Frame 1 (142 bytes on wire, 142 bytes captured) Arrival Time: May 20, 2008 11:45:42.640748000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 142 bytes Capture Length: 142 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.157 (165.227.249.157), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x0021 (33) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb73 [correct] Good: True Bad : False Source: 165.227.249.157 (165.227.249.157) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0x2fb8 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x093F5B37A539A510 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 40 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 32 Transform number: 0 Transform ID: KEY_IKE (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 ab 06 ab 00 14 6c a6 ca 37 08 00 45 00 ..).....l..7..E. 0010 00 80 00 21 40 00 40 11 fb 73 a5 e3 f9 9d a5 e3 ...!@.@..s...... 0020 f9 73 01 f4 01 f4 00 6c 2f b8 09 3f 5b 37 a5 39 .s.....l/..?[7.9 0030 a5 10 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 64 0d 00 00 34 00 00 00 01 00 00 .....d...4...... 0050 00 01 00 00 00 28 00 01 00 01 00 00 00 20 00 01 .....(....... .. 0060 00 00 80 0b 00 01 80 0c 70 80 80 01 00 05 80 02 ........p....... 0070 00 02 80 03 00 01 80 04 00 02 00 00 00 14 af ca ................ 0080 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 2 (122 bytes on wire, 122 bytes captured) Arrival Time: May 20, 2008 11:45:44.101255000 Time delta from previous packet: 1.460507000 seconds Time since reference or first frame: 1.460507000 seconds Frame Number: 2 Packet Length: 122 bytes Capture Length: 122 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37) Destination: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.157 (165.227.249.157) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 108 Identification: 0x0651 (1617) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf557 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.157 (165.227.249.157) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 88 Checksum: 0x8312 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x093F5B37A539A510 Responder cookie: 0x334E3115F537BB7E Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 80 Security Association payload Next payload: NONE (0) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 32 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 14 6c a6 ca 37 00 0c 29 ab 06 ab 08 00 45 00 ..l..7..).....E. 0010 00 6c 06 51 00 00 80 11 f5 57 a5 e3 f9 73 a5 e3 .l.Q.....W...s.. 0020 f9 9d 01 f4 01 f4 00 58 83 12 09 3f 5b 37 a5 39 .......X...?[7.9 0030 a5 10 33 4e 31 15 f5 37 bb 7e 01 10 02 00 00 00 ..3N1..7.~...... 0040 00 00 00 00 00 50 00 00 00 34 00 00 00 01 00 00 .....P...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 00 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 ........p. Frame 3 (222 bytes on wire, 222 bytes captured) Arrival Time: May 20, 2008 11:45:44.279259000 Time delta from previous packet: 0.178004000 seconds Time since reference or first frame: 1.638511000 seconds Frame Number: 3 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.157 (165.227.249.157), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0022 (34) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb22 [correct] Good: True Bad : False Source: 165.227.249.157 (165.227.249.157) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xabc7 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x093F5B37A539A510 Responder cookie: 0x334E3115F537BB7E Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 ab 06 ab 00 14 6c a6 ca 37 08 00 45 00 ..).....l..7..E. 0010 00 d0 00 22 40 00 40 11 fb 22 a5 e3 f9 9d a5 e3 ..."@.@.."...... 0020 f9 73 01 f4 01 f4 00 bc ab c7 09 3f 5b 37 a5 39 .s.........?[7.9 0030 a5 10 33 4e 31 15 f5 37 bb 7e 04 10 02 00 00 00 ..3N1..7.~...... 0040 00 00 00 00 00 b4 0a 00 00 84 2e 30 5d 27 f0 ea ...........0]'.. 0050 b6 b3 be 06 c6 e0 aa fa 62 92 2f 5a 63 89 85 a6 ........b./Zc... 0060 d9 b6 4e 62 dd c2 90 f6 70 82 aa 2b 4d 31 e5 fd ..Nb....p..+M1.. 0070 9b 97 5b 42 8f cb 3e c5 a4 e7 21 ef 7d 34 3d 52 ..[B..>...!.}4=R 0080 79 3f 6c bc 34 2b 72 55 a2 6a 90 f6 cd 2c a9 f2 y?l.4+rU.j...,.. 0090 45 66 fc c0 99 0e 74 3f 9c d9 fe 00 5e 8b 8c 7d Ef....t?....^..} 00a0 df 9f 46 68 8a 90 48 7a 2e 48 77 91 9c 9a 3d bc ..Fh..Hz.Hw...=. 00b0 83 15 37 2e 32 57 25 07 ad 4f 86 ca 4b e5 12 bf ..7.2W%..O..K... 00c0 cf 30 66 e3 04 a3 27 aa 8b 85 00 00 00 14 db c5 .0f...'......... 00d0 c7 7f ac f6 97 f9 f3 ff c8 3b 4b f5 29 02 .........;K.). Frame 4 (294 bytes on wire, 294 bytes captured) Arrival Time: May 20, 2008 11:45:45.855129000 Time delta from previous packet: 1.575870000 seconds Time since reference or first frame: 3.214381000 seconds Frame Number: 4 Packet Length: 294 bytes Capture Length: 294 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37) Destination: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.157 (165.227.249.157) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 280 Identification: 0x0658 (1624) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf4a4 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.157 (165.227.249.157) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 260 Checksum: 0xce02 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x093F5B37A539A510 Responder cookie: 0x334E3115F537BB7E Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 252 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 20 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 48 Vendor ID: unknown vendor ID: 0x47BBE7C993F1FC13B4E6D0DB565C68E50102010102010103... Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0xDA8E937880010000 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 14 6c a6 ca 37 00 0c 29 ab 06 ab 08 00 45 00 ..l..7..).....E. 0010 01 18 06 58 00 00 80 11 f4 a4 a5 e3 f9 73 a5 e3 ...X.........s.. 0020 f9 9d 01 f4 01 f4 01 04 ce 02 09 3f 5b 37 a5 39 ...........?[7.9 0030 a5 10 33 4e 31 15 f5 37 bb 7e 04 10 02 00 00 00 ..3N1..7.~...... 0040 00 00 00 00 00 fc 0a 00 00 84 f5 61 39 01 c3 a8 ...........a9... 0050 11 65 16 ec ae b4 3c 5b e1 80 57 b4 be b3 70 ef .e....<[..W...p. 0060 0e 01 59 c1 8e 31 33 c5 6b 8b b3 f8 db 50 5d 04 ..Y..13.k....P]. 0070 99 02 1d 4f b8 f0 4b fd 3b 8f 9b 72 fc 3b d4 a2 ...O..K.;..r.;.. 0080 e1 43 e9 26 9f 3f 6c 0a 2d b2 68 53 da 5e bf b4 .C.&.?l.-.hS.^.. 0090 72 40 b2 d8 03 2b 31 fd f0 60 45 6a 87 c0 d7 47 r@...+1..`Ej...G 00a0 a9 16 d5 98 23 00 5f 56 fd fe 85 23 86 88 79 9a ....#._V...#..y. 00b0 fb b9 fc f9 7b b3 14 f0 ee c3 09 8d 47 17 62 7c ....{.......G.b| 00c0 37 28 9c 67 d0 ef ac 76 1e e0 0d 00 00 14 15 c5 7(.g...v........ 00d0 c2 74 d7 a0 4d 12 4b dd 52 10 a7 b4 8a 69 0d 00 .t..M.K.R....i.. 00e0 00 30 47 bb e7 c9 93 f1 fc 13 b4 e6 d0 db 56 5c .0G...........V\ 00f0 68 e5 01 02 01 01 02 01 01 03 11 31 30 2e 31 2e h..........10.1. 0100 31 20 28 42 75 69 6c 64 20 31 30 29 00 00 0d 00 1 (Build 10).... 0110 00 0c da 8e 93 78 80 01 00 00 00 00 00 0c 09 00 .....x.......... 0120 26 89 df d6 b7 12 &..... Frame 5 (110 bytes on wire, 110 bytes captured) Arrival Time: May 20, 2008 11:45:46.070617000 Time delta from previous packet: 0.215488000 seconds Time since reference or first frame: 3.429869000 seconds Frame Number: 5 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.157 (165.227.249.157), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0023 (35) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb91 [correct] Good: True Bad : False Source: 165.227.249.157 (165.227.249.157) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0xd5d9 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x093F5B37A539A510 Responder cookie: 0x334E3115F537BB7E Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 ab 06 ab 00 14 6c a6 ca 37 08 00 45 00 ..).....l..7..E. 0010 00 60 00 23 40 00 40 11 fb 91 a5 e3 f9 9d a5 e3 .`.#@.@......... 0020 f9 73 01 f4 01 f4 00 4c d5 d9 09 3f 5b 37 a5 39 .s.....L...?[7.9 0030 a5 10 33 4e 31 15 f5 37 bb 7e 05 10 02 01 00 00 ..3N1..7.~...... 0040 00 00 00 00 00 44 59 c0 36 17 ea 24 bb 75 6b 5e .....DY.6..$.uk^ 0050 c2 fd be 33 94 64 7a 58 67 00 e2 0f 55 f5 28 11 ...3.dzXg...U.(. 0060 83 cf 88 d5 eb ab 8e 32 f1 ca 5b be 4f a9 .......2..[.O. Frame 6 (110 bytes on wire, 110 bytes captured) Arrival Time: May 20, 2008 11:45:46.070619000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 3.429871000 seconds Frame Number: 6 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37) Destination: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.157 (165.227.249.157) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x065b (1627) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf559 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.157 (165.227.249.157) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x72c4 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x093F5B37A539A510 Responder cookie: 0x334E3115F537BB7E Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 14 6c a6 ca 37 00 0c 29 ab 06 ab 08 00 45 00 ..l..7..).....E. 0010 00 60 06 5b 00 00 80 11 f5 59 a5 e3 f9 73 a5 e3 .`.[.....Y...s.. 0020 f9 9d 01 f4 01 f4 00 4c 72 c4 09 3f 5b 37 a5 39 .......Lr..?[7.9 0030 a5 10 33 4e 31 15 f5 37 bb 7e 05 10 02 01 00 00 ..3N1..7.~...... 0040 00 00 00 00 00 44 dc 6b aa 61 9e 1a e9 93 e1 b7 .....D.k.a...... 0050 9d 6e 19 ef 91 d9 dd a7 a4 ee 1a 42 e4 56 81 a4 .n.........B.V.. 0060 9e 9b f8 e1 a3 81 e1 d9 6b fa eb 30 ce 5d ........k..0.] Frame 7 (326 bytes on wire, 326 bytes captured) Arrival Time: May 20, 2008 11:45:46.298231000 Time delta from previous packet: 0.227612000 seconds Time since reference or first frame: 3.657483000 seconds Frame Number: 7 Packet Length: 326 bytes Capture Length: 326 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.157 (165.227.249.157), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0024 (36) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfab8 [correct] Good: True Bad : False Source: 165.227.249.157 (165.227.249.157) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xdc64 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x093F5B37A539A510 Responder cookie: 0x334E3115F537BB7E Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xFE81546D Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 ab 06 ab 00 14 6c a6 ca 37 08 00 45 00 ..).....l..7..E. 0010 01 38 00 24 40 00 40 11 fa b8 a5 e3 f9 9d a5 e3 .8.$@.@......... 0020 f9 73 01 f4 01 f4 01 24 dc 64 09 3f 5b 37 a5 39 .s.....$.d.?[7.9 0030 a5 10 33 4e 31 15 f5 37 bb 7e 08 10 20 01 fe 81 ..3N1..7.~.. ... 0040 54 6d 00 00 01 1c e1 bc de 1b 7a 91 a3 5e 8c 27 Tm........z..^.' 0050 fd 95 85 5d b4 c8 e8 6d c1 6d 31 f4 f9 7c a9 83 ...]...m.m1..|.. 0060 5a 2b ad 28 18 a4 51 cc f8 9e c7 2b e5 5a d1 a5 Z+.(..Q....+.Z.. 0070 ed 75 4e d5 2c d1 bc 62 f9 49 52 f1 d6 04 ba cf .uN.,..b.IR..... 0080 a7 b9 63 1d 30 f6 8f 06 4f e9 9b bc c7 78 5c 8b ..c.0...O....x\. 0090 66 4d eb 43 c3 59 7f b5 ca cd 82 94 09 d7 6b 7d fM.C.Y........k} 00a0 86 3c a1 6f 91 6a 31 ca c6 e6 a0 67 58 ed f0 f7 .<.o.j1....gX... 00b0 d9 1b c8 c3 26 90 2b a5 ec 99 dc 1b 29 e1 a6 a7 ....&.+.....)... 00c0 ef bd b2 ad c9 0b 4b 8f 6b 6e cf 7d de e7 b7 91 ......K.kn.}.... 00d0 d5 d8 6d b3 38 37 6e 7a 5a c3 d0 bc 35 44 c1 ec ..m.87nzZ...5D.. 00e0 c4 40 9f 1a a6 fc ac 83 f5 01 9c 17 d6 17 e4 6e .@.............n 00f0 8c a5 b8 b1 89 48 41 71 80 c8 ac 9d 10 30 7f 98 .....HAq.....0.. 0100 df 72 82 86 e3 d6 ed 8e a8 30 0b 97 02 e4 cd 59 .r.......0.....Y 0110 c4 de 62 a0 dd c9 f0 5f 5e 7e 3c 0e 46 b9 c9 47 ..b...._^~<.F..G 0120 9d 5d d7 f4 b5 85 97 93 9b 74 07 ea da c9 7c ae .].......t....|. 0130 ca 77 91 89 af 8a a6 18 f7 7d 02 34 bb fd f6 7e .w.......}.4...~ 0140 68 c0 bb 8d 3b 99 h...;. Frame 8 (358 bytes on wire, 358 bytes captured) Arrival Time: May 20, 2008 11:45:48.025331000 Time delta from previous packet: 1.727100000 seconds Time since reference or first frame: 5.384583000 seconds Frame Number: 8 Packet Length: 358 bytes Capture Length: 358 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37) Destination: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.157 (165.227.249.157) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 344 Identification: 0x0665 (1637) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf457 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.157 (165.227.249.157) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 324 Checksum: 0xcca9 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x093F5B37A539A510 Responder cookie: 0x334E3115F537BB7E Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..1. = Commit .... .0.. = No authentication Message ID: 0xFE81546D Length: 316 Encrypted payload (288 bytes) 0000 00 14 6c a6 ca 37 00 0c 29 ab 06 ab 08 00 45 00 ..l..7..).....E. 0010 01 58 06 65 00 00 80 11 f4 57 a5 e3 f9 73 a5 e3 .X.e.....W...s.. 0020 f9 9d 01 f4 01 f4 01 44 cc a9 09 3f 5b 37 a5 39 .......D...?[7.9 0030 a5 10 33 4e 31 15 f5 37 bb 7e 08 10 20 03 fe 81 ..3N1..7.~.. ... 0040 54 6d 00 00 01 3c 89 59 47 99 36 f1 b1 d2 2a 1a Tm...<.YG.6...*. 0050 3e 18 c2 36 eb cb 08 b4 42 c2 f5 ce dd 5b 59 97 >..6....B....[Y. 0060 50 ed 9a aa c6 53 6d b0 2d 5c d2 98 e5 ff 07 16 P....Sm.-\...... 0070 f9 a9 1a eb 9f b4 dd 8f 1a 3b 68 29 fc f3 dc a0 .........;h).... 0080 06 b8 20 ff 79 38 2a e2 08 18 dc 88 84 7f 66 18 .. .y8*.......f. 0090 6d 5c 1b 09 a4 7d dc f6 5c 4d 1a 8e 71 d3 f1 b5 m\...}..\M..q... 00a0 d0 7d 0d 7c c4 dc 50 29 b1 af a6 43 01 77 9f 3e .}.|..P)...C.w.> 00b0 c4 6f bf bf 58 32 fa c0 29 40 95 71 3e 58 a5 fb .o..X2..)@.q>X.. 00c0 0e ca 2c bd 0b 65 84 87 19 3a 74 0b 2a 7c fa ee ..,..e...:t.*|.. 00d0 3f b7 8f d4 a1 d5 c2 9a 67 2e 5b 2c a8 6b de 29 ?.......g.[,.k.) 00e0 e2 90 4f 61 19 6b 3b 45 20 8a 24 e5 66 95 69 c6 ..Oa.k;E .$.f.i. 00f0 69 d9 da 93 f2 a2 0b f1 d8 e2 a6 57 fa 21 ce e5 i..........W.!.. 0100 b1 36 ba d1 fd 5f 0a 35 47 41 7e 4f 6f da 14 9c .6..._.5GA~Oo... 0110 0b be 19 60 9d 1f 76 13 c3 91 f5 54 66 c9 cd 8c ...`..v....Tf... 0120 8a b9 9f e2 d0 3d 17 b6 c0 66 02 73 a5 2f 5b d6 .....=...f.s./[. 0130 ad 5f 31 8c 4d b5 f3 d0 fb c9 4f 73 b7 f2 6f 79 ._1.M.....Os..oy 0140 47 58 17 8a 2f 8b bc 80 18 19 1f 4a fe e3 0e e9 GX../......J.... 0150 65 8b d6 36 98 76 6e 5d 36 93 c5 bd 5e 00 d7 97 e..6.vn]6...^... 0160 2e 0d 2a d7 b9 26 ..*..& Frame 9 (94 bytes on wire, 94 bytes captured) Arrival Time: May 20, 2008 11:45:48.543898000 Time delta from previous packet: 0.518567000 seconds Time since reference or first frame: 5.903150000 seconds Frame Number: 9 Packet Length: 94 bytes Capture Length: 94 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.157 (165.227.249.157), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 80 Identification: 0x0025 (37) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb9f [correct] Good: True Bad : False Source: 165.227.249.157 (165.227.249.157) Destination: 165.227.249.115 (165.227.249.115) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 60 Checksum: 0xbacf [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x093F5B37A539A510 Responder cookie: 0x334E3115F537BB7E Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xFE81546D Length: 52 Encrypted payload (24 bytes) 0000 00 0c 29 ab 06 ab 00 14 6c a6 ca 37 08 00 45 00 ..).....l..7..E. 0010 00 50 00 25 40 00 40 11 fb 9f a5 e3 f9 9d a5 e3 .P.%@.@......... 0020 f9 73 01 f4 01 f4 00 3c ba cf 09 3f 5b 37 a5 39 .s.....<...?[7.9 0030 a5 10 33 4e 31 15 f5 37 bb 7e 08 10 20 01 fe 81 ..3N1..7.~.. ... 0040 54 6d 00 00 00 34 df 9a bf 11 d3 5c ec 36 4e 51 Tm...4.....\.6NQ 0050 17 bd d4 32 ac 4c e0 11 be 9f f7 49 e8 0c ...2.L.....I.. Frame 10 (126 bytes on wire, 126 bytes captured) Arrival Time: May 20, 2008 11:45:55.662589000 Time delta from previous packet: 7.118691000 seconds Time since reference or first frame: 13.021841000 seconds Frame Number: 10 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab), Dst: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37) Destination: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37) Source: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.115 (165.227.249.115), Dst: 165.227.249.157 (165.227.249.157) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xfb82 [correct] Good: True Bad : False Source: 165.227.249.115 (165.227.249.115) Destination: 165.227.249.157 (165.227.249.157) Encapsulating Security Payload SPI: 0x3bdee4b9 Sequence: 1 Data (84 bytes) 0000 00 14 6c a6 ca 37 00 0c 29 ab 06 ab 08 00 45 00 ..l..7..).....E. 0010 00 70 00 01 00 00 80 32 fb 82 a5 e3 f9 73 a5 e3 .p.....2.....s.. 0020 f9 9d 3b de e4 b9 00 00 00 01 2d 45 47 01 ca 61 ..;.......-EG..a 0030 4a 9d db c8 c3 9a 01 07 0b f6 d6 7a d3 b2 91 b9 J..........z.... 0040 07 cc b0 da 20 d9 f5 37 cd d1 45 5a f9 0a a6 16 .... ..7..EZ.... 0050 1d c6 01 4b ed 20 dd 4f 58 83 72 f2 18 b7 47 4a ...K. .OX.r...GJ 0060 9c e0 21 00 f0 86 55 3e f6 af c0 81 ab 4b 86 6c ..!...U>.....K.l 0070 d3 ad 76 e3 69 6c 0c b7 0a 68 1f 28 30 7a ..v.il...h.(0z Frame 11 (126 bytes on wire, 126 bytes captured) Arrival Time: May 20, 2008 11:45:55.885833000 Time delta from previous packet: 0.223244000 seconds Time since reference or first frame: 13.245085000 seconds Frame Number: 11 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37), Dst: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Destination: 00:0c:29:ab:06:ab (00:0c:29:ab:06:ab) Source: 00:14:6c:a6:ca:37 (00:14:6c:a6:ca:37) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.157 (165.227.249.157), Dst: 165.227.249.115 (165.227.249.115) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0xd958 (55640) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x622b [correct] Good: True Bad : False Source: 165.227.249.157 (165.227.249.157) Destination: 165.227.249.115 (165.227.249.115) Encapsulating Security Payload SPI: 0x887698d1 Sequence: 1 Data (84 bytes) 0000 00 0c 29 ab 06 ab 00 14 6c a6 ca 37 08 00 45 00 ..).....l..7..E. 0010 00 70 d9 58 00 00 40 32 62 2b a5 e3 f9 9d a5 e3 .p.X..@2b+...... 0020 f9 73 88 76 98 d1 00 00 00 01 ce 1d 99 d2 d9 e4 .s.v............ 0030 56 f6 0a a0 7c 7a b4 0d 76 5f 0a a0 0e 0c ea a5 V...|z..v_...... 0040 eb 66 6f c7 54 af cd a8 27 b7 a5 5d 17 df 8d ef .fo.T...'..].... 0050 9f 23 6a b5 2f c1 c0 3e ba 45 db b2 1e 9d 5c a4 .#j./..>.E....\. 0060 6d 9a f9 cb eb 41 b2 a2 52 d1 28 99 f5 df 51 72 m....A..R.(...Qr 0070 59 53 25 51 7b 6a 07 e8 a5 0a 81 1c b8 36 YS%Q{j.......6