f5 33 08 00 45 00 ..). ".....3..E. 0010 00 70 b6 f3 00 00 40 32 84 a2 a5 e3 f9 8b a5 e3 .p....@2........ 0020 f9 73 57 42 5f 39 00 00 00 01 87 76 b1 30 ce 7c .sWB_9.....v.0.| 0030 f8 5d 7f 55 43 ef 7b 5d f0 b0 8f e5 2f ee cd ac .].UC.{]..../... 0040 f2 9a 45 cb a6 b9 02 bb 8c df c0 c0 b5 1f fa f7 ..E............. 0050 c9 3d 5e e6 99 7e 9e 8a bf 58 57 ff d0 38 60 bb .=^..~...XW..8`. 0060 d9 f0 27 12 08 7b db 69 da 9b 3a c3 44 87 c9 b1 ..'..{.i..:.D... 0070 d6 87 0c 55 15 bb ca 31 0e 6a dd b1 16 ed 82 73 ...U...1.j.....s 0080 8b fa .. Frame 12 (130 bytes on wire, 130 bytes captured) Arrival Time: Mar 16, 2004 17:23:02.537676000 Time delta from previous packet: 1.040198000 seconds Time since reference or first frame: 11.258614000 seconds Frame Number: 12 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0c:29:b1:20:22, Dst: 00:d0:cf:01:f5:33 Destination: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Source: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Type: IP (0x0800) Frame check sequence: 0x949d5eb4 (correct) Internet Protocol, Src Addr: 165.227.249.115 (165.227.249.115), Dst Addr: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0002 (2) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb93 (correct) Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.139 (165.227.249.139) Encapsulating Security Payload SPI: 0x9f6c0686 Sequence: 2 Data (84 bytes) 0000 00 d0 cf 01 f5 33 00 0c 29 b1 20 22 08 00 45 00 .....3..). "..E. 0010 00 70 00 02 00 00 80 32 fb 93 a5 e3 f9 73 a5 e3 .p.....2.....s.. 0020 f9 8b 9f 6c 06 86 00 00 00 02 ab 59 b1 b8 a7 f0 ...l.......Y.... 0030 62 3f 6c 19 f2 dc d6 f5 9e 9a 7f 84 cf d1 34 60 b?l...........4` 0040 ab ec 2b 7f 63 33 ab 08 16 e7 80 47 fe 38 c6 8a ..+.c3.....G.8.. 0050 83 1c 91 60 cd 9c e7 0e 90 fa 10 05 46 21 d5 e3 ...`........F!.. 0060 7a ad bd 22 2b 4e 7e 20 d6 7f 5c 75 52 38 bc 60 z.."+N~ ..\uR8.` 0070 19 57 ba c6 93 dd ab ac e6 ac e3 98 53 34 94 9d .W..........S4.. 0080 5e b4 ^. Frame 13 (130 bytes on wire, 130 bytes captured) Arrival Time: Mar 16, 2004 17:23:02.539454000 Time delta from previous packet: 0.001778000 seconds Time since reference or first frame: 11.260392000 seconds Frame Number: 13 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:d0:cf:01:f5:33, Dst: 00:0c:29:b1:20:22 Destination: 00:0c:29:b1:20:22 (00:0c:29:b1:20:22) Source: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Type: IP (0x0800) Frame check sequence: 0x4017f22e (correct) Internet Protocol, Src Addr: 165.227.249.139 (165.227.249.139), Dst Addr: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0xb6f4 (46836) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x84a1 (correct) Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x57425f39 Sequence: 2 Data (84 bytes) 0000 00 0c 29 b1 20 22 00 d0 cf 01 f5 33 08 00 45 00 ..). ".....3..E. 0010 00 70 b6 f4 00 00 40 32 84 a1 a5 e3 f9 8b a5 e3 .p....@2........ 0020 f9 73 57 42 5f 39 00 00 00 02 3a c3 44 87 c9 b1 .sWB_9....:.D... 0030 d6 87 c3 92 cc 5d a9 a4 bc 0b 37 44 27 e8 9b 96 .....]....7D'... 0040 9f cd e2 bf 98 4a 1b 88 90 35 41 5b 3b 84 c2 a0 .....J...5A[;... 0050 f1 ab ef 09 28 45 54 02 a4 7a 2c ca 73 8d 62 92 ....(ET..z,.s.b. 0060 22 7e 8d dc e3 96 62 b7 1f 1a 0e f6 63 80 98 81 "~....b.....c... 0070 54 7f 78 30 ae e8 fd e0 0c 9f dc 18 91 f4 40 17 T.x0..........@. 0080 f2 2e ..