Frame 1 (166 bytes on wire, 166 bytes captured) Arrival Time: Jan 21, 2006 15:49:42.883306000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 166 bytes Capture Length: 166 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Type: IP (0x0800) Trailer: B0175438 Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 148 Identification: 0x090b (2315) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf27f [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 128 Checksum: 0xba7c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x05BFBCD3BBBB544F Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 120 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 0000 00 13 c4 80 d3 aa 00 0c 29 1d cf fc 08 00 45 00 ........).....E. 0010 00 94 09 0b 00 00 80 11 f2 7f a5 e3 f9 73 a5 e3 .............s.. 0020 f9 93 01 f4 01 f4 00 80 ba 7c 05 bf bc d3 bb bb .........|...... 0030 54 4f 00 00 00 00 00 00 00 00 01 10 02 00 00 00 TO.............. 0040 00 00 00 00 00 78 0d 00 00 34 00 00 00 01 00 00 .....x...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 0e 10 0d 00 00 14 44 85 ..............D. 0080 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 00 00 .-.......F.y.... 0090 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 ......>.in.c...B 00a0 7b 1f b0 17 54 38 {...T8 Frame 2 (150 bytes on wire, 150 bytes captured) Arrival Time: Jan 21, 2006 15:49:42.884179000 Time delta from previous packet: 0.000873000 seconds Time since reference or first frame: 0.000873000 seconds Frame Number: 2 Packet Length: 150 bytes Capture Length: 150 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Destination: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 24952FB8 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x2c06 (11270) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x5094 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0x66cd [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x05BFBCD3BBBB544F Responder cookie: 0xD30DD24E1D63C76A Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (3600) Vendor ID payload Next payload: NONE (0) Length: 24 Vendor ID: Microsoft L2TP/IPSec VPN Client 0000 00 0c 29 1d cf fc 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 84 2c 06 00 00 ff 11 50 94 a5 e3 f9 93 a5 e3 ..,.....P....... 0020 f9 73 01 f4 01 f4 00 70 66 cd 05 bf bc d3 bb bb .s.....pf....... 0030 54 4f d3 0d d2 4e 1d 63 c7 6a 01 10 02 00 00 00 TO...N.c.j...... 0040 00 00 00 00 00 68 0d 00 00 34 00 00 00 01 00 00 .....h...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 0e 10 00 00 00 18 40 48 ..............@H 0080 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3 c0 00 ..n...%......... 0090 00 00 24 95 2f b8 ..$./. Frame 3 (302 bytes on wire, 302 bytes captured) Arrival Time: Jan 21, 2006 15:49:44.985242000 Time delta from previous packet: 2.101063000 seconds Time since reference or first frame: 2.101936000 seconds Frame Number: 3 Packet Length: 302 bytes Capture Length: 302 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Type: IP (0x0800) Trailer: A99750E4 Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x090c (2316) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf1f6 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xec9d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x05BFBCD3BBBB544F Responder cookie: 0xD30DD24E1D63C76A Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 13 c4 80 d3 aa 00 0c 29 1d cf fc 08 00 45 00 ........).....E. 0010 01 1c 09 0c 00 00 80 11 f1 f6 a5 e3 f9 73 a5 e3 .............s.. 0020 f9 93 01 f4 01 f4 01 08 ec 9d 05 bf bc d3 bb bb ................ 0030 54 4f d3 0d d2 4e 1d 63 c7 6a 04 10 02 00 00 00 TO...N.c.j...... 0040 00 00 00 00 01 00 0a 00 00 84 af d1 5f 1a bc 12 ............_... 0050 58 cd 04 95 68 e2 90 bf 57 54 a2 54 9f da 59 75 X...h...WT.T..Yu 0060 3d c8 ae 20 ae d4 fd fe e4 43 c6 25 8c ee 76 19 =.. .....C.%..v. 0070 4b 7d 01 9f 65 71 ab 12 d1 88 0e 4b 7b ed 8b fc K}..eq.....K{... 0080 cf ad 85 3c e4 4a be 5d 03 65 2b 34 22 cf fd cf ...<.J.].e+4"... 0090 e2 90 d2 ad a4 8b d4 c4 45 97 ff ba 34 74 f9 67 ........E...4t.g 00a0 d5 a3 d9 d5 7f a0 f0 40 73 fd c1 c1 6c 47 e9 8c .......@s...lG.. 00b0 03 5b ca 45 20 b7 40 32 6f e0 b3 4e 2a fc 1c 89 .[.E .@2o..N*... 00c0 f0 b4 e1 0c 9b 80 4d ea c5 d9 0d 00 00 18 4c e0 ......M.......L. 00d0 fd 98 ec a3 72 1f f1 97 f0 b1 52 9a 26 9c e8 be ....r.....R.&... 00e0 40 e2 0d 00 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 @....0G......... 00f0 d0 db 56 5c 68 e5 01 02 01 01 02 01 01 03 11 31 ..V\h..........1 0100 30 2e 31 2e 31 20 28 42 75 69 6c 64 20 31 30 29 0.1.1 (Build 10) 0110 00 00 0d 00 00 0c da 8e 93 78 80 01 00 00 00 00 .........x...... 0120 00 0c 09 00 26 89 df d6 b7 12 a9 97 50 e4 ....&.......P. Frame 4 (302 bytes on wire, 302 bytes captured) Arrival Time: Jan 21, 2006 15:49:44.986867000 Time delta from previous packet: 0.001625000 seconds Time since reference or first frame: 2.103561000 seconds Frame Number: 4 Packet Length: 302 bytes Capture Length: 302 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Destination: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 5F2F927E Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x2c09 (11273) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x4ff9 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0x78d0 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x05BFBCD3BBBB544F Responder cookie: 0xD30DD24E1D63C76A Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x12F5F28C457168A9702D9FE274CC0100 Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x26CA75531D62C76ADDE42C579F8AC615 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x1F07F70EAA6514D3B0FA96542A500100 0000 00 0c 29 1d cf fc 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 01 1c 2c 09 00 00 ff 11 4f f9 a5 e3 f9 93 a5 e3 ..,.....O....... 0020 f9 73 01 f4 01 f4 01 08 78 d0 05 bf bc d3 bb bb .s......x....... 0030 54 4f d3 0d d2 4e 1d 63 c7 6a 04 10 02 00 00 00 TO...N.c.j...... 0040 00 00 00 00 01 00 0a 00 00 84 ef bf 21 fb f4 5a ............!..Z 0050 c1 25 d9 70 d6 1f 98 b2 ad b1 e2 44 55 26 c8 34 .%.p.......DU&.4 0060 7b ed be 61 70 1b d1 7b 6a cd 94 4b fd 42 76 d4 {..ap..{j..K.Bv. 0070 fc 9d 10 6e a8 5a cb 9d 3e 45 08 95 71 e7 fd f0 ...n.Z..>E..q... 0080 8b d8 cc 42 50 57 82 da d4 49 79 07 0e b1 f2 6b ...BPW...Iy....k 0090 33 a9 79 8a ab b3 11 4a cc 9c c8 bc 45 3e ee d6 3.y....J....E>.. 00a0 e9 5c 00 65 7e 0d 68 77 de c2 8a 0a 3f 91 ae ee .\.e~.hw....?... 00b0 74 14 8b 74 f7 f4 8c dd 11 ec 12 e5 00 33 49 94 t..t.........3I. 00c0 b2 17 80 54 f4 92 d3 ac c5 6d 0d 00 00 18 9f 66 ...T.....m.....f 00d0 9e e4 99 4f 5b 55 20 b6 74 c4 19 85 5e d3 a0 f0 ...O[U .t...^... 00e0 19 a9 0d 00 00 14 12 f5 f2 8c 45 71 68 a9 70 2d ..........Eqh.p- 00f0 9f e2 74 cc 01 00 0d 00 00 0c 09 00 26 89 df d6 ..t.........&... 0100 b7 12 0d 00 00 14 26 ca 75 53 1d 62 c7 6a dd e4 ......&.uS.b.j.. 0110 2c 57 9f 8a c6 15 00 00 00 14 1f 07 f7 0e aa 65 ,W.............e 0120 14 d3 b0 fa 96 54 2a 50 01 00 5f 2f 92 7e .....T*P.._/.~ Frame 5 (138 bytes on wire, 138 bytes captured) Arrival Time: Jan 21, 2006 15:49:46.711802000 Time delta from previous packet: 1.724935000 seconds Time since reference or first frame: 3.828496000 seconds Frame Number: 5 Packet Length: 138 bytes Capture Length: 138 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Type: IP (0x0800) Trailer: 7504A648 Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x090e (2318) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf298 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x12ad [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x05BFBCD3BBBB544F Responder cookie: 0xD30DD24E1D63C76A Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 1d cf fc 08 00 45 00 ........).....E. 0010 00 78 09 0e 00 00 80 11 f2 98 a5 e3 f9 73 a5 e3 .x...........s.. 0020 f9 93 01 f4 01 f4 00 64 12 ad 05 bf bc d3 bb bb .......d........ 0030 54 4f d3 0d d2 4e 1d 63 c7 6a 05 10 02 01 00 00 TO...N.c.j...... 0040 00 00 00 00 00 5c 45 47 69 b3 c4 20 76 e3 8a 22 .....\EGi.. v.." 0050 1b 30 0c 5b 7d 20 bc 81 a2 7b 89 cc db 36 eb cf .0.[} ...{...6.. 0060 7c 52 94 a6 69 70 ef ed ce c5 24 d9 41 9f 20 96 |R..ip....$.A. . 0070 4f 63 11 db 99 e2 81 14 9a fd e3 78 57 53 71 5b Oc.........xWSq[ 0080 47 a7 19 aa 98 17 75 04 a6 48 G.....u..H Frame 6 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 21, 2006 15:49:46.713063000 Time delta from previous packet: 0.001261000 seconds Time since reference or first frame: 3.829757000 seconds Frame Number: 6 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Destination: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 5CC7466A Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x2c0a (11274) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x50a4 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0xec3f [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x443CC4846006DCC9 Responder cookie: 0x5EB1483D6F603D35 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x220EE9E4 Length: 84 Encrypted payload (56 bytes) 0000 00 0c 29 1d cf fc 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 70 2c 0a 00 00 ff 11 50 a4 a5 e3 f9 93 a5 e3 .p,.....P....... 0020 f9 73 01 f4 01 f4 00 5c ec 3f 44 3c c4 84 60 06 .s.....\.?D<..`. 0030 dc c9 5e b1 48 3d 6f 60 3d 35 08 10 05 01 22 0e ..^.H=o`=5....". 0040 e9 e4 00 00 00 54 cd 78 bf 45 8f ea d7 12 8a e9 .....T.x.E...... 0050 6f 5a 97 b3 d7 a3 7a 7f b0 67 3e 5a 09 e3 66 71 oZ....z..g>Z..fq 0060 dc 8a ae df c4 7e c9 2c 46 72 b6 ab d3 8b a5 0a .....~.,Fr...... 0070 92 c3 ff 4d bc 53 68 42 e9 fc b2 89 04 ec 5c c7 ...M.ShB......\. 0080 46 6a Fj Frame 7 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 21, 2006 15:49:46.713181000 Time delta from previous packet: 0.000118000 seconds Time since reference or first frame: 3.829875000 seconds Frame Number: 7 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Destination: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 41885853 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x2c0b (11275) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x50a3 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0xdea5 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x05BFBCD3BBBB544F Responder cookie: 0xD30DD24E1D63C76A Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 84 Encrypted payload (56 bytes) 0000 00 0c 29 1d cf fc 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 70 2c 0b 00 00 ff 11 50 a3 a5 e3 f9 93 a5 e3 .p,.....P....... 0020 f9 73 01 f4 01 f4 00 5c de a5 05 bf bc d3 bb bb .s.....\........ 0030 54 4f d3 0d d2 4e 1d 63 c7 6a 05 10 02 01 00 00 TO...N.c.j...... 0040 00 00 00 00 00 54 34 79 3a 73 f7 b7 64 62 e9 67 .....T4y:s..db.g 0050 cb 17 6c 59 de fc 0e a8 24 6c 4d 9c d4 a5 03 de ..lY....$lM..... 0060 9b ea 3e 84 f5 23 ea a9 21 af 34 22 29 e8 04 c8 ..>..#..!.4")... 0070 e9 8c 0a 8a 8c 9e d3 2b d8 e3 40 3d a9 da 41 88 .......+..@=..A. 0080 58 53 XS Frame 8 (338 bytes on wire, 338 bytes captured) Arrival Time: Jan 21, 2006 15:49:48.847698000 Time delta from previous packet: 2.134517000 seconds Time since reference or first frame: 5.964392000 seconds Frame Number: 8 Packet Length: 338 bytes Capture Length: 338 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Type: IP (0x0800) Trailer: FAE87991 Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x0910 (2320) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf1ce [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x9d1d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x05BFBCD3BBBB544F Responder cookie: 0xD30DD24E1D63C76A Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xD6BB06EC Length: 292 Encrypted payload (264 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 1d cf fc 08 00 45 00 ........).....E. 0010 01 40 09 10 00 00 80 11 f1 ce a5 e3 f9 73 a5 e3 .@...........s.. 0020 f9 93 01 f4 01 f4 01 2c 9d 1d 05 bf bc d3 bb bb .......,........ 0030 54 4f d3 0d d2 4e 1d 63 c7 6a 08 10 20 01 d6 bb TO...N.c.j.. ... 0040 06 ec 00 00 01 24 a1 8d 6f 71 1e 15 89 c9 db 60 .....$..oq.....` 0050 87 58 e5 01 f3 ba 08 71 d4 d3 1a 46 98 21 69 88 .X.....q...F.!i. 0060 7f 3d f2 4f 49 3c 8b 3a c3 ad 96 90 cc 4d c9 85 .=.OI<.:.....M.. 0070 4c 56 ef 6a e3 03 bc bb f6 17 8f b2 d2 00 1c 21 LV.j...........! 0080 71 bf cb c7 e3 93 b7 6c 14 89 e8 24 e7 18 80 61 q......l...$...a 0090 be d0 26 9f b4 40 de 69 60 d8 12 4c c1 77 26 1f ..&..@.i`..L.w&. 00a0 b6 65 8a d7 9b 72 e7 46 7e 22 49 84 76 7b 6a 64 .e...r.F~"I.v{jd 00b0 27 d0 aa 4f e6 e4 d4 3f b6 7b 4a 13 27 2f 61 b9 '..O...?.{J.'/a. 00c0 3d fc 1f db e1 13 1e 82 a7 35 8b 15 b8 59 1b 09 =........5...Y.. 00d0 c5 90 6e b5 98 a0 e7 d8 eb 84 bc 58 b8 2f ed 8c ..n........X./.. 00e0 c9 9c f0 6c 14 ea 95 b4 bd cb 6b 84 18 e6 f6 5f ...l......k...._ 00f0 07 c9 e7 c3 88 38 26 85 48 e8 9b 20 ad 77 45 9b .....8&.H.. .wE. 0100 44 94 40 20 e6 4c 2d 00 34 f4 b9 07 9e d3 a0 f4 D.@ .L-.4....... 0110 f6 b8 6c 8f 60 f2 31 69 25 2c a7 a5 46 84 d9 1c ..l.`.1i%,..F... 0120 1e da b0 b4 0a af ad 14 9b c6 61 70 98 04 3b ee ..........ap..;. 0130 17 69 d6 70 78 d9 00 60 51 12 4c 70 b1 92 1d 03 .i.px..`Q.Lp.... 0140 4a 73 60 fe 6f 30 eb 4e 20 b0 ae 68 93 a7 fa e8 Js`.o0.N ..h.... 0150 79 91 y. Frame 9 (338 bytes on wire, 338 bytes captured) Arrival Time: Jan 21, 2006 15:49:48.850257000 Time delta from previous packet: 0.002559000 seconds Time since reference or first frame: 5.966951000 seconds Frame Number: 9 Packet Length: 338 bytes Capture Length: 338 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Destination: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 2C17C09E Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x2c10 (11280) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x4fce [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x2b8b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x05BFBCD3BBBB544F Responder cookie: 0xD30DD24E1D63C76A Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xD6BB06EC Length: 292 Encrypted payload (264 bytes) 0000 00 0c 29 1d cf fc 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 01 40 2c 10 00 00 ff 11 4f ce a5 e3 f9 93 a5 e3 .@,.....O....... 0020 f9 73 01 f4 01 f4 01 2c 2b 8b 05 bf bc d3 bb bb .s.....,+....... 0030 54 4f d3 0d d2 4e 1d 63 c7 6a 08 10 20 01 d6 bb TO...N.c.j.. ... 0040 06 ec 00 00 01 24 31 71 f3 89 7a f0 23 a9 1e 24 .....$1q..z.#..$ 0050 e9 e9 89 3e 31 51 0d 5f 34 f0 22 62 36 c0 2e 84 ...>1Q._4."b6... 0060 b1 59 e1 91 c0 9a c2 be c5 7c 94 d2 8a 38 9d 2b .Y.......|...8.+ 0070 a4 55 2f 27 21 92 f6 a3 d0 d8 2d 67 53 23 51 86 .U/'!.....-gS#Q. 0080 a5 ad c6 5a 9d a6 1c bf 4b be 97 40 df 1c 66 d6 ...Z....K..@..f. 0090 9d cc 35 07 3d d1 9c ba 32 b8 bc e5 91 16 b6 58 ..5.=...2......X 00a0 2b 41 fc 8b 5e 66 56 f8 7a 5c 44 0b b1 ee ae 2a +A..^fV.z\D....* 00b0 67 97 a6 4c 8a 7c 5d 22 fe c9 95 7c 99 bc b3 8b g..L.|]"...|.... 00c0 ba 10 52 e3 8e ec df 15 a0 2c ce 75 b9 81 c4 2e ..R......,.u.... 00d0 4f 23 f7 91 f0 31 d2 e2 47 04 61 b7 51 0f 05 52 O#...1..G.a.Q..R 00e0 5f 25 b6 03 6f dc 82 f0 db 1a 37 cd a5 2a c8 64 _%..o.....7..*.d 00f0 06 14 01 2e 49 c4 5c 85 e3 3b 06 4d ff 3f d7 1f ....I.\..;.M.?.. 0100 1e a9 e3 99 6c e9 1f 29 9f 73 d8 20 5a de 47 7e ....l..).s. Z.G~ 0110 22 83 5f 0c 75 0b 46 ad 2c 46 70 4d c0 fd 82 b8 "._.u.F.,FpM.... 0120 0b 1b 11 85 ac 34 2f 5f b5 f4 72 fa 66 b6 33 5f .....4/_..r.f.3_ 0130 0b 92 f4 60 f7 a8 fb 7f a0 2d 3a f9 48 27 a0 b9 ...`.....-:.H'.. 0140 b9 4a 67 c9 2e 34 59 32 7b 21 6c 00 80 81 2c 17 .Jg..4Y2{!l...,. 0150 c0 9e .. Frame 10 (98 bytes on wire, 98 bytes captured) Arrival Time: Jan 21, 2006 15:49:48.857480000 Time delta from previous packet: 0.007223000 seconds Time since reference or first frame: 5.974174000 seconds Frame Number: 10 Packet Length: 98 bytes Capture Length: 98 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Type: IP (0x0800) Trailer: 044E18D2 Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 80 Identification: 0x0911 (2321) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf2bd [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 60 Checksum: 0x9c24 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x05BFBCD3BBBB544F Responder cookie: 0xD30DD24E1D63C76A Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xD6BB06EC Length: 52 Encrypted payload (24 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 1d cf fc 08 00 45 00 ........).....E. 0010 00 50 09 11 00 00 80 11 f2 bd a5 e3 f9 73 a5 e3 .P...........s.. 0020 f9 93 01 f4 01 f4 00 3c 9c 24 05 bf bc d3 bb bb .......<.$...... 0030 54 4f d3 0d d2 4e 1d 63 c7 6a 08 10 20 01 d6 bb TO...N.c.j.. ... 0040 06 ec 00 00 00 34 93 6d 28 c8 f0 30 db 8c 0a 32 .....4.m(..0...2 0050 b8 b1 ca 6d 65 b1 3d 67 97 50 03 f1 6a 46 04 4e ...me.=g.P..jF.N 0060 18 d2 .. Frame 11 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 21, 2006 15:49:52.967731000 Time delta from previous packet: 4.110251000 seconds Time since reference or first frame: 10.084425000 seconds Frame Number: 11 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Type: IP (0x0800) Trailer: 4A6780C7 Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb8c [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.147 (165.227.249.147) Encapsulating Security Payload SPI: 0x08095053 Sequence: 1 Data (84 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 1d cf fc 08 00 45 00 ........).....E. 0010 00 70 00 01 00 00 80 32 fb 8c a5 e3 f9 73 a5 e3 .p.....2.....s.. 0020 f9 93 08 09 50 53 00 00 00 01 ca 6d 32 46 07 58 ....PS.....m2F.X 0030 06 1c 05 a4 2f ab 70 5a 75 03 09 7a ad 06 62 87 ..../.pZu..z..b. 0040 be b1 f2 0a 4c 86 a0 fb 24 d3 0e d7 d0 22 6f df ....L...$...."o. 0050 83 6b 86 62 f7 4f 40 af 4a 79 0c f6 54 a4 81 7c .k.b.O@.Jy..T..| 0060 04 14 07 40 c6 9b 4d bc 99 42 ed 8d 46 d2 98 14 ...@..M..B..F... 0070 2a 95 eb b3 61 f7 ea 03 41 e7 5c 84 a4 77 4a 67 *...a...A.\..wJg 0080 80 c7 .. Frame 12 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 21, 2006 15:49:52.968484000 Time delta from previous packet: 0.000753000 seconds Time since reference or first frame: 10.085178000 seconds Frame Number: 12 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Destination: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 34665478 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x112c (4396) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x2a62 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x81985def Sequence: 1 Data (84 bytes) 0000 00 0c 29 1d cf fc 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 70 11 2c 00 00 40 32 2a 62 a5 e3 f9 93 a5 e3 .p.,..@2*b...... 0020 f9 73 81 98 5d ef 00 00 00 01 0f e0 23 8e 4b ac .s..].......#.K. 0030 9a c7 b9 62 f9 08 3c 28 80 7d 2b 24 ff e2 9e 9b ...b..<(.}+$.... 0040 66 19 11 3e ba 12 38 46 14 3d 9f ea f0 d9 1d fe f..>..8F.=...... 0050 04 88 ea ef 98 e1 3a 2f 3c 9f 79 b3 d8 38 4f d2 ......:/<.y..8O. 0060 3d b2 14 dc e8 87 19 1a 1c 05 2f 9c f5 4f 33 67 =........./..O3g 0070 72 d3 dd 38 10 67 30 59 99 ce b7 92 e1 b0 34 66 r..8.g0Y......4f 0080 54 78 Tx Frame 13 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 21, 2006 15:49:53.997218000 Time delta from previous packet: 1.028734000 seconds Time since reference or first frame: 11.113912000 seconds Frame Number: 13 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Type: IP (0x0800) Trailer: 67F9915C Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb8b [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.147 (165.227.249.147) Encapsulating Security Payload SPI: 0x08095053 Sequence: 2 Data (84 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 1d cf fc 08 00 45 00 ........).....E. 0010 00 70 00 02 00 00 80 32 fb 8b a5 e3 f9 73 a5 e3 .p.....2.....s.. 0020 f9 93 08 09 50 53 00 00 00 02 ed 8d 46 d2 98 14 ....PS......F... 0030 2a 95 e5 68 5d 7d 52 28 45 e4 c9 b5 9c d8 20 a9 *..h]}R(E..... . 0040 5f c3 d1 f4 db 8d 75 4b bd b5 d2 ff 68 e2 12 92 _.....uK....h... 0050 2f 83 d6 3f 9f 91 91 ec d4 87 7e 16 ba 35 83 90 /..?......~..5.. 0060 28 f7 4b b0 76 37 cf b0 a6 ac 95 dc dc cb 42 f3 (.K.v7........B. 0070 d5 6d 40 41 74 72 51 ff 80 fa 7e 84 25 69 67 f9 .m@AtrQ...~.%ig. 0080 91 5c .\ Frame 14 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 21, 2006 15:49:53.997227000 Time delta from previous packet: 0.000009000 seconds Time since reference or first frame: 11.113921000 seconds Frame Number: 14 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Destination: 00:0c:29:1d:cf:fc (00:0c:29:1d:cf:fc) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: FE99E37D Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x132c (4908) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x2862 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x81985def Sequence: 2 Data (84 bytes) 0000 00 0c 29 1d cf fc 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 70 13 2c 00 00 40 32 28 62 a5 e3 f9 93 a5 e3 .p.,..@2(b...... 0020 f9 73 81 98 5d ef 00 00 00 02 af d2 99 90 30 01 .s..].........0. 0030 dd 6a 2b c4 a2 7b 31 55 05 5f 2a e2 73 ab b9 60 .j+..{1U._*.s..` 0040 10 78 28 13 d3 8c 5a fc 0e 8b b7 f7 e3 a6 e2 9a .x(...Z......... 0050 46 19 2b 79 d7 e0 60 8f 99 1c 6e 28 6d 1e ff eb F.+y..`...n(m... 0060 db 3e 97 a5 1d 65 6f dc 45 e6 10 c7 51 1d ae 50 .>...eo.E...Q..P 0070 42 f7 ba 0a 3c 51 62 40 d6 91 d7 16 fc 80 fe 99 B...