Frame 1 (174 bytes on wire, 174 bytes captured) Arrival Time: Sep 21, 2005 11:27:38.340109000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 174 bytes Capture Length: 174 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:06:b1:22:73:e9 Destination: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0xa5532dac (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 156 Identification: 0x000c (12) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb9a (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 136 Checksum: 0xa7b7 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x48068B97C5D819DE Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 128 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 44 Vendor ID: Check Point Check Point Product: VPN-1 Version: NG with Application Intelligence R55 0000 00 06 b1 22 73 e9 00 0c 29 89 f2 82 08 00 45 00 ..."s...).....E. 0010 00 9c 00 0c 40 00 40 11 fb 9a a5 e3 f9 7a a5 e3 ....@.@......z.. 0020 f9 68 01 f4 01 f4 00 88 a7 b7 48 06 8b 97 c5 d8 .h........H..... 0030 19 de 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 80 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 00 00 ............p... 0080 00 2c f4 ed 19 e0 c1 14 eb 51 6f aa ac 0e e3 7d .,.......Qo....} 0090 af 28 07 b4 38 1f 00 00 00 01 00 00 13 8d 42 c2 .(..8.........B. 00a0 45 8b 00 00 00 00 18 00 00 00 a5 53 2d ac E..........S-. Frame 2 (138 bytes on wire, 138 bytes captured) Arrival Time: Sep 21, 2005 11:27:38.342679000 Time delta from previous packet: 0.002570000 seconds Time since reference or first frame: 0.002570000 seconds Frame Number: 2 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:06:b1:22:73:e9, Dst: 00:0c:29:89:f2:82 Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Type: IP (0x0800) Frame check sequence: 0x99810c70 (correct) Internet Protocol, Src Addr: 165.227.249.104 (165.227.249.104), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7cc9 (correct) Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xad57 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x48068B97C5D819DE Responder cookie: 0xC43ABB256D1043D8 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: unknown vendor ID: 0x5B362BC820F60001 0000 00 0c 29 89 f2 82 00 06 b1 22 73 e9 08 00 45 00 ..)......"s...E. 0010 00 78 00 01 00 00 ff 11 7c c9 a5 e3 f9 68 a5 e3 .x......|....h.. 0020 f9 7a 01 f4 01 f4 00 64 ad 57 48 06 8b 97 c5 d8 .z.....d.WH..... 0030 19 de c4 3a bb 25 6d 10 43 d8 01 10 02 00 00 00 ...:.%m.C....... 0040 00 00 00 00 00 5c 0d 00 00 34 00 00 00 01 00 00 .....\...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 00 00 00 0c 5b 36 ........p.....[6 0080 2b c8 20 f6 00 01 99 81 0c 70 +. ......p Frame 3 (230 bytes on wire, 230 bytes captured) Arrival Time: Sep 21, 2005 11:27:38.355738000 Time delta from previous packet: 0.013059000 seconds Time since reference or first frame: 0.015629000 seconds Frame Number: 3 Packet Length: 230 bytes Capture Length: 230 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:06:b1:22:73:e9 Destination: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0xf4f1356a (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x000d (13) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb61 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0xbcaa (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x48068B97C5D819DE Responder cookie: 0xC43ABB256D1043D8 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 24 Nonce Data 0000 00 06 b1 22 73 e9 00 0c 29 89 f2 82 08 00 45 00 ..."s...).....E. 0010 00 d4 00 0d 40 00 40 11 fb 61 a5 e3 f9 7a a5 e3 ....@.@..a...z.. 0020 f9 68 01 f4 01 f4 00 c0 bc aa 48 06 8b 97 c5 d8 .h........H..... 0030 19 de c4 3a bb 25 6d 10 43 d8 04 10 02 00 00 00 ...:.%m.C....... 0040 00 00 00 00 00 b8 0a 00 00 84 b6 38 cd 42 80 2c ...........8.B., 0050 0b 84 b1 bf 97 9f 37 3b 6c 5c f1 ff 2a 40 9d c2 ......7;l\..*@.. 0060 1c 78 8a 4a ea 01 1e 2b a3 10 9a 61 4d 9d 57 fd .x.J...+...aM.W. 0070 3c 04 c6 65 f4 51 8b 3d f7 53 c1 90 10 dc 61 34 <..e.Q.=.S....a4 0080 31 48 79 38 31 57 d4 9c 16 78 7a 13 68 ed 45 43 1Hy81W...xz.h.EC 0090 1e eb a5 b4 7d 7d b9 1c ac cb 4a 5f f8 bb ec b5 ....}}....J_.... 00a0 3d a9 a1 ce 8e 16 5d 53 70 f3 0d 7f f3 86 fc 11 =.....]Sp....... 00b0 c4 34 32 7e dc 19 35 07 85 62 c1 81 69 48 ac 54 .42~..5..b..iH.T 00c0 19 0e c9 a0 bf 4a 65 75 e0 9f 00 00 00 18 f6 6a .....Jeu.......j 00d0 c5 56 e0 05 bb f8 10 74 ce db 13 ed 1e 93 53 6e .V.....t......Sn 00e0 0b c6 f4 f1 35 6a ....5j Frame 4 (230 bytes on wire, 230 bytes captured) Arrival Time: Sep 21, 2005 11:27:40.315566000 Time delta from previous packet: 1.959828000 seconds Time since reference or first frame: 1.975457000 seconds Frame Number: 4 Packet Length: 230 bytes Capture Length: 230 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:06:b1:22:73:e9 Destination: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0x6ad47075 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x000e (14) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb60 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0xbcaa (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x48068B97C5D819DE Responder cookie: 0xC43ABB256D1043D8 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 24 Nonce Data 0000 00 06 b1 22 73 e9 00 0c 29 89 f2 82 08 00 45 00 ..."s...).....E. 0010 00 d4 00 0e 40 00 40 11 fb 60 a5 e3 f9 7a a5 e3 ....@.@..`...z.. 0020 f9 68 01 f4 01 f4 00 c0 bc aa 48 06 8b 97 c5 d8 .h........H..... 0030 19 de c4 3a bb 25 6d 10 43 d8 04 10 02 00 00 00 ...:.%m.C....... 0040 00 00 00 00 00 b8 0a 00 00 84 b6 38 cd 42 80 2c ...........8.B., 0050 0b 84 b1 bf 97 9f 37 3b 6c 5c f1 ff 2a 40 9d c2 ......7;l\..*@.. 0060 1c 78 8a 4a ea 01 1e 2b a3 10 9a 61 4d 9d 57 fd .x.J...+...aM.W. 0070 3c 04 c6 65 f4 51 8b 3d f7 53 c1 90 10 dc 61 34 <..e.Q.=.S....a4 0080 31 48 79 38 31 57 d4 9c 16 78 7a 13 68 ed 45 43 1Hy81W...xz.h.EC 0090 1e eb a5 b4 7d 7d b9 1c ac cb 4a 5f f8 bb ec b5 ....}}....J_.... 00a0 3d a9 a1 ce 8e 16 5d 53 70 f3 0d 7f f3 86 fc 11 =.....]Sp....... 00b0 c4 34 32 7e dc 19 35 07 85 62 c1 81 69 48 ac 54 .42~..5..b..iH.T 00c0 19 0e c9 a0 bf 4a 65 75 e0 9f 00 00 00 18 f6 6a .....Jeu.......j 00d0 c5 56 e0 05 bb f8 10 74 ce db 13 ed 1e 93 53 6e .V.....t......Sn 00e0 0b c6 6a d4 70 75 ..j.pu Frame 5 (254 bytes on wire, 254 bytes captured) Arrival Time: Sep 21, 2005 11:27:40.640939000 Time delta from previous packet: 0.325373000 seconds Time since reference or first frame: 2.300830000 seconds Frame Number: 5 Packet Length: 254 bytes Capture Length: 254 bytes Ethernet II, Src: 00:06:b1:22:73:e9, Dst: 00:0c:29:89:f2:82 Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Type: IP (0x0800) Frame check sequence: 0xaac02a40 (correct) Internet Protocol, Src Addr: 165.227.249.104 (165.227.249.104), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 236 Identification: 0x0002 (2) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7c54 (correct) Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 216 Checksum: 0xf682 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x48068B97C5D819DE Responder cookie: 0xC43ABB256D1043D8 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 208 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0x404BF439522CA3F6 Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 89 f2 82 00 06 b1 22 73 e9 08 00 45 00 ..)......"s...E. 0010 00 ec 00 02 00 00 ff 11 7c 54 a5 e3 f9 68 a5 e3 ........|T...h.. 0020 f9 7a 01 f4 01 f4 00 d8 f6 82 48 06 8b 97 c5 d8 .z........H..... 0030 19 de c4 3a bb 25 6d 10 43 d8 04 10 02 00 00 00 ...:.%m.C....... 0040 00 00 00 00 00 d0 0a 00 00 84 76 bd 1b c6 ee 11 ..........v..... 0050 5e e7 2f c5 06 4f 90 40 f6 4d 73 73 63 c1 74 dd ^./..O.@.Mssc.t. 0060 10 1e 05 6d 63 55 28 91 8c 74 ed 9f 18 dc 88 93 ...mcU(..t...... 0070 bb 8c da 51 46 75 9d bf b3 aa 7b 97 16 0c 5d 48 ...QFu....{...]H 0080 5e e9 30 07 6e c9 c8 3b ce 73 dd 57 08 72 26 88 ^.0.n..;.s.W.r&. 0090 bf 39 c3 35 fd 68 17 e2 7f c1 3c 73 87 39 e5 59 .9.5.h.....q=H 00a0 2c 82 79 bd b6 4c 5f 35 cc a7 29 d0 8a 30 b0 16 ,.y..L_5..)..0.. 00b0 d0 fc 41 b8 5e 8a 56 ae 26 f2 98 c8 ce 98 e2 62 ..A.^.V.&......b 00c0 04 92 0a 9b 6e c3 21 15 59 ec 0f 6e 5c 09 fd 80 ....n.!.Y..n\... 00d0 05 72 b9 07 ee 4f 34 76 5b a9 cb a9 6e 02 02 c0 .r...O4v[...n... 00e0 9a d7 bc a2 f7 e6 be 8d 55 7e 30 17 90 0b 0f 55 ........U~0....U 00f0 81 b8 d2 4a 2d fe dc 85 c7 61 75 c3 39 22 07 d1 ...J-....au.9".. 0100 95 76 fa 55 2d 79 74 b8 41 17 78 3d f1 74 6d e5 .v.U-yt.A.x=.tm. 0110 9e 04 be ae ef ab 8f a3 5a 52 00 b1 e6 95 ff d1 ........ZR...... 0120 08 67 be 53 18 4f f7 a5 97 da 7b 24 0a ab 77 af .g.S.O....{$..w. 0130 68 9a 47 ea 62 41 9b 36 e5 13 d0 76 7f 6d e0 f2 h.G.bA.6...v.m.. 0140 9b ca 60 13 6e a2 27 dc 41 88 14 89 7f 30 82 c6 ..`.n.'.A....0.. 0150 ed 89 5a 2d 81 9d b1 35 c5 ad ..Z-...5.. Frame 11 (106 bytes on wire, 106 bytes captured) Arrival Time: Sep 21, 2005 11:27:42.981886000 Time delta from previous packet: 0.009346000 seconds Time since reference or first frame: 4.641777000 seconds Frame Number: 11 Packet Length: 106 bytes Capture Length: 106 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:06:b1:22:73:e9 Destination: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0xdfd9449e (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0012 (18) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbd8 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xec80 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x48068B97C5D819DE Responder cookie: 0xC43ABB256D1043D8 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x36808638 Length: 60 Encrypted payload (32 bytes) 0000 00 06 b1 22 73 e9 00 0c 29 89 f2 82 08 00 45 00 ..."s...).....E. 0010 00 58 00 12 40 00 40 11 fb d8 a5 e3 f9 7a a5 e3 .X..@.@......z.. 0020 f9 68 01 f4 01 f4 00 44 ec 80 48 06 8b 97 c5 d8 .h.....D..H..... 0030 19 de c4 3a bb 25 6d 10 43 d8 08 10 20 01 36 80 ...:.%m.C... .6. 0040 86 38 00 00 00 3c 90 cb 48 49 f2 2f b4 32 7f e6 .8...<..HI./.2.. 0050 36 d9 01 69 8e 55 4f 16 c6 6a 42 5e 6b 2f 8c 14 6..i.UO..jB^k/.. 0060 fb c3 ca 01 2c d0 df d9 44 9e ....,...D. Frame 12 (106 bytes on wire, 106 bytes captured) Arrival Time: Sep 21, 2005 11:27:43.084407000 Time delta from previous packet: 0.102521000 seconds Time since reference or first frame: 4.744298000 seconds Frame Number: 12 Packet Length: 106 bytes Capture Length: 106 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:06:b1:22:73:e9 Destination: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0x317deb09 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0013 (19) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbd7 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xec80 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x48068B97C5D819DE Responder cookie: 0xC43ABB256D1043D8 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x36808638 Length: 60 Encrypted payload (32 bytes) 0000 00 06 b1 22 73 e9 00 0c 29 89 f2 82 08 00 45 00 ..."s...).....E. 0010 00 58 00 13 40 00 40 11 fb d7 a5 e3 f9 7a a5 e3 .X..@.@......z.. 0020 f9 68 01 f4 01 f4 00 44 ec 80 48 06 8b 97 c5 d8 .h.....D..H..... 0030 19 de c4 3a bb 25 6d 10 43 d8 08 10 20 01 36 80 ...:.%m.C... .6. 0040 86 38 00 00 00 3c 90 cb 48 49 f2 2f b4 32 7f e6 .8...<..HI./.2.. 0050 36 d9 01 69 8e 55 4f 16 c6 6a 42 5e 6b 2f 8c 14 6..i.UO..jB^k/.. 0060 fb c3 ca 01 2c d0 31 7d eb 09 ....,.1}.. Frame 13 (106 bytes on wire, 106 bytes captured) Arrival Time: Sep 21, 2005 11:27:43.193736000 Time delta from previous packet: 0.109329000 seconds Time since reference or first frame: 4.853627000 seconds Frame Number: 13 Packet Length: 106 bytes Capture Length: 106 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:06:b1:22:73:e9 Destination: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0xd10c7bdb (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0014 (20) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbd6 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xec80 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x48068B97C5D819DE Responder cookie: 0xC43ABB256D1043D8 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x36808638 Length: 60 Encrypted payload (32 bytes) 0000 00 06 b1 22 73 e9 00 0c 29 89 f2 82 08 00 45 00 ..."s...).....E. 0010 00 58 00 14 40 00 40 11 fb d6 a5 e3 f9 7a a5 e3 .X..@.@......z.. 0020 f9 68 01 f4 01 f4 00 44 ec 80 48 06 8b 97 c5 d8 .h.....D..H..... 0030 19 de c4 3a bb 25 6d 10 43 d8 08 10 20 01 36 80 ...:.%m.C... .6. 0040 86 38 00 00 00 3c 90 cb 48 49 f2 2f b4 32 7f e6 .8...<..HI./.2.. 0050 36 d9 01 69 8e 55 4f 16 c6 6a 42 5e 6b 2f 8c 14 6..i.UO..jB^k/.. 0060 fb c3 ca 01 2c d0 d1 0c 7b db ....,...{. Frame 14 (130 bytes on wire, 130 bytes captured) Arrival Time: Sep 21, 2005 11:27:43.317603000 Time delta from previous packet: 0.123867000 seconds Time since reference or first frame: 4.977494000 seconds Frame Number: 14 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:06:b1:22:73:e9 Destination: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0xe50713fd (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0007 (7) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7caa (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.104 (165.227.249.104) Encapsulating Security Payload SPI: 0x44b88381 Sequence: 1 Data (84 bytes) 0000 00 06 b1 22 73 e9 00 0c 29 89 f2 82 08 00 45 00 ..."s...).....E. 0010 00 70 00 07 00 00 ff 32 7c aa a5 e3 f9 7a a5 e3 .p.....2|....z.. 0020 f9 68 44 b8 83 81 00 00 00 01 8f 3e ca 73 e8 8c .hD........>.s.. 0030 14 a8 42 31 ca ad d4 eb c4 86 82 34 b0 9a 1e 4b ..B1.......4...K 0040 ea 0c 6e 1f 75 76 79 bb fc 9b a9 0b 9c b6 f1 e1 ..n.uvy......... 0050 67 b0 5a a0 00 25 83 9f 48 b4 58 0a 0d 6b 9f 96 g.Z..%..H.X..k.. 0060 d9 dd 05 7e 7c 9a 23 14 a9 19 36 a5 8f 12 f6 01 ...~|.#...6..... 0070 b5 8e 6b bd 5a 0c 1a 02 7c 11 9c ce a1 8b e5 07 ..k.Z...|....... 0080 13 fd .. Frame 15 (130 bytes on wire, 130 bytes captured) Arrival Time: Sep 21, 2005 11:27:43.319473000 Time delta from previous packet: 0.001870000 seconds Time since reference or first frame: 4.979364000 seconds Frame Number: 15 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:06:b1:22:73:e9, Dst: 00:0c:29:89:f2:82 Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Type: IP (0x0800) Frame check sequence: 0xc00f4655 (correct) Internet Protocol, Src Addr: 165.227.249.104 (165.227.249.104), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0000 (0) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7cb1 (correct) Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0x76bc04e1 Sequence: 1 Data (84 bytes) 0000 00 0c 29 89 f2 82 00 06 b1 22 73 e9 08 00 45 00 ..)......"s...E. 0010 00 70 00 00 00 00 ff 32 7c b1 a5 e3 f9 68 a5 e3 .p.....2|....h.. 0020 f9 7a 76 bc 04 e1 00 00 00 01 c2 e0 6d cb 8a f0 .zv.........m... 0030 6d 8b c2 0f 2b 8d 2f 0f 7c 6e 86 20 1c cf ad 98 m...+./.|n. .... 0040 f5 a2 0d f2 38 84 a9 31 85 0a 89 67 a0 cf 40 6d ....8..1...g..@m 0050 bf 46 57 b1 32 62 c8 a0 76 3b ff f9 82 e3 43 4b .FW.2b..v;....CK 0060 4e 14 7f 0b ed 78 a5 f6 df 41 b1 a0 69 56 d0 14 N....x...A..iV.. 0070 e7 bd 18 56 af 08 19 1b 2d ac 5a 72 f4 31 c0 0f ...V....-.Zr.1.. 0080 46 55 FU Frame 16 (130 bytes on wire, 130 bytes captured) Arrival Time: Sep 21, 2005 11:27:43.477205000 Time delta from previous packet: 0.157732000 seconds Time since reference or first frame: 5.137096000 seconds Frame Number: 16 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:06:b1:22:73:e9 Destination: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0xa813636f (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0008 (8) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7ca9 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.104 (165.227.249.104) Encapsulating Security Payload SPI: 0x44b88381 Sequence: 2 Data (84 bytes) 0000 00 06 b1 22 73 e9 00 0c 29 89 f2 82 08 00 45 00 ..."s...).....E. 0010 00 70 00 08 00 00 ff 32 7c a9 a5 e3 f9 7a a5 e3 .p.....2|....z.. 0020 f9 68 44 b8 83 81 00 00 00 02 f9 f9 13 d9 7e d4 .hD...........~. 0030 c4 1e 8d dc 5f 83 7c 7a 6a d4 ae 4b 7d 33 7a 28 ...._.|zj..K}3z( 0040 a4 f3 51 39 9c 9a 9f e9 8a b2 e3 c3 17 d4 29 84 ..Q9..........). 0050 8a 96 4f 23 f3 ce a4 74 68 15 97 b7 c7 27 8a 72 ..O#...th....'.r 0060 ea 0b 49 2b 45 42 2b 70 f5 a1 a4 eb e3 d3 3d 48 ..I+EB+p......=H 0070 78 c2 b0 74 fd 6b 27 54 09 af e8 83 bc a1 a8 13 x..t.k'T........ 0080 63 6f co Frame 17 (130 bytes on wire, 130 bytes captured) Arrival Time: Sep 21, 2005 11:27:43.478526000 Time delta from previous packet: 0.001321000 seconds Time since reference or first frame: 5.138417000 seconds Frame Number: 17 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:06:b1:22:73:e9, Dst: 00:0c:29:89:f2:82 Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Type: IP (0x0800) Frame check sequence: 0x2dea7228 (correct) Internet Protocol, Src Addr: 165.227.249.104 (165.227.249.104), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0001 (1) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7cb0 (correct) Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0x76bc04e1 Sequence: 2 Data (84 bytes) 0000 00 0c 29 89 f2 82 00 06 b1 22 73 e9 08 00 45 00 ..)......"s...E. 0010 00 70 00 01 00 00 ff 32 7c b0 a5 e3 f9 68 a5 e3 .p.....2|....h.. 0020 f9 7a 76 bc 04 e1 00 00 00 02 19 0b 04 7d aa 6f .zv..........}.o 0030 cd 6d c3 d2 08 f1 52 31 ae 31 70 60 41 e9 aa 48 .m....R1.1p`A..H 0040 a0 be 23 2f 04 96 83 ba 55 61 ba d2 63 6a 66 ca ..#/....Ua..cjf. 0050 31 9b e0 95 66 db 3f c8 25 06 d5 48 d4 6f f2 4b 1...f.?.%..H.o.K 0060 51 a0 80 62 60 05 82 22 d8 5d 5b f5 fd d3 10 32 Q..b`..".][....2 0070 03 0e d5 b9 02 2e f2 d6 6d 96 5e f4 4b fd 2d ea ........m.^.K.-. 0080 72 28 r( Frame 18 (130 bytes on wire, 130 bytes captured) Arrival Time: Sep 21, 2005 11:27:44.491448000 Time delta from previous packet: 1.012922000 seconds Time since reference or first frame: 6.151339000 seconds Frame Number: 18 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:06:b1:22:73:e9 Destination: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0x5bb94124 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0009 (9) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7ca8 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.104 (165.227.249.104) Encapsulating Security Payload SPI: 0x44b88381 Sequence: 3 Data (84 bytes) 0000 00 06 b1 22 73 e9 00 0c 29 89 f2 82 08 00 45 00 ..."s...).....E. 0010 00 70 00 09 00 00 ff 32 7c a8 a5 e3 f9 7a a5 e3 .p.....2|....z.. 0020 f9 68 44 b8 83 81 00 00 00 03 9a 19 7b 89 c5 1e .hD.........{... 0030 f4 42 7c f0 49 80 c3 70 54 29 d8 46 5b c2 4d 73 .B|.I..pT).F[.Ms 0040 4d 07 cb 0d d2 06 84 5b 77 06 40 5c 88 ca d6 3b M......[w.@\...; 0050 48 99 6c b6 1e a6 d1 c3 12 ac 52 b8 cc 38 9f e4 H.l.......R..8.. 0060 7f 65 25 2c 5b 21 96 93 2c 20 9d ae d8 83 2c 4d .e%,[!.., ....,M 0070 1f 4a 87 a8 14 ca b2 26 37 e1 75 3a 0f 40 5b b9 .J.....&7.u:.@[. 0080 41 24 A$ Frame 19 (130 bytes on wire, 130 bytes captured) Arrival Time: Sep 21, 2005 11:27:44.492965000 Time delta from previous packet: 0.001517000 seconds Time since reference or first frame: 6.152856000 seconds Frame Number: 19 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:06:b1:22:73:e9, Dst: 00:0c:29:89:f2:82 Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Type: IP (0x0800) Frame check sequence: 0x8b597d6f (correct) Internet Protocol, Src Addr: 165.227.249.104 (165.227.249.104), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0002 (2) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7caf (correct) Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0x76bc04e1 Sequence: 3 Data (84 bytes) 0000 00 0c 29 89 f2 82 00 06 b1 22 73 e9 08 00 45 00 ..)......"s...E. 0010 00 70 00 02 00 00 ff 32 7c af a5 e3 f9 68 a5 e3 .p.....2|....h.. 0020 f9 7a 76 bc 04 e1 00 00 00 03 2b 8e 95 05 f2 a8 .zv.......+..... 0030 d5 85 0f 87 9d ca 99 4e 55 ba 78 7e 0f e3 49 cb .......NU.x~..I. 0040 12 df 90 10 73 3f 9d fd 35 64 01 3c 9c aa 90 62 ....s?..5d.<...b 0050 8d 28 1e 0a 2b 4c 40 75 ea 96 af ad f9 5a 22 ca .(..+L@u.....Z". 0060 25 4f fa bb 39 c9 18 45 e4 ad 5f 00 58 1b 15 38 %O..9..E.._.X..8 0070 48 9a 6a c7 4d 7b 22 57 3f 89 a6 fe 6e 3a 8b 59 H.j.M{"W?...n:.Y 0080 7d 6f }o Frame 20 (130 bytes on wire, 130 bytes captured) Arrival Time: Sep 21, 2005 11:27:45.515440000 Time delta from previous packet: 1.022475000 seconds Time since reference or first frame: 7.175331000 seconds Frame Number: 20 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:06:b1:22:73:e9 Destination: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0x1a9323cd (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x000a (10) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7ca7 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.104 (165.227.249.104) Encapsulating Security Payload SPI: 0x44b88381 Sequence: 4 Data (84 bytes) 0000 00 06 b1 22 73 e9 00 0c 29 89 f2 82 08 00 45 00 ..."s...).....E. 0010 00 70 00 0a 00 00 ff 32 7c a7 a5 e3 f9 7a a5 e3 .p.....2|....z.. 0020 f9 68 44 b8 83 81 00 00 00 04 a0 24 84 ee fc 3d .hD........$...= 0030 4e 4c 6a df 36 7b 8d 74 5d 67 57 b6 4c a4 ec 29 NLj.6{.t]gW.L..) 0040 ab c5 d3 0a 2e 05 23 a0 3e 0f 0b 5e 4b 68 ef 20 ......#.>..^Kh. 0050 b3 e4 90 cc 46 9c d2 64 eb b4 f7 81 3c 71 31 ef ....F..d....