Frame 1 (246 bytes on wire, 246 bytes captured) Arrival Time: Sep 18, 2007 16:30:26.517026000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 246 bytes Capture Length: 246 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:30:48:41:4f:4b (00:30:48:41:4f:4b), Dst: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Destination: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Source: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.116 (165.227.249.116), Dst: 165.227.249.131 (165.227.249.131) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 232 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb45 [correct] Good: True Bad : False Source: 165.227.249.116 (165.227.249.116) Destination: 165.227.249.131 (165.227.249.131) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 212 Checksum: 0xd120 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5179DBE103D9C1EF Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 204 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x1FB99487B303B5E6C4695C0F98074FF4 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x648982785BEDBDD66A6DD356F0E160FD 0000 00 1b 2f 37 c7 b9 00 30 48 41 4f 4b 08 00 45 00 ../7...0HAOK..E. 0010 00 e8 00 00 40 00 40 11 fb 45 a5 e3 f9 74 a5 e3 ....@.@..E...t.. 0020 f9 83 01 f4 01 f4 00 d4 d1 20 51 79 db e1 03 d9 ......... Qy.... 0030 c1 ef 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 cc 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 04 00 02 80 03 00 01 80 01 00 05 80 02 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 0d 00 ............p... 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f 0d 00 00 14 1f b9 94 87 b3 03 ...B{........... 00b0 b5 e6 c4 69 5c 0f 98 07 4f f4 0d 00 00 14 4a 13 ...i\...O.....J. 00c0 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 00d0 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00e0 01 00 00 00 00 14 64 89 82 78 5b ed bd d6 6a 6d ......d..x[...jm 00f0 d3 56 f0 e1 60 fd .V..`. Frame 2 (146 bytes on wire, 146 bytes captured) Arrival Time: Sep 18, 2007 16:30:26.768021000 Time delta from previous packet: 0.250995000 seconds Time since reference or first frame: 0.250995000 seconds Frame Number: 2 Packet Length: 146 bytes Capture Length: 146 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9), Dst: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Destination: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Source: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.131 (165.227.249.131), Dst: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba9 [correct] Good: True Bad : False Source: 165.227.249.131 (165.227.249.131) Destination: 165.227.249.116 (165.227.249.116) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0xb002 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5179DBE103D9C1EF Responder cookie: 0x63D0A6C0BC59F264 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 30 48 41 4f 4b 00 1b 2f 37 c7 b9 08 00 45 00 .0HAOK../7....E. 0010 00 84 00 00 40 00 40 11 fb a9 a5 e3 f9 83 a5 e3 ....@.@......... 0020 f9 74 01 f4 01 f4 00 70 b0 02 51 79 db e1 03 d9 .t.....p..Qy.... 0030 c1 ef 63 d0 a6 c0 bc 59 f2 64 01 10 02 00 00 00 ..c....Y.d...... 0040 00 00 00 00 00 68 0d 00 00 38 00 00 00 01 00 00 .....h...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 04 00 02 80 03 00 01 80 01 00 05 80 02 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 00 00 ............p... 0080 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 0090 01 00 .. Frame 3 (214 bytes on wire, 214 bytes captured) Arrival Time: Sep 18, 2007 16:30:26.817443000 Time delta from previous packet: 0.049422000 seconds Time since reference or first frame: 0.300417000 seconds Frame Number: 3 Packet Length: 214 bytes Capture Length: 214 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:30:48:41:4f:4b (00:30:48:41:4f:4b), Dst: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Destination: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Source: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.116 (165.227.249.116), Dst: 165.227.249.131 (165.227.249.131) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 200 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb65 [correct] Good: True Bad : False Source: 165.227.249.116 (165.227.249.116) Destination: 165.227.249.131 (165.227.249.131) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 180 Checksum: 0x2132 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5179DBE103D9C1EF Responder cookie: 0x63D0A6C0BC59F264 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 172 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 12 Nonce Data 0000 00 1b 2f 37 c7 b9 00 30 48 41 4f 4b 08 00 45 00 ../7...0HAOK..E. 0010 00 c8 00 00 40 00 40 11 fb 65 a5 e3 f9 74 a5 e3 ....@.@..e...t.. 0020 f9 83 01 f4 01 f4 00 b4 21 32 51 79 db e1 03 d9 ........!2Qy.... 0030 c1 ef 63 d0 a6 c0 bc 59 f2 64 04 10 02 00 00 00 ..c....Y.d...... 0040 00 00 00 00 00 ac 0a 00 00 84 60 a9 2f e5 10 82 ..........`./... 0050 38 c4 40 6c 0f 73 15 cf d9 08 60 d5 3f 0e df 47 8.@l.s....`.?..G 0060 46 ae b4 44 78 6b de db b5 f0 1c dd 9d 62 0b 06 F..Dxk.......b.. 0070 ee be 89 f4 65 2d d7 2c dc 8b 18 7f fe 4f 5c 50 ....e-.,.....O\P 0080 95 88 1c ac d5 4f 67 aa e7 b2 2d 10 6b 89 6b b0 .....Og...-.k.k. 0090 25 62 e4 c1 46 26 b1 c3 70 92 ad 38 94 6b 6e 81 %b..F&..p..8.kn. 00a0 00 d6 0c 97 4a f2 ce 72 8f ac 96 07 06 2b a8 94 ....J..r.....+.. 00b0 f7 81 c3 fa c2 1e 39 5c df ab e7 a5 c6 16 e7 f2 ......9\........ 00c0 14 8a 10 6b 1c bc 98 3a c5 10 00 00 00 0c d6 91 ...k...:........ 00d0 59 45 99 6b e5 40 YE.k.@ Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Sep 18, 2007 16:30:27.075808000 Time delta from previous packet: 0.258365000 seconds Time since reference or first frame: 0.558782000 seconds Frame Number: 4 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9), Dst: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Destination: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Source: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.131 (165.227.249.131), Dst: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb5d [correct] Good: True Bad : False Source: 165.227.249.131 (165.227.249.131) Destination: 165.227.249.116 (165.227.249.116) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x7e0d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5179DBE103D9C1EF Responder cookie: 0x63D0A6C0BC59F264 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 30 48 41 4f 4b 00 1b 2f 37 c7 b9 08 00 45 00 .0HAOK../7....E. 0010 00 d0 00 00 40 00 40 11 fb 5d a5 e3 f9 83 a5 e3 ....@.@..]...... 0020 f9 74 01 f4 01 f4 00 bc 7e 0d 51 79 db e1 03 d9 .t......~.Qy.... 0030 c1 ef 63 d0 a6 c0 bc 59 f2 64 04 10 02 00 00 00 ..c....Y.d...... 0040 00 00 00 00 00 b4 0a 00 00 84 52 c3 b4 68 9b bd ..........R..h.. 0050 28 2f 06 a9 be 78 03 83 6d bc cd 03 bf 62 68 15 (/...x..m....bh. 0060 59 0e e0 78 c3 d9 8f e1 56 68 68 88 d6 73 71 c5 Y..x....Vhh..sq. 0070 96 2b c3 f7 17 b7 c4 e5 50 a1 fd 1f 43 d7 2d 9d .+......P...C.-. 0080 f0 94 f7 d0 b4 1b 4f 7d 5d 8e 79 9a 02 d3 37 9b ......O}].y...7. 0090 29 e1 88 92 29 a8 7f 9e 81 81 09 e0 83 e5 16 52 )...)..........R 00a0 ab 72 6a f9 a9 c1 30 55 19 78 38 b3 a2 82 46 f3 .rj...0U.x8...F. 00b0 ab 2b 7e 21 bb 0a 47 81 5f ee eb f5 a6 ab 15 b7 .+~!..G._....... 00c0 66 ca c0 29 85 68 54 15 90 38 00 00 00 14 12 7b f..).hT..8.....{ 00d0 b8 0c e3 8c 60 83 33 61 59 ce bb 85 38 73 ....`.3aY...8s Frame 5 (134 bytes on wire, 134 bytes captured) Arrival Time: Sep 18, 2007 16:30:27.146112000 Time delta from previous packet: 0.070304000 seconds Time since reference or first frame: 0.629086000 seconds Frame Number: 5 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:30:48:41:4f:4b (00:30:48:41:4f:4b), Dst: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Destination: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Source: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.116 (165.227.249.116), Dst: 165.227.249.131 (165.227.249.131) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb5 [correct] Good: True Bad : False Source: 165.227.249.116 (165.227.249.116) Destination: 165.227.249.131 (165.227.249.131) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xa5d9 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5179DBE103D9C1EF Responder cookie: 0x63D0A6C0BC59F264 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 1b 2f 37 c7 b9 00 30 48 41 4f 4b 08 00 45 00 ../7...0HAOK..E. 0010 00 78 00 00 40 00 40 11 fb b5 a5 e3 f9 74 a5 e3 .x..@.@......t.. 0020 f9 83 01 f4 01 f4 00 64 a5 d9 51 79 db e1 03 d9 .......d..Qy.... 0030 c1 ef 63 d0 a6 c0 bc 59 f2 64 05 10 02 01 00 00 ..c....Y.d...... 0040 00 00 00 00 00 5c 51 16 e1 13 7e 11 3b 40 ee 23 .....\Q...~.;@.# 0050 c1 18 20 37 ac e4 ce 1f cb 89 6a 3b c9 81 cd 2a .. 7......j;...* 0060 8f 9a 14 a8 b1 4d 04 10 75 f9 ec c5 ae d3 1a 67 .....M..u......g 0070 75 1f 17 1f 2d ad 70 e6 5b d6 cc c6 fc 30 98 44 u...-.p.[....0.D 0080 ec 93 e4 08 22 42 ...."B Frame 6 (110 bytes on wire, 110 bytes captured) Arrival Time: Sep 18, 2007 16:30:27.267464000 Time delta from previous packet: 0.121352000 seconds Time since reference or first frame: 0.750438000 seconds Frame Number: 6 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9), Dst: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Destination: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Source: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.131 (165.227.249.131), Dst: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbcd [correct] Good: True Bad : False Source: 165.227.249.131 (165.227.249.131) Destination: 165.227.249.116 (165.227.249.116) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0xe8f2 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5179DBE103D9C1EF Responder cookie: 0x63D0A6C0BC59F264 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 30 48 41 4f 4b 00 1b 2f 37 c7 b9 08 00 45 00 .0HAOK../7....E. 0010 00 60 00 00 40 00 40 11 fb cd a5 e3 f9 83 a5 e3 .`..@.@......... 0020 f9 74 01 f4 01 f4 00 4c e8 f2 51 79 db e1 03 d9 .t.....L..Qy.... 0030 c1 ef 63 d0 a6 c0 bc 59 f2 64 05 10 02 01 00 00 ..c....Y.d...... 0040 00 00 00 00 00 44 c2 89 19 df 5e 8f 2f 68 93 c8 .....D....^./h.. 0050 21 dd dc f7 99 f4 6d 73 48 85 0e 97 01 ca f0 2c !.....msH......, 0060 0c 1b c9 90 15 98 a3 66 32 0f 51 4d c0 72 .......f2.QM.r Frame 7 (326 bytes on wire, 326 bytes captured) Arrival Time: Sep 18, 2007 16:30:27.325942000 Time delta from previous packet: 0.058478000 seconds Time since reference or first frame: 0.808916000 seconds Frame Number: 7 Packet Length: 326 bytes Capture Length: 326 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:30:48:41:4f:4b (00:30:48:41:4f:4b), Dst: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Destination: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Source: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.116 (165.227.249.116), Dst: 165.227.249.131 (165.227.249.131) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaf5 [correct] Good: True Bad : False Source: 165.227.249.116 (165.227.249.116) Destination: 165.227.249.131 (165.227.249.131) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xbafd [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5179DBE103D9C1EF Responder cookie: 0x63D0A6C0BC59F264 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x0CC34E8C Length: 284 Encrypted payload (256 bytes) 0000 00 1b 2f 37 c7 b9 00 30 48 41 4f 4b 08 00 45 00 ../7...0HAOK..E. 0010 01 38 00 00 40 00 40 11 fa f5 a5 e3 f9 74 a5 e3 .8..@.@......t.. 0020 f9 83 01 f4 01 f4 01 24 ba fd 51 79 db e1 03 d9 .......$..Qy.... 0030 c1 ef 63 d0 a6 c0 bc 59 f2 64 08 10 20 01 0c c3 ..c....Y.d.. ... 0040 4e 8c 00 00 01 1c 0b 05 28 dd b1 78 74 e8 68 dd N.......(..xt.h. 0050 fc d5 0a 4b 62 df 2a 67 ea e0 fb f1 d9 72 4d 9a ...Kb.*g.....rM. 0060 ef de 06 f0 16 5b 12 9e 92 ee 96 35 74 6b 9d 3c .....[.....5tk.< 0070 11 36 28 b7 05 02 cd d1 d8 ff 6b 0a b0 c6 88 a2 .6(.......k..... 0080 c5 96 cf 72 54 99 e2 8e eb 72 91 b5 d9 a5 3c 69 ...rT....r....S...{...u. 0140 5e 10 9a f1 89 c7 ^..... Frame 8 (334 bytes on wire, 334 bytes captured) Arrival Time: Sep 18, 2007 16:30:27.730070000 Time delta from previous packet: 0.404128000 seconds Time since reference or first frame: 1.213044000 seconds Frame Number: 8 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9), Dst: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Destination: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Source: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.131 (165.227.249.131), Dst: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaed [correct] Good: True Bad : False Source: 165.227.249.131 (165.227.249.131) Destination: 165.227.249.116 (165.227.249.116) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0xc50b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5179DBE103D9C1EF Responder cookie: 0x63D0A6C0BC59F264 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x0CC34E8C Length: 292 Encrypted payload (264 bytes) 0000 00 30 48 41 4f 4b 00 1b 2f 37 c7 b9 08 00 45 00 .0HAOK../7....E. 0010 01 40 00 00 40 00 40 11 fa ed a5 e3 f9 83 a5 e3 .@..@.@......... 0020 f9 74 01 f4 01 f4 01 2c c5 0b 51 79 db e1 03 d9 .t.....,..Qy.... 0030 c1 ef 63 d0 a6 c0 bc 59 f2 64 08 10 20 01 0c c3 ..c....Y.d.. ... 0040 4e 8c 00 00 01 24 c2 dd ad d5 44 17 f3 28 7a da N....$....D..(z. 0050 57 92 e4 c2 ff 1f 0f 83 99 ba 12 ba ce 99 ef 5b W..............[ 0060 d3 de e4 f9 90 29 61 05 b0 a0 10 36 b0 bb 7e a4 .....)a....6..~. 0070 73 87 fa f3 3f 63 36 21 56 6d 57 24 57 b3 93 7c s...?c6!VmW$W..| 0080 23 9f eb 71 a1 dd c5 73 01 31 c1 e2 90 2b a7 c6 #..q...s.1...+.. 0090 22 ac 08 99 7f f7 a8 71 e9 cd 0a 61 ce 65 63 3c "......q...a.ec< 00a0 02 e3 60 25 e6 d9 63 a9 79 17 fc 0f 5e b7 ed 5b ..`%..c.y...^..[ 00b0 21 7e 03 f2 2c 6d 8b 3d f7 26 76 d4 0a 93 ea 2c !~..,m.=.&v...., 00c0 6a df 9b 00 c5 0b 05 4d 37 32 13 ee c8 f1 be bf j......M72...... 00d0 9f 45 ae 24 0d af 3b ec 06 aa ae 32 2c 0f ed d7 .E.$..;....2,... 00e0 01 0b ee 5d 7e 63 fa 61 6d 67 84 bb 15 8e 50 28 ...]~c.amg....P( 00f0 b4 c3 8c 06 0b ad 45 7d 5d 38 0b ff fa d4 51 7c ......E}]8....Q| 0100 38 22 99 6c 71 3a 21 51 68 3c e4 60 97 1a 8e 8e 8".lq:!Qh<.`.... 0110 ff 33 fb b2 c3 98 b6 6f 0b 68 83 73 06 9a f3 d2 .3.....o.h.s.... 0120 b7 c4 6e 54 92 b8 47 3f 7f e6 f9 f7 8c 4b 66 9a ..nT..G?.....Kf. 0130 bb 98 94 15 e5 94 4c b5 b5 16 0e 27 9c 6c a6 c9 ......L....'.l.. 0140 55 21 d0 d0 cb 90 f7 17 1f b5 f9 b5 5f fb U!.........._. Frame 9 (94 bytes on wire, 94 bytes captured) Arrival Time: Sep 18, 2007 16:30:27.732767000 Time delta from previous packet: 0.002697000 seconds Time since reference or first frame: 1.215741000 seconds Frame Number: 9 Packet Length: 94 bytes Capture Length: 94 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:30:48:41:4f:4b (00:30:48:41:4f:4b), Dst: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Destination: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Source: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.116 (165.227.249.116), Dst: 165.227.249.131 (165.227.249.131) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 80 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbdd [correct] Good: True Bad : False Source: 165.227.249.116 (165.227.249.116) Destination: 165.227.249.131 (165.227.249.131) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 60 Checksum: 0x122b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5179DBE103D9C1EF Responder cookie: 0x63D0A6C0BC59F264 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x0CC34E8C Length: 52 Encrypted payload (24 bytes) 0000 00 1b 2f 37 c7 b9 00 30 48 41 4f 4b 08 00 45 00 ../7...0HAOK..E. 0010 00 50 00 00 40 00 40 11 fb dd a5 e3 f9 74 a5 e3 .P..@.@......t.. 0020 f9 83 01 f4 01 f4 00 3c 12 2b 51 79 db e1 03 d9 .......<.+Qy.... 0030 c1 ef 63 d0 a6 c0 bc 59 f2 64 08 10 20 01 0c c3 ..c....Y.d.. ... 0040 4e 8c 00 00 00 34 48 66 21 d1 d2 0e 1e 59 8c d1 N....4Hf!....Y.. 0050 8c 5d ba ae 55 89 67 b0 35 ce 2c 74 2c a2 .]..U.g.5.,t,. Frame 10 (126 bytes on wire, 126 bytes captured) Arrival Time: Sep 18, 2007 16:30:31.651075000 Time delta from previous packet: 3.918308000 seconds Time since reference or first frame: 5.134049000 seconds Frame Number: 10 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:30:48:41:4f:4b (00:30:48:41:4f:4b), Dst: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Destination: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Source: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.116 (165.227.249.116), Dst: 165.227.249.131 (165.227.249.131) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 30 Protocol: ESP (0x32) Header checksum: 0x1d9d [correct] Good: True Bad : False Source: 165.227.249.116 (165.227.249.116) Destination: 165.227.249.131 (165.227.249.131) Encapsulating Security Payload SPI: 0xf94742e5 Sequence: 1 Data (84 bytes) 0000 00 1b 2f 37 c7 b9 00 30 48 41 4f 4b 08 00 45 00 ../7...0HAOK..E. 0010 00 70 00 00 40 00 1e 32 1d 9d a5 e3 f9 74 a5 e3 .p..@..2.....t.. 0020 f9 83 f9 47 42 e5 00 00 00 01 fb 7a 99 6b 56 b2 ...GB......z.kV. 0030 64 e7 76 4a ac 5a b1 02 08 64 8c 3f 3d c6 8b 03 d.vJ.Z...d.?=... 0040 ab b7 94 1a f5 cf bd ea 63 4f 23 6c 3f 6a 99 5c ........cO#l?j.\ 0050 73 c5 23 73 05 d7 fb 19 47 d2 ac 4d 30 6d 2f dc s.#s....G..M0m/. 0060 87 a0 4c 0a 77 8c d1 bf eb 85 27 5b 3b 8a a9 82 ..L.w.....'[;... 0070 5e a2 57 03 12 19 55 27 76 d2 6c c6 06 fd ^.W...U'v.l... Frame 11 (126 bytes on wire, 126 bytes captured) Arrival Time: Sep 18, 2007 16:30:31.767033000 Time delta from previous packet: 0.115958000 seconds Time since reference or first frame: 5.250007000 seconds Frame Number: 11 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9), Dst: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Destination: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Source: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.131 (165.227.249.131), Dst: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0xbdd2 (48594) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x7dca [correct] Good: True Bad : False Source: 165.227.249.131 (165.227.249.131) Destination: 165.227.249.116 (165.227.249.116) Encapsulating Security Payload SPI: 0x0ed5ded4 Sequence: 1 Data (84 bytes) 0000 00 30 48 41 4f 4b 00 1b 2f 37 c7 b9 08 00 45 00 .0HAOK../7....E. 0010 00 70 bd d2 00 00 40 32 7d ca a5 e3 f9 83 a5 e3 .p....@2}....... 0020 f9 74 0e d5 de d4 00 00 00 01 8e eb 9d ab 3b 9f .t............;. 0030 65 fa bf 4c 78 3e 79 ff 8f 63 7d 69 7c 32 46 5d e..Lx>y..c}i|2F] 0040 fe eb fe 3d 2d d7 21 02 af dd 90 2b 08 ba 7c 3b ...=-.!....+..|; 0050 27 c7 96 8f cd 7f 22 1e 47 c0 7e 4c e3 0d 28 84 '.....".G.~L..(. 0060 6d 3c 73 a3 4d 9e 9d a1 8b 35 90 4f 71 37 31 ed m...I.\..$C..@. 0050 0d a0 c0 07 17 7c 60 23 c5 8b 0e bd 75 40 a2 c9 .....|`#....u@.. 0060 53 69 44 84 d3 56 ee ae d4 19 ee f8 bc 3c d7 82 SiD..V.......<.. 0070 91 28 e3 69 fc 1b dc b8 08 03 11 18 8d 8f .(.i.......... Frame 15 (126 bytes on wire, 126 bytes captured) Arrival Time: Sep 18, 2007 16:30:33.762463000 Time delta from previous packet: 0.122447000 seconds Time since reference or first frame: 7.245437000 seconds Frame Number: 15 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9), Dst: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Destination: 00:30:48:41:4f:4b (00:30:48:41:4f:4b) Source: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.131 (165.227.249.131), Dst: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0xbdd4 (48596) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x7dc8 [correct] Good: True Bad : False Source: 165.227.249.131 (165.227.249.131) Destination: 165.227.249.116 (165.227.249.116) Encapsulating Security Payload SPI: 0x0ed5ded4 Sequence: 3 Data (84 bytes) 0000 00 30 48 41 4f 4b 00 1b 2f 37 c7 b9 08 00 45 00 .0HAOK../7....E. 0010 00 70 bd d4 00 00 40 32 7d c8 a5 e3 f9 83 a5 e3 .p....@2}....... 0020 f9 74 0e d5 de d4 00 00 00 03 e2 80 e8 d2 6c fa .t............l. 0030 87 74 de 79 a1 e9 7a e4 00 0f db 6b a6 ea 62 fb .t.y..z....k..b. 0040 55 64 11 7e d6 ab 27 7b 28 e6 44 1e f1 ba e9 ad Ud.~..'{(.D..... 0050 18 66 4d 38 d8 3f ae ee cf 38 95 10 0a 5e 0d 08 .fM8.?...8...^.. 0060 93 df fe ab c7 6b 29 a7 5a 61 9f 88 58 c4 9e 15 .....k).Za..X... 0070 b5 ae e2 e4 56 5e 3b 68 02 c7 5f 75 7b a4 ....V^;h.._u{.