Frame 1 (162 bytes on wire, 162 bytes captured) Arrival Time: Mar 6, 2007 15:33:24.890459000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 162 bytes Capture Length: 162 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Destination: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 148 Identification: 0x01ac (428) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9df [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 128 Checksum: 0x6919 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x41E501B33479ABF0 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 120 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 0c 29 af 74 f5 00 0c 29 ab 06 ab 08 00 45 00 ..).t...).....E. 0010 00 94 01 ac 00 00 80 11 f9 df a5 e3 f9 73 a5 e3 .............s.. 0020 f9 92 01 f4 01 f4 00 80 69 19 41 e5 01 b3 34 79 ........i.A...4y 0030 ab f0 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 78 0d 00 00 34 00 00 00 01 00 00 .....x...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 0e 10 0d 00 00 14 44 85 ..............D. 0080 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 00 00 .-.......F.y.... 0090 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 ......>.in.c...B 00a0 7b 1f {. Frame 2 (142 bytes on wire, 142 bytes captured) Arrival Time: Mar 6, 2007 15:33:24.928991000 Time delta from previous packet: 0.038532000 seconds Time since reference or first frame: 0.038532000 seconds Frame Number: 2 Packet Length: 142 bytes Capture Length: 142 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x07ef (2031) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf3b0 [correct] Good: True Bad : False Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0x90f2 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x41E501B33479ABF0 Responder cookie: 0x82C294E569E4B995 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 0c 29 ab 06 ab 00 0c 29 af 74 f5 08 00 45 00 ..).....).t...E. 0010 00 80 07 ef 00 00 80 11 f3 b0 a5 e3 f9 92 a5 e3 ................ 0020 f9 73 01 f4 01 f4 00 6c 90 f2 41 e5 01 b3 34 79 .s.....l..A...4y 0030 ab f0 82 c2 94 e5 69 e4 b9 95 01 10 02 00 00 00 ......i......... 0040 00 00 00 00 00 64 0d 00 00 34 00 00 00 01 00 00 .....d...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 80 0c 0e 10 00 00 00 14 90 cb ................ 0080 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f ..>.in.c...B{. Frame 3 (346 bytes on wire, 346 bytes captured) Arrival Time: Mar 6, 2007 15:33:27.081512000 Time delta from previous packet: 2.152521000 seconds Time since reference or first frame: 2.191053000 seconds Frame Number: 3 Packet Length: 346 bytes Capture Length: 346 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Destination: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 332 Identification: 0x01ad (429) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf926 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 312 Checksum: 0xd617 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x41E501B33479ABF0 Responder cookie: 0x82C294E569E4B995 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 304 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: A1317A4F39D26456B10F2BF6C708A909B438E37F NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: Vendor ID (13) Length: 24 Hash of address and port: 469B921116CA7565DEDA5723BCBEE9683B712739 Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 af 74 f5 00 0c 29 ab 06 ab 08 00 45 00 ..).t...).....E. 0010 01 4c 01 ad 00 00 80 11 f9 26 a5 e3 f9 73 a5 e3 .L.......&...s.. 0020 f9 92 01 f4 01 f4 01 38 d6 17 41 e5 01 b3 34 79 .......8..A...4y 0030 ab f0 82 c2 94 e5 69 e4 b9 95 04 10 02 00 00 00 ......i......... 0040 00 00 00 00 01 30 0a 00 00 84 5c dc b9 23 b0 1d .....0....\..#.. 0050 26 90 20 58 38 d6 1d a3 6d 23 3d 93 79 6f bd 72 &. X8...m#=.yo.r 0060 c1 dc fc c2 6b 22 34 72 0e 37 04 cf 85 5b f7 fc ....k"4r.7...[.. 0070 6d 3d 85 49 0f 12 5d 0d c7 4c ab 30 bc 29 25 22 m=.I..]..L.0.)%" 0080 d9 40 bf c5 ae 57 9e 0d 7d 76 c9 56 32 18 9a 18 .@...W..}v.V2... 0090 56 24 e5 ec 23 ff a2 b4 a4 dd 9f 0d a3 15 0a 7e V$..#..........~ 00a0 b2 01 1b ec f2 b0 92 8a f8 18 b5 3d f7 d1 42 f1 ...........=..B. 00b0 dd 6e d4 f1 9f 8f 1e 94 a8 47 ac 17 24 09 76 c9 .n.......G..$.v. 00c0 dd 3f 81 78 c2 78 3f 35 70 b6 82 00 00 18 14 6f .?.x.x?5p......o 00d0 62 6a 90 ca 81 d4 7a b6 a3 cc ab dc 4c d0 cd e0 bj....z.....L... 00e0 9c 7d 82 00 00 18 a1 31 7a 4f 39 d2 64 56 b1 0f .}.....1zO9.dV.. 00f0 2b f6 c7 08 a9 09 b4 38 e3 7f 0d 00 00 18 46 9b +......8......F. 0100 92 11 16 ca 75 65 de da 57 23 bc be e9 68 3b 71 ....ue..W#...h;q 0110 27 39 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 '9...0G......... 0120 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0130 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0140 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0150 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 4 (270 bytes on wire, 270 bytes captured) Arrival Time: Mar 6, 2007 15:33:27.133861000 Time delta from previous packet: 0.052349000 seconds Time since reference or first frame: 2.243402000 seconds Frame Number: 4 Packet Length: 270 bytes Capture Length: 270 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x07f0 (2032) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf32f [correct] Good: True Bad : False Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x83bd [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x41E501B33479ABF0 Responder cookie: 0x82C294E569E4B995 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: 469B921116CA7565DEDA5723BCBEE9683B712739 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Length: 24 Hash of address and port: A1317A4F39D26456B10F2BF6C708A909B438E37F 0000 00 0c 29 ab 06 ab 00 0c 29 af 74 f5 08 00 45 00 ..).....).t...E. 0010 01 00 07 f0 00 00 80 11 f3 2f a5 e3 f9 92 a5 e3 ........./...... 0020 f9 73 01 f4 01 f4 00 ec 83 bd 41 e5 01 b3 34 79 .s........A...4y 0030 ab f0 82 c2 94 e5 69 e4 b9 95 04 10 02 00 00 00 ......i......... 0040 00 00 00 00 00 e4 0a 00 00 84 22 d6 5c 3a 72 35 ..........".\:r5 0050 ef 58 1d f3 8f ef e1 da 8d db f0 aa 75 08 f3 04 .X..........u... 0060 a6 c0 ec a2 81 ed a7 fb 46 d4 b1 c1 12 2e 7b 6b ........F.....{k 0070 47 29 86 da e9 07 95 4d 94 3e 6a 56 62 ed 36 58 G).....M.>jVb.6X 0080 89 83 32 de f6 b8 8f 89 9d 41 6f 28 82 a0 77 9a ..2......Ao(..w. 0090 9d 85 74 9d eb 13 31 5e a2 5e 13 a7 e0 ea fb d0 ..t...1^.^...... 00a0 3b 9b b6 f5 ff 29 e8 cb 21 72 16 10 72 f7 6d 0e ;....)..!r..r.m. 00b0 5f 75 c7 6a 1c 61 e1 27 14 80 db 8a f4 d6 ef 7e _u.j.a.'.......~ 00c0 6b 97 43 63 43 4f 8f 18 dc 13 82 00 00 14 cc bd k.CcCO.......... 00d0 ed f2 29 8a bd 5b f2 09 07 9d 21 97 f2 35 82 00 ..)..[....!..5.. 00e0 00 18 46 9b 92 11 16 ca 75 65 de da 57 23 bc be ..F.....ue..W#.. 00f0 e9 68 3b 71 27 39 00 00 00 18 a1 31 7a 4f 39 d2 .h;q'9.....1zO9. 0100 64 56 b1 0f 2b f6 c7 08 a9 09 b4 38 e3 7f dV..+......8.. Frame 5 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 6, 2007 15:33:28.953898000 Time delta from previous packet: 1.820037000 seconds Time since reference or first frame: 4.063439000 seconds Frame Number: 5 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Destination: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x01af (431) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9f8 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xeac0 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x41E501B33479ABF0 Responder cookie: 0x82C294E569E4B995 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 af 74 f5 00 0c 29 ab 06 ab 08 00 45 00 ..).t...).....E. 0010 00 78 01 af 00 00 80 11 f9 f8 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 92 01 f4 01 f4 00 64 ea c0 41 e5 01 b3 34 79 .......d..A...4y 0030 ab f0 82 c2 94 e5 69 e4 b9 95 05 10 02 01 00 00 ......i......... 0040 00 00 00 00 00 5c 3a f1 ae c7 28 e5 b7 90 b5 03 .....\:...(..... 0050 e8 a4 50 03 fb 00 ca e4 a2 03 c6 af f2 1c a9 a7 ..P............. 0060 08 37 05 48 c4 d9 48 09 97 d8 6e 40 5b 51 90 2f .7.H..H...n@[Q./ 0070 46 fc f9 83 cd b1 24 c1 bc 27 3b 1c f1 54 96 54 F.....$..';..T.T 0080 be 45 ae 6e be 54 .E.n.T Frame 6 (110 bytes on wire, 110 bytes captured) Arrival Time: Mar 6, 2007 15:33:28.989698000 Time delta from previous packet: 0.035800000 seconds Time since reference or first frame: 4.099239000 seconds Frame Number: 6 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x07f1 (2033) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf3ce [correct] Good: True Bad : False Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x6202 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x41E501B33479ABF0 Responder cookie: 0x82C294E569E4B995 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 ab 06 ab 00 0c 29 af 74 f5 08 00 45 00 ..).....).t...E. 0010 00 60 07 f1 00 00 80 11 f3 ce a5 e3 f9 92 a5 e3 .`.............. 0020 f9 73 01 f4 01 f4 00 4c 62 02 41 e5 01 b3 34 79 .s.....Lb.A...4y 0030 ab f0 82 c2 94 e5 69 e4 b9 95 05 10 02 01 00 00 ......i......... 0040 00 00 00 00 00 44 c1 b0 f9 1a 6c 3c 45 91 6d b0 .....D....l.....e.G6j...1. 0070 a5 6d 4f d8 d5 42 b0 31 37 19 79 42 ed 4d 12 d0 .mO..B.17.yB.M.. 0080 49 70 6c 07 7a a1 1d 4e c4 da a5 3b 53 d3 2e a9 Ipl.z..N...;S... 0090 bc 4a c5 5f 5f a9 f7 41 84 94 79 98 a0 94 09 92 .J.__..A..y..... 00a0 0a 6e de c6 6f b2 30 f8 36 cb 8d c4 da 3e f6 56 .n..o.0.6....>.V 00b0 8c f9 81 c7 3e 8d db a1 6f 6c fd a6 c8 ff ed 62 ....>...ol.....b 00c0 52 b8 d5 45 ce 01 1d 9f e5 3a c4 64 de c3 b8 b6 R..E.....:.d.... 00d0 30 21 33 05 75 a9 bb 3a 79 17 76 eb 87 1d 03 fd 0!3.u..:y.v..... 00e0 2b b4 31 aa da 86 ea 83 56 45 c6 73 7c 43 bb 23 +.1.....VE.s|C.# 00f0 97 2a dd a9 dc 34 c7 78 e0 21 b7 3b 0e af d1 dd .*...4.x.!.;.... 0100 f5 9f 86 0e 81 1f ff 7d 9f 19 5e 9c 36 a3 1e 82 .......}..^.6... 0110 cb 04 f6 ec b9 09 86 36 24 11 44 44 8f d7 83 17 .......6$.DD.... 0120 f6 51 32 6f 60 8c ef 31 b8 31 31 95 56 aa 1e 84 .Q2o`..1.11.V... 0130 63 09 a1 7b 99 db c7 5c 00 07 a4 ef a5 9c 01 8c c..{...\........ 0140 f0 43 d2 03 a8 fc d0 28 dd 5a 14 6e 94 61 .C.....(.Z.n.a Frame 8 (326 bytes on wire, 326 bytes captured) Arrival Time: Mar 6, 2007 15:33:30.959060000 Time delta from previous packet: 0.021319000 seconds Time since reference or first frame: 6.068601000 seconds Frame Number: 8 Packet Length: 326 bytes Capture Length: 326 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x07f2 (2034) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf2f5 [correct] Good: True Bad : False Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x194f [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x41E501B33479ABF0 Responder cookie: 0x82C294E569E4B995 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xF0A7CEDC Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 ab 06 ab 00 0c 29 af 74 f5 08 00 45 00 ..).....).t...E. 0010 01 38 07 f2 00 00 80 11 f2 f5 a5 e3 f9 92 a5 e3 .8.............. 0020 f9 73 01 f4 01 f4 01 24 19 4f 41 e5 01 b3 34 79 .s.....$.OA...4y 0030 ab f0 82 c2 94 e5 69 e4 b9 95 08 10 20 01 f0 a7 ......i..... ... 0040 ce dc 00 00 01 1c 33 3c a4 d4 54 40 90 66 4c 40 ......3<..T@.fL@ 0050 93 bf b7 38 37 37 83 f9 3c d7 6e 77 79 9e 54 ca ...877..<.nwy.T. 0060 93 c5 f2 6e a2 4e e2 ef d7 85 d3 53 68 1a 62 73 ...n.N.....Sh.bs 0070 a7 50 79 f2 4f e0 3b 5b ee 24 ed 13 8a 70 40 ac .Py.O.;[.$...p@. 0080 00 9a 78 71 0c 59 ba 3d 56 c3 9f 9d a0 13 01 73 ..xq.Y.=V......s 0090 3f a0 74 6a ed e2 5f ed f6 4c 68 2d 29 8c e3 34 ?.tj.._..Lh-)..4 00a0 0f 3e 0c a3 31 41 5a 20 3d 2c 67 5e e4 83 c3 2f .>..1AZ =,g^.../ 00b0 63 f2 b1 71 04 8c 69 7c 65 8e b3 3a f7 c4 86 dd c..q..i|e..:.... 00c0 44 37 e5 9c 32 43 b3 53 1a 7d 2f de df 82 c4 57 D7..2C.S.}/....W 00d0 55 dc 64 49 ca 16 8c d6 d9 73 d2 44 30 59 51 d0 U.dI.....s.D0YQ. 00e0 5d 65 fb cf cc 97 c9 9a a0 12 65 3a 9d d2 33 2d ]e........e:..3- 00f0 af ac 1e 08 9e b6 1d 82 52 6b d5 76 5c 6f 7f d6 ........Rk.v\o.. 0100 43 53 f2 be fe 85 df 2a 02 d0 3e e8 3b 6c c9 d9 CS.....*..>.;l.. 0110 29 77 21 6d a6 ae 91 3c a2 4c e7 a4 43 f5 2f 2a )w!m...<.L..C./* 0120 95 4f 0a 69 35 8a df c1 f7 02 5f 46 4b af 31 14 .O.i5....._FK.1. 0130 ef 2f 44 89 db ae 9d c9 ff 11 dd 2b 17 ef 84 83 ./D........+.... 0140 7b 2e 6b df aa 46 {.k..F Frame 9 (94 bytes on wire, 94 bytes captured) Arrival Time: Mar 6, 2007 15:33:30.962911000 Time delta from previous packet: 0.003851000 seconds Time since reference or first frame: 6.072452000 seconds Frame Number: 9 Packet Length: 94 bytes Capture Length: 94 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Destination: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 80 Identification: 0x01b2 (434) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa1d [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 60 Checksum: 0xace7 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x41E501B33479ABF0 Responder cookie: 0x82C294E569E4B995 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xF0A7CEDC Length: 52 Encrypted payload (24 bytes) 0000 00 0c 29 af 74 f5 00 0c 29 ab 06 ab 08 00 45 00 ..).t...).....E. 0010 00 50 01 b2 00 00 80 11 fa 1d a5 e3 f9 73 a5 e3 .P...........s.. 0020 f9 92 01 f4 01 f4 00 3c ac e7 41 e5 01 b3 34 79 .......<..A...4y 0030 ab f0 82 c2 94 e5 69 e4 b9 95 08 10 20 01 f0 a7 ......i..... ... 0040 ce dc 00 00 00 34 9d 51 a7 60 12 9b 59 90 f2 9b .....4.Q.`..Y... 0050 6d 66 e8 7a d7 e9 73 82 68 e4 6f e7 ab 57 mf.z..s.h.o..W Frame 10 (126 bytes on wire, 126 bytes captured) Arrival Time: Mar 6, 2007 15:33:35.248638000 Time delta from previous packet: 4.285727000 seconds Time since reference or first frame: 10.358179000 seconds Frame Number: 10 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Destination: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb8d [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) Encapsulating Security Payload SPI: 0xe22b101c Sequence: 1 Data (84 bytes) 0000 00 0c 29 af 74 f5 00 0c 29 ab 06 ab 08 00 45 00 ..).t...).....E. 0010 00 70 00 01 00 00 80 32 fb 8d a5 e3 f9 73 a5 e3 .p.....2.....s.. 0020 f9 92 e2 2b 10 1c 00 00 00 01 a0 ab 10 dd e5 31 ...+...........1 0030 d3 26 33 f9 16 8a 61 47 69 cc b2 8a 87 86 10 12 .&3...aGi....... 0040 18 90 16 81 98 34 65 75 31 9c 33 11 42 fb f5 62 .....4eu1.3.B..b 0050 27 84 47 d2 56 73 3f ea dd 1b 0c 95 b4 03 f7 10 '.G.Vs?......... 0060 89 08 17 cd bd 5b 9b 63 86 df 2b 2e a4 b1 a6 c2 .....[.c..+..... 0070 f0 6f a7 df 2c f5 e1 db cc eb f6 69 b1 69 .o..,......i.i Frame 11 (126 bytes on wire, 126 bytes captured) Arrival Time: Mar 6, 2007 15:33:35.248640000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 10.358181000 seconds Frame Number: 11 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x396f (14703) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 126 Protocol: ESP (0x32) Header checksum: 0xc41f [correct] Good: True Bad : False Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x337da6b1 Sequence: 1 Data (84 bytes) 0000 00 0c 29 ab 06 ab 00 0c 29 af 74 f5 08 00 45 00 ..).....).t...E. 0010 00 70 39 6f 00 00 7e 32 c4 1f a5 e3 f9 92 a5 e3 .p9o..~2........ 0020 f9 73 33 7d a6 b1 00 00 00 01 40 e2 34 3f 6c 37 .s3}......@.4?l7 0030 11 a3 61 22 20 fc 56 b6 a3 03 1b c1 5f ee c8 9a ..a" .V....._... 0040 75 03 19 1e 12 70 66 8a 62 be fc 24 aa 0f b8 9f u....pf.b..$.... 0050 e3 ea 62 f6 12 be c9 d3 d2 fc dc b3 fa 81 7c 81 ..b...........|. 0060 bb 6e 60 9b e9 15 01 50 59 ed 5f 4a 81 00 66 43 .n`....PY._J..fC 0070 50 67 ef a4 ab cd 67 7e 99 f3 24 3c eb 0a Pg....g~..$<.. Frame 12 (126 bytes on wire, 126 bytes captured) Arrival Time: Mar 6, 2007 15:33:36.236494000 Time delta from previous packet: 0.987854000 seconds Time since reference or first frame: 11.346035000 seconds Frame Number: 12 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Destination: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.146 (165.227.249.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb8c [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.146 (165.227.249.146) Encapsulating Security Payload SPI: 0xe22b101c Sequence: 2 Data (84 bytes) 0000 00 0c 29 af 74 f5 00 0c 29 ab 06 ab 08 00 45 00 ..).t...).....E. 0010 00 70 00 02 00 00 80 32 fb 8c a5 e3 f9 73 a5 e3 .p.....2.....s.. 0020 f9 92 e2 2b 10 1c 00 00 00 02 2b 2e a4 b1 a6 c2 ...+......+..... 0030 f0 6f a1 07 48 1a e2 f4 41 61 78 5d 81 1e a7 39 .o..H...Aax]...9 0040 a9 47 12 be 09 12 7a 20 d9 bd a2 ce 3a dc b5 26 .G....z ....:..& 0050 fa 42 86 83 86 18 ad d2 8c 9d 11 6b 54 09 01 2b .B.........kT..+ 0060 fa b6 01 5c b6 f3 81 1c 4f 16 43 5c 2e 89 a6 2b ...\....O.C\...+ 0070 7f 7d 90 c7 35 5a 55 24 f7 bc 6f bc 96 e1 .}..5ZU$..o... Frame 13 (126 bytes on wire, 126 bytes captured) Arrival Time: Mar 6, 2007 15:33:36.239688000 Time delta from previous packet: 0.003194000 seconds Time since reference or first frame: 11.349229000 seconds Frame Number: 13 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:0c:29:af:74:f5 (00:0c:29:af:74:f5) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.146 (165.227.249.146), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x3970 (14704) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 126 Protocol: ESP (0x32) Header checksum: 0xc41e [correct] Good: True Bad : False Source: 165.227.249.146 (165.227.249.146) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x337da6b1 Sequence: 2 Data (84 bytes) 0000 00 0c 29 ab 06 ab 00 0c 29 af 74 f5 08 00 45 00 ..).....).t...E. 0010 00 70 39 70 00 00 7e 32 c4 1e a5 e3 f9 92 a5 e3 .p9p..~2........ 0020 f9 73 33 7d a6 b1 00 00 00 02 23 33 80 5f 6c 7c .s3}......#3._l| 0030 14 79 9f 06 88 20 f9 53 e2 0c 09 ea 22 84 c4 bb .y... .S...."... 0040 a4 8e 15 1b 47 9e b1 3f 71 30 2b 3a 10 80 95 b3 ....G..?q0+:.... 0050 bd b4 7b 3e 0d 99 36 81 02 90 72 d1 64 3c 04 77 ..{>..6...r.d<.w 0060 d0 40 6e 2b fa 38 e2 91 13 b4 da 18 6f c6 7f 59 .@n+.8......o..Y 0070 0b fc 0d 53 48 a6 c0 34 d5 f0 8e b7 09 a7 ...SH..4......