Frame 1 (174 bytes on wire, 174 bytes captured) Arrival Time: Jun 16, 2005 14:35:46.921770000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 174 bytes Capture Length: 174 bytes Ethernet II, Src: 00:0c:29:f7:87:89, Dst: 00:0f:b5:4b:45:e0 Destination: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Source: 00:0c:29:f7:87:89 (00:0c:29:f7:87:89) Type: IP (0x0800) Frame check sequence: 0xd2c9e598 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.101 (165.227.249.101) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 156 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba9 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.101 (165.227.249.101) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 136 Checksum: 0x8660 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x2E6B8E93F6A4A8D8 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 128 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 44 Vendor ID: Check Point Check Point Product: VPN-1 Version: NG with Application Intelligence R55 0000 00 0f b5 4b 45 e0 00 0c 29 f7 87 89 08 00 45 00 ...KE...).....E. 0010 00 9c 00 00 40 00 40 11 fb a9 a5 e3 f9 7a a5 e3 ....@.@......z.. 0020 f9 65 01 f4 01 f4 00 88 86 60 2e 6b 8e 93 f6 a4 .e.......`.k.... 0030 a8 d8 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 80 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 00 00 ............p... 0080 00 2c f4 ed 19 e0 c1 14 eb 51 6f aa ac 0e e3 7d .,.......Qo....} 0090 af 28 07 b4 38 1f 00 00 00 01 00 00 13 8d 00 00 .(..8........... 00a0 00 00 00 00 00 00 18 80 00 00 d2 c9 e5 98 .............. Frame 2 (170 bytes on wire, 170 bytes captured) Arrival Time: Jun 16, 2005 14:35:46.928233000 Time delta from previous packet: 0.006463000 seconds Time since reference or first frame: 0.006463000 seconds Frame Number: 2 Packet Length: 170 bytes Capture Length: 170 bytes Ethernet II, Src: 00:0f:b5:4b:45:e0, Dst: 00:0c:29:f7:87:89 Destination: 00:0c:29:f7:87:89 (00:0c:29:f7:87:89) Source: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Type: IP (0x0800) Frame check sequence: 0xcfbe815e (correct) Internet Protocol, Src Addr: 165.227.249.101 (165.227.249.101), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbad (correct) Source: 165.227.249.101 (165.227.249.101) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0xbc7a (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x2E6B8E93F6A4A8D8 Responder cookie: 0x3563CFBB9DC102FD Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-dpd-00.txt Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x648982785BEDBDD66A6DD356F0E160FD 0000 00 0c 29 f7 87 89 00 0f b5 4b 45 e0 08 00 45 00 ..)......KE...E. 0010 00 98 00 00 40 00 40 11 fb ad a5 e3 f9 65 a5 e3 ....@.@......e.. 0020 f9 7a 01 f4 01 f4 00 84 bc 7a 2e 6b 8e 93 f6 a4 .z.......z.k.... 0030 a8 d8 35 63 cf bb 9d c1 02 fd 01 10 02 00 00 00 ..5c............ 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 0d 00 ............p... 0080 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 0090 01 00 00 00 00 14 64 89 82 78 5b ed bd d6 6a 6d ......d..x[...jm 00a0 d3 56 f0 e1 60 fd cf be 81 5e .V..`....^ Frame 3 (230 bytes on wire, 230 bytes captured) Arrival Time: Jun 16, 2005 14:35:46.942163000 Time delta from previous packet: 0.013930000 seconds Time since reference or first frame: 0.020393000 seconds Frame Number: 3 Packet Length: 230 bytes Capture Length: 230 bytes Ethernet II, Src: 00:0c:29:f7:87:89, Dst: 00:0f:b5:4b:45:e0 Destination: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Source: 00:0c:29:f7:87:89 (00:0c:29:f7:87:89) Type: IP (0x0800) Frame check sequence: 0x22ebd7bb (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.101 (165.227.249.101) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb71 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.101 (165.227.249.101) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x5ada (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x2E6B8E93F6A4A8D8 Responder cookie: 0x3563CFBB9DC102FD Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 24 Nonce Data 0000 00 0f b5 4b 45 e0 00 0c 29 f7 87 89 08 00 45 00 ...KE...).....E. 0010 00 d4 00 00 40 00 40 11 fb 71 a5 e3 f9 7a a5 e3 ....@.@..q...z.. 0020 f9 65 01 f4 01 f4 00 c0 5a da 2e 6b 8e 93 f6 a4 .e......Z..k.... 0030 a8 d8 35 63 cf bb 9d c1 02 fd 04 10 02 00 00 00 ..5c............ 0040 00 00 00 00 00 b8 0a 00 00 84 01 39 fa cd fa 80 ...........9.... 0050 72 75 1d ef 7f 17 67 20 c6 81 2c 57 f9 45 fb 93 ru....g ..,W.E.. 0060 c5 1c d0 53 96 ac e2 40 80 d8 98 99 6c 04 10 26 ...S...@....l..& 0070 4b 2b 8d 90 c5 fe 75 85 b3 3f 29 67 7f 8a 10 5d K+....u..?)g...] 0080 1f 8b 0c bf f2 3b 63 0b 1a d2 d7 30 4d 2f 6f bf .....;c....0M/o. 0090 5f 07 ce 2b 40 3b c6 74 9c 5a 7d b6 e3 7f ce 4d _..+@;.t.Z}....M 00a0 2b 55 b1 b8 d5 f1 54 b7 a4 c3 67 59 c3 2d 72 c4 +U....T...gY.-r. 00b0 81 d1 a1 ea e8 03 4d 75 9b 53 21 40 90 40 df 43 ......Mu.S!@.@.C 00c0 a9 22 66 f1 c6 48 31 aa 28 1b 00 00 00 18 7b 98 ."f..H1.(.....{. 00d0 75 8a 69 5e 16 f9 5c 4f 6e 50 3a b6 2d 8d 8a 7e u.i^..\OnP:.-..~ 00e0 75 4e 22 eb d7 bb uN"... Frame 4 (218 bytes on wire, 218 bytes captured) Arrival Time: Jun 16, 2005 14:35:47.159676000 Time delta from previous packet: 0.217513000 seconds Time since reference or first frame: 0.237906000 seconds Frame Number: 4 Packet Length: 218 bytes Capture Length: 218 bytes Ethernet II, Src: 00:0f:b5:4b:45:e0, Dst: 00:0c:29:f7:87:89 Destination: 00:0c:29:f7:87:89 (00:0c:29:f7:87:89) Source: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Type: IP (0x0800) Frame check sequence: 0xa741b3bf (correct) Internet Protocol, Src Addr: 165.227.249.101 (165.227.249.101), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 200 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb7d (correct) Source: 165.227.249.101 (165.227.249.101) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 180 Checksum: 0x7462 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x2E6B8E93F6A4A8D8 Responder cookie: 0x3563CFBB9DC102FD Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 172 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 12 Nonce Data 0000 00 0c 29 f7 87 89 00 0f b5 4b 45 e0 08 00 45 00 ..)......KE...E. 0010 00 c8 00 00 40 00 40 11 fb 7d a5 e3 f9 65 a5 e3 ....@.@..}...e.. 0020 f9 7a 01 f4 01 f4 00 b4 74 62 2e 6b 8e 93 f6 a4 .z......tb.k.... 0030 a8 d8 35 63 cf bb 9d c1 02 fd 04 10 02 00 00 00 ..5c............ 0040 00 00 00 00 00 ac 0a 00 00 84 f7 cf 9a 25 2c 24 .............%,$ 0050 b0 8b 6c d7 d1 30 80 0f 81 67 6a ec c6 dc 26 27 ..l..0...gj...&' 0060 ae fb 39 65 62 12 d7 be e3 ce 2d 65 08 e1 01 4e ..9eb.....-e...N 0070 2c ce 0e 4f 06 d3 65 48 1d a3 42 b7 e4 34 28 46 ,..O..eH..B..4(F 0080 e3 2b 6a 4a 4c 58 df 3f 97 b8 7b 66 ba db b7 db .+jJLX.?..{f.... 0090 9b 18 56 28 53 a2 1a 7d 12 34 de 7c 50 96 8c 17 ..V(S..}.4.|P... 00a0 4c 81 67 a3 7c 10 07 18 84 93 16 00 b7 a8 24 af L.g.|.........$. 00b0 dd 15 69 7b ab 1f 58 e6 fa 71 f0 b2 e1 cc c8 ae ..i{..X..q...... 00c0 fb 90 d0 c3 f1 6e 6c 6a d2 c8 00 00 00 0c 9c 5f .....nlj......._ 00d0 53 c1 37 83 fd 85 a7 41 b3 bf S.7....A.. Frame 5 (114 bytes on wire, 114 bytes captured) Arrival Time: Jun 16, 2005 14:35:47.176631000 Time delta from previous packet: 0.016955000 seconds Time since reference or first frame: 0.254861000 seconds Frame Number: 5 Packet Length: 114 bytes Capture Length: 114 bytes Ethernet II, Src: 00:0c:29:f7:87:89, Dst: 00:0f:b5:4b:45:e0 Destination: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Source: 00:0c:29:f7:87:89 (00:0c:29:f7:87:89) Type: IP (0x0800) Frame check sequence: 0xfdca228e (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.101 (165.227.249.101) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbe5 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.101 (165.227.249.101) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0xd421 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x2E6B8E93F6A4A8D8 Responder cookie: 0x3563CFBB9DC102FD Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0f b5 4b 45 e0 00 0c 29 f7 87 89 08 00 45 00 ...KE...).....E. 0010 00 60 00 00 40 00 40 11 fb e5 a5 e3 f9 7a a5 e3 .`..@.@......z.. 0020 f9 65 01 f4 01 f4 00 4c d4 21 2e 6b 8e 93 f6 a4 .e.....L.!.k.... 0030 a8 d8 35 63 cf bb 9d c1 02 fd 05 10 02 01 00 00 ..5c............ 0040 00 00 00 00 00 44 1b 51 d0 1d 69 30 16 91 1f 40 .....D.Q..i0...@ 0050 29 3d 70 83 53 df 43 a4 ae b5 0d 50 fa 15 f2 b0 )=p.S.C....P.... 0060 9c e7 66 43 c3 c5 98 50 11 38 66 b1 a3 49 fd ca ..fC...P.8f..I.. 0070 22 8e ". Frame 6 (138 bytes on wire, 138 bytes captured) Arrival Time: Jun 16, 2005 14:35:47.401958000 Time delta from previous packet: 0.225327000 seconds Time since reference or first frame: 0.480188000 seconds Frame Number: 6 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:0f:b5:4b:45:e0, Dst: 00:0c:29:f7:87:89 Destination: 00:0c:29:f7:87:89 (00:0c:29:f7:87:89) Source: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Type: IP (0x0800) Frame check sequence: 0x19bdeb15 (correct) Internet Protocol, Src Addr: 165.227.249.101 (165.227.249.101), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbcd (correct) Source: 165.227.249.101 (165.227.249.101) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xe935 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x2E6B8E93F6A4A8D8 Responder cookie: 0x3563CFBB9DC102FD Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 f7 87 89 00 0f b5 4b 45 e0 08 00 45 00 ..)......KE...E. 0010 00 78 00 00 40 00 40 11 fb cd a5 e3 f9 65 a5 e3 .x..@.@......e.. 0020 f9 7a 01 f4 01 f4 00 64 e9 35 2e 6b 8e 93 f6 a4 .z.....d.5.k.... 0030 a8 d8 35 63 cf bb 9d c1 02 fd 05 10 02 01 00 00 ..5c............ 0040 00 00 00 00 00 5c 43 10 da 94 c6 7d c9 7b d8 f7 .....\C....}.{.. 0050 c8 51 0d 3f b5 57 e6 a7 52 4c 22 fb 80 7c 32 ff .Q.?.W..RL"..|2. 0060 ba 5a 69 ae e9 e7 b3 9e 73 58 26 44 73 37 e3 59 .Zi.....sX&Ds7.Y 0070 e1 03 ec c5 6c 91 d7 c8 41 df 77 27 6e 73 1e f1 ....l...A.w'ns.. 0080 41 6a 72 df ea 18 19 bd eb 15 Ajr....... Frame 7 (346 bytes on wire, 346 bytes captured) Arrival Time: Jun 16, 2005 14:35:47.426543000 Time delta from previous packet: 0.024585000 seconds Time since reference or first frame: 0.504773000 seconds Frame Number: 7 Packet Length: 346 bytes Capture Length: 346 bytes Ethernet II, Src: 00:0c:29:f7:87:89, Dst: 00:0f:b5:4b:45:e0 Destination: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Source: 00:0c:29:f7:87:89 (00:0c:29:f7:87:89) Type: IP (0x0800) Frame check sequence: 0xee33c433 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.101 (165.227.249.101) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfafd (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.101 (165.227.249.101) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x5411 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x2E6B8E93F6A4A8D8 Responder cookie: 0x3563CFBB9DC102FD Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x449A6F7E Length: 300 Encrypted payload (272 bytes) 0000 00 0f b5 4b 45 e0 00 0c 29 f7 87 89 08 00 45 00 ...KE...).....E. 0010 01 48 00 00 40 00 40 11 fa fd a5 e3 f9 7a a5 e3 .H..@.@......z.. 0020 f9 65 01 f4 01 f4 01 34 54 11 2e 6b 8e 93 f6 a4 .e.....4T..k.... 0030 a8 d8 35 63 cf bb 9d c1 02 fd 08 10 20 01 44 9a ..5c........ .D. 0040 6f 7e 00 00 01 2c 81 81 39 6c 98 cf 1c 16 1e ac o~...,..9l...... 0050 af 98 8f bd 2e ac 81 90 2c 78 06 7a 33 20 af ab ........,x.z3 .. 0060 42 31 92 7e 5f d5 e2 ae 27 22 a3 96 5a 08 58 69 B1.~_...'"..Z.Xi 0070 6b 62 3d ec 78 7c 03 df 6a e6 c4 6f 14 19 88 b6 kb=.x|..j..o.... 0080 ce 1a 48 d9 c5 fb 60 ad 55 61 58 58 aa 6d e1 72 ..H...`.UaXX.m.r 0090 d7 2f fb 48 59 3d c3 af 93 24 93 75 23 11 c1 68 ./.HY=...$.u#..h 00a0 19 2e 43 d0 4a 19 47 8b ef 56 97 49 3d 88 a1 7a ..C.J.G..V.I=..z 00b0 f6 7a cd e6 0c 38 0c 61 1e 6e 82 b9 db d1 5e eb .z...8.a.n....^. 00c0 ee f0 49 4b 52 74 71 39 bf f8 e6 00 d4 3a 87 f6 ..IKRtq9.....:.. 00d0 9d 78 5f 86 ac 28 ee 61 4f 07 dd 3d 9e 96 97 3e .x_..(.aO..=...> 00e0 4b 6c a8 81 94 f1 1c 59 42 fa d2 8f bb f9 52 04 Kl.....YB.....R. 00f0 9a 3c af 89 6d 1f 40 5a 8d f6 48 8c 2f 5e d6 65 .<..m.@Z..H./^.e 0100 a9 8a 63 bd 2e f1 27 4c cc 21 11 51 15 91 04 6d ..c...'L.!.Q...m 0110 3b fb e8 de 07 9c 1a 54 2a 4a 48 96 2a b5 82 99 ;......T*JH.*... 0120 48 22 8f a8 02 61 0c 06 ee c8 2a 80 04 e7 95 a4 H"...a....*..... 0130 aa ce 15 e8 0c 13 20 10 8e 16 bd 3c 97 47 d6 04 ...... ....<.G.. 0140 d9 f0 d9 09 83 f4 45 0f 10 d6 db 37 b3 b7 51 d1 ......E....7..Q. 0150 23 4b 52 13 75 fa ee 33 c4 33 #KR.u..3.3 Frame 8 (330 bytes on wire, 330 bytes captured) Arrival Time: Jun 16, 2005 14:35:47.625844000 Time delta from previous packet: 0.199301000 seconds Time since reference or first frame: 0.704074000 seconds Frame Number: 8 Packet Length: 330 bytes Capture Length: 330 bytes Ethernet II, Src: 00:0f:b5:4b:45:e0, Dst: 00:0c:29:f7:87:89 Destination: 00:0c:29:f7:87:89 (00:0c:29:f7:87:89) Source: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Type: IP (0x0800) Frame check sequence: 0x2571226d (correct) Internet Protocol, Src Addr: 165.227.249.101 (165.227.249.101), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb0d (correct) Source: 165.227.249.101 (165.227.249.101) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x9989 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x2E6B8E93F6A4A8D8 Responder cookie: 0x3563CFBB9DC102FD Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x449A6F7E Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 f7 87 89 00 0f b5 4b 45 e0 08 00 45 00 ..)......KE...E. 0010 01 38 00 00 40 00 40 11 fb 0d a5 e3 f9 65 a5 e3 .8..@.@......e.. 0020 f9 7a 01 f4 01 f4 01 24 99 89 2e 6b 8e 93 f6 a4 .z.....$...k.... 0030 a8 d8 35 63 cf bb 9d c1 02 fd 08 10 20 01 44 9a ..5c........ .D. 0040 6f 7e 00 00 01 1c 80 85 fb 49 ab 31 af 42 e8 af o~.......I.1.B.. 0050 05 9f 30 8b d8 35 2d 93 de 9f 5e b8 b9 30 bf db ..0..5-...^..0.. 0060 0f 80 21 3b d6 8a 77 f9 3f 02 f6 8a b3 c6 7b 72 ..!;..w.?.....{r 0070 7d 1e 21 09 b6 e8 5e ce 5c 6f d1 c9 f4 20 aa 76 }.!...^.\o... .v 0080 f7 73 0c 73 cb e9 83 00 f4 7c 0b 9c b7 ba 8d 23 .s.s.....|.....# 0090 bd 8f ac 03 0a d8 17 4d a7 b9 bf 3d 04 21 dc ca .......M...=.!.. 00a0 4e 48 58 cc 48 76 9c 21 42 bd 4a d3 af f8 3f 1f NHX.Hv.!B.J...?. 00b0 02 1b 7f 90 56 59 29 95 21 9e f6 e0 4d 09 a7 31 ....VY).!...M..1 00c0 d0 07 2e 70 d5 3d e0 00 ad 64 79 d6 80 91 81 71 ...p.=...dy....q 00d0 6c 6e 1c 9e 90 62 57 b7 24 65 49 26 fa 6a 3f 14 ln...bW.$eI&.j?. 00e0 46 82 c4 02 36 d1 f8 df f0 83 38 5b ef e2 d6 3b F...6.....8[...; 00f0 05 50 57 37 45 96 2a 6c 28 12 73 7d 42 63 42 cf .PW7E.*l(.s}BcB. 0100 64 94 9a fb f7 0e ac 22 d4 f3 e1 01 bb b4 d0 1f d......"........ 0110 6b 2a 5d 1f 7a e0 23 34 d7 2e d0 e6 fa 4f fc d2 k*].z.#4.....O.. 0120 f1 c9 48 e6 d7 12 99 c1 df f6 66 2d e3 ce a1 d7 ..H.......f-.... 0130 4b b3 e1 ab b6 1a fa e6 7d 7a 3d 47 7d 82 3c 51 K.......}z=G}..,[ 0060 00 9b af 1b af 16 54 d0 ac c5 54 80 af 58 5f 44 ......T...T..X_D 0070 2b 1c 1a 64 5f 94 0a 0c 3b 4d ba cf 0e 6e 52 13 +..d_...;M...nR. 0080 e7 82 .. Frame 16 (130 bytes on wire, 130 bytes captured) Arrival Time: Jun 16, 2005 14:35:48.990794000 Time delta from previous packet: 0.000364000 seconds Time since reference or first frame: 2.069024000 seconds Frame Number: 16 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:00:24:c3:5e:28, Dst: 00:0f:b5:4b:45:e0 Destination: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Source: 00:00:24:c3:5e:28 (00:00:24:c3:5e:28) Type: IP (0x0800) Frame check sequence: 0x13d58c14 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.101 (165.227.249.101) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x000f (15) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 254 Protocol: ESP (0x32) Header checksum: 0x7da5 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.101 (165.227.249.101) Encapsulating Security Payload SPI: 0xe955704c Sequence: 2 Data (84 bytes) 0000 00 0f b5 4b 45 e0 00 00 24 c3 5e 28 08 00 45 00 ...KE...$.^(..E. 0010 00 70 00 0f 00 00 fe 32 7d a5 a5 e3 f9 7a a5 e3 .p.....2}....z.. 0020 f9 65 e9 55 70 4c 00 00 00 02 97 95 c2 a7 17 a4 .e.UpL.......... 0030 4d 4c b2 a3 24 e9 f7 48 93 5a 67 fb 0f c2 41 9b ML..$..H.Zg...A. 0040 1c 2a 4e 91 8a 8c d9 1a 5b 7b cf db 64 7d 88 22 .*N.....[{..d}." 0050 9d c5 97 86 88 34 9f 92 c0 6e f9 3e c6 2c 5b 20 .....4...n.>.,[ 0060 00 9b af 1b af 16 54 d0 ac c5 54 80 af 58 5f 44 ......T...T..X_D 0070 2b 1c 1a 64 5f 94 0a 0c 3b 4d ba cf 0e 6e 13 d5 +..d_...;M...n.. 0080 8c 14 .. Frame 17 (130 bytes on wire, 130 bytes captured) Arrival Time: Jun 16, 2005 14:35:49.001946000 Time delta from previous packet: 0.011152000 seconds Time since reference or first frame: 2.080176000 seconds Frame Number: 17 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0f:b5:4b:45:e0, Dst: 00:0c:29:f7:87:89 Destination: 00:0c:29:f7:87:89 (00:0c:29:f7:87:89) Source: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Type: IP (0x0800) Frame check sequence: 0x80498914 (correct) Internet Protocol, Src Addr: 165.227.249.101 (165.227.249.101), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0001 (1) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 30 Protocol: ESP (0x32) Header checksum: 0x5db4 (correct) Source: 165.227.249.101 (165.227.249.101) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0x2f743c61 Sequence: 2 Data (84 bytes) 0000 00 0c 29 f7 87 89 00 0f b5 4b 45 e0 08 00 45 00 ..)......KE...E. 0010 00 70 00 01 00 00 1e 32 5d b4 a5 e3 f9 65 a5 e3 .p.....2]....e.. 0020 f9 7a 2f 74 3c 61 00 00 00 02 de d0 6a b0 32 0c .z/td?....\ 0060 a8 f6 05 18 9e 3f f9 7e 1f 6a 95 34 ca 43 3b d2 .....?.~.j.4.C;. 0070 a0 55 cd 66 55 c9 a1 5c ae 39 d7 2d e0 b0 80 49 .U.fU..\.9.-...I 0080 89 14 .. Frame 18 (130 bytes on wire, 130 bytes captured) Arrival Time: Jun 16, 2005 14:35:50.015459000 Time delta from previous packet: 1.013513000 seconds Time since reference or first frame: 3.093689000 seconds Frame Number: 18 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0c:29:f7:87:89, Dst: 00:00:24:c3:5e:28 Destination: 00:00:24:c3:5e:28 (00:00:24:c3:5e:28) Source: 00:0c:29:f7:87:89 (00:0c:29:f7:87:89) Type: IP (0x0800) Frame check sequence: 0x0baebc1d (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.101 (165.227.249.101) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0010 (16) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7ca4 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.101 (165.227.249.101) Encapsulating Security Payload SPI: 0xe955704c Sequence: 3 Data (84 bytes) 0000 00 00 24 c3 5e 28 00 0c 29 f7 87 89 08 00 45 00 ..$.^(..).....E. 0010 00 70 00 10 00 00 ff 32 7c a4 a5 e3 f9 7a a5 e3 .p.....2|....z.. 0020 f9 65 e9 55 70 4c 00 00 00 03 54 80 af 58 5f 44 .e.UpL....T..X_D 0030 2b 1c 7d a2 95 c6 2f 77 0c a0 bc 5b 39 a4 01 f0 +.}.../w...[9... 0040 28 0f 96 43 c6 57 49 49 bf 5f a9 a3 54 2e a6 97 (..C.WII._..T... 0050 a3 b8 80 27 02 fa bf a0 3d 09 11 22 95 51 67 8f ...'....=..".Qg. 0060 e1 8b f8 35 9e 9d a0 46 70 04 f3 d4 8e 82 67 c2 ...5...Fp.....g. 0070 fc 11 1f 60 87 ae 2f f0 b4 6f 83 15 0a 15 0b ae ...`../..o...... 0080 bc 1d .. Frame 19 (130 bytes on wire, 130 bytes captured) Arrival Time: Jun 16, 2005 14:35:50.015824000 Time delta from previous packet: 0.000365000 seconds Time since reference or first frame: 3.094054000 seconds Frame Number: 19 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:00:24:c3:5e:28, Dst: 00:0f:b5:4b:45:e0 Destination: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Source: 00:00:24:c3:5e:28 (00:00:24:c3:5e:28) Type: IP (0x0800) Frame check sequence: 0x4a68d78b (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.101 (165.227.249.101) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0010 (16) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 254 Protocol: ESP (0x32) Header checksum: 0x7da4 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.101 (165.227.249.101) Encapsulating Security Payload SPI: 0xe955704c Sequence: 3 Data (84 bytes) 0000 00 0f b5 4b 45 e0 00 00 24 c3 5e 28 08 00 45 00 ...KE...$.^(..E. 0010 00 70 00 10 00 00 fe 32 7d a4 a5 e3 f9 7a a5 e3 .p.....2}....z.. 0020 f9 65 e9 55 70 4c 00 00 00 03 54 80 af 58 5f 44 .e.UpL....T..X_D 0030 2b 1c 7d a2 95 c6 2f 77 0c a0 bc 5b 39 a4 01 f0 +.}.../w...[9... 0040 28 0f 96 43 c6 57 49 49 bf 5f a9 a3 54 2e a6 97 (..C.WII._..T... 0050 a3 b8 80 27 02 fa bf a0 3d 09 11 22 95 51 67 8f ...'....=..".Qg. 0060 e1 8b f8 35 9e 9d a0 46 70 04 f3 d4 8e 82 67 c2 ...5...Fp.....g. 0070 fc 11 1f 60 87 ae 2f f0 b4 6f 83 15 0a 15 4a 68 ...`../..o....Jh 0080 d7 8b .. Frame 20 (130 bytes on wire, 130 bytes captured) Arrival Time: Jun 16, 2005 14:35:50.018225000 Time delta from previous packet: 0.002401000 seconds Time since reference or first frame: 3.096455000 seconds Frame Number: 20 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0f:b5:4b:45:e0, Dst: 00:0c:29:f7:87:89 Destination: 00:0c:29:f7:87:89 (00:0c:29:f7:87:89) Source: 00:0f:b5:4b:45:e0 (00:0f:b5:4b:45:e0) Type: IP (0x0800) Frame check sequence: 0x1f6b9a0d (correct) Internet Protocol, Src Addr: 165.227.249.101 (165.227.249.101), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0002 (2) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 30 Protocol: ESP (0x32) Header checksum: 0x5db3 (correct) Source: 165.227.249.101 (165.227.249.101) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0x2f743c61 Sequence: 3 Data (84 bytes) 0000 00 0c 29 f7 87 89 00 0f b5 4b 45 e0 08 00 45 00 ..)......KE...E. 0010 00 70 00 02 00 00 1e 32 5d b3 a5 e3 f9 65 a5 e3 .p.....2]....e.. 0020 f9 7a 2f 74 3c 61 00 00 00 03 da 50 ee 6c 9a ae .z/t