Frame 1 (170 bytes on wire, 170 bytes captured) Arrival Time: Jul 10, 2007 11:33:30.459081000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 170 bytes Capture Length: 170 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Destination: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 156 Identification: 0x008f (143) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb14 [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 136 Checksum: 0x60f0 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5DF097C5D9E2A57F Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 128 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 44 Vendor ID: Check Point Check Point Product: VPN-1 Version: NG with Application Intelligence R55 Check Point Vendor ID parameters 0000 00 c0 02 11 42 56 00 0c 29 51 89 a7 08 00 45 00 ....BV..)Q....E. 0010 00 9c 00 8f 40 00 40 11 fb 14 a5 e3 f9 7a a5 e3 ....@.@......z.. 0020 f9 6b 01 f4 01 f4 00 88 60 f0 5d f0 97 c5 d9 e2 .k......`.]..... 0030 a5 7f 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 80 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 00 00 ............p... 0080 00 2c f4 ed 19 e0 c1 14 eb 51 6f aa ac 0e e3 7d .,.......Qo....} 0090 af 28 07 b4 38 1f 00 00 00 01 00 00 13 8d 46 92 .(..8.........F. 00a0 c6 bb 00 00 00 00 18 00 00 00 .......... Frame 2 (128 bytes on wire, 128 bytes captured) Arrival Time: Jul 10, 2007 11:33:30.480209000 Time delta from previous packet: 0.021128000 seconds Time since reference or first frame: 0.021128000 seconds Frame Number: 2 Packet Length: 128 bytes Capture Length: 128 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:c0:02:11:42:56 (00:c0:02:11:42:56), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Source: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Type: IP (0x0800) Trailer: 0000 Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0224 (548) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x39ac [correct] Good: True Bad : False Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0xc246 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5DF097C5D9E2A57F Responder cookie: 0xB550E882A5EC4ADD Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 84 Security Association payload Next payload: NONE (0) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0c 29 51 89 a7 00 c0 02 11 42 56 08 00 45 00 ..)Q......BV..E. 0010 00 70 02 24 00 00 40 11 39 ac a5 e3 f9 6b a5 e3 .p.$..@.9....k.. 0020 f9 7a 01 f4 01 f4 00 5c c2 46 5d f0 97 c5 d9 e2 .z.....\.F]..... 0030 a5 7f b5 50 e8 82 a5 ec 4a dd 01 10 02 00 00 00 ...P....J....... 0040 00 00 00 00 00 54 00 00 00 38 00 00 00 01 00 00 .....T...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 00 00 ............p... Frame 3 (226 bytes on wire, 226 bytes captured) Arrival Time: Jul 10, 2007 11:33:30.480211000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.021130000 seconds Frame Number: 3 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Destination: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x0090 (144) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfadb [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x2592 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5DF097C5D9E2A57F Responder cookie: 0xB550E882A5EC4ADD Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 24 Nonce Data 0000 00 c0 02 11 42 56 00 0c 29 51 89 a7 08 00 45 00 ....BV..)Q....E. 0010 00 d4 00 90 40 00 40 11 fa db a5 e3 f9 7a a5 e3 ....@.@......z.. 0020 f9 6b 01 f4 01 f4 00 c0 25 92 5d f0 97 c5 d9 e2 .k......%.]..... 0030 a5 7f b5 50 e8 82 a5 ec 4a dd 04 10 02 00 00 00 ...P....J....... 0040 00 00 00 00 00 b8 0a 00 00 84 ac c9 6c 9f a2 7e ............l..~ 0050 93 c0 a5 5e ff e3 5e 5e a9 8a d7 52 63 c2 69 32 ...^..^^...Rc.i2 0060 01 d7 a9 e5 77 4b 66 ad 37 1a 8c ad bb 28 34 5f ....wKf.7....(4_ 0070 0d 33 bf 17 2a 3a 8b 56 a6 25 0b 2b 3b 62 b8 c7 .3..*:.V.%.+;b.. 0080 a0 c2 74 33 71 0b 0b df 80 65 4f d7 4d dd 49 51 ..t3q....eO.M.IQ 0090 25 4e f1 07 a9 ad 23 29 dc d8 85 84 89 b5 14 84 %N....#)........ 00a0 be 86 8f 00 97 7d fd 48 e0 6c 8c b8 73 0b 09 30 .....}.H.l..s..0 00b0 21 e1 75 ff a0 9f ed b5 7a 9f cd 46 7f 65 4e ce !.u.....z..F.eN. 00c0 da cd 14 bb 09 0b 3d 13 54 bc 00 00 00 18 c0 87 ......=.T....... 00d0 af 2c 3e f2 33 f8 99 f7 35 ba b9 66 9d a8 8b a9 .,>.3...5..f.... 00e0 77 39 w9 Frame 4 (214 bytes on wire, 214 bytes captured) Arrival Time: Jul 10, 2007 11:33:31.840522000 Time delta from previous packet: 1.360311000 seconds Time since reference or first frame: 1.381441000 seconds Frame Number: 4 Packet Length: 214 bytes Capture Length: 214 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:c0:02:11:42:56 (00:c0:02:11:42:56), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Source: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 200 Identification: 0x0225 (549) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3953 [correct] Good: True Bad : False Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 180 Checksum: 0x63e3 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5DF097C5D9E2A57F Responder cookie: 0xB550E882A5EC4ADD Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 172 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 12 Nonce Data 0000 00 0c 29 51 89 a7 00 c0 02 11 42 56 08 00 45 00 ..)Q......BV..E. 0010 00 c8 02 25 00 00 40 11 39 53 a5 e3 f9 6b a5 e3 ...%..@.9S...k.. 0020 f9 7a 01 f4 01 f4 00 b4 63 e3 5d f0 97 c5 d9 e2 .z......c.]..... 0030 a5 7f b5 50 e8 82 a5 ec 4a dd 04 10 02 00 00 00 ...P....J....... 0040 00 00 00 00 00 ac 0a 00 00 84 2b 7c c6 1d af 43 ..........+|...C 0050 e5 e3 2c 05 27 69 c0 ca 43 5b 6e 4e 4a e8 80 ae ..,.'i..C[nNJ... 0060 e6 22 5b 07 5c b9 0d 29 6c b5 db b3 48 b7 2a 25 ."[.\..)l...H.*% 0070 f0 59 c1 d0 e4 48 8f 8e 98 36 2c b2 b9 f5 6d 96 .Y...H...6,...m. 0080 3f 20 05 2a 13 0c bd 6b 2d 97 47 f7 d2 4a f5 40 ? .*...k-.G..J.@ 0090 3c af 49 aa f0 24 d8 db 59 b5 07 f8 2f 77 0d 5d <.I..$..Y.../w.] 00a0 a5 c0 c1 0f dd 26 f3 3c 0a 22 65 44 2c 1c 07 18 .....&.<."eD,... 00b0 2e 4d ae ff e7 0f 9d 56 14 be 7c ec a3 47 46 f0 .M.....V..|..GF. 00c0 6a a2 d4 ec f0 4a 46 a7 bc 0a 00 00 00 0c 8f 1e j....JF......... 00d0 3f 9e 01 8d b8 13 ?..... Frame 5 (110 bytes on wire, 110 bytes captured) Arrival Time: Jul 10, 2007 11:33:31.840524000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 1.381443000 seconds Frame Number: 5 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Destination: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0091 (145) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb4e [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0xf18f [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5DF097C5D9E2A57F Responder cookie: 0xB550E882A5EC4ADD Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 c0 02 11 42 56 00 0c 29 51 89 a7 08 00 45 00 ....BV..)Q....E. 0010 00 60 00 91 40 00 40 11 fb 4e a5 e3 f9 7a a5 e3 .`..@.@..N...z.. 0020 f9 6b 01 f4 01 f4 00 4c f1 8f 5d f0 97 c5 d9 e2 .k.....L..]..... 0030 a5 7f b5 50 e8 82 a5 ec 4a dd 05 10 02 01 00 00 ...P....J....... 0040 00 00 00 00 00 44 89 7f 86 08 13 87 b2 e9 04 9e .....D.......... 0050 fa 9f e0 8f eb ba c8 86 bc 04 9b 71 63 36 af e6 ...........qc6.. 0060 eb fd 8e 52 bb 15 42 9b 49 20 df 8e 4a d9 ...R..B.I ..J. Frame 6 (110 bytes on wire, 110 bytes captured) Arrival Time: Jul 10, 2007 11:33:33.477855000 Time delta from previous packet: 1.637331000 seconds Time since reference or first frame: 3.018774000 seconds Frame Number: 6 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:c0:02:11:42:56 (00:c0:02:11:42:56), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Source: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0226 (550) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x39ba [correct] Good: True Bad : False Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x7f3c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5DF097C5D9E2A57F Responder cookie: 0xB550E882A5EC4ADD Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 51 89 a7 00 c0 02 11 42 56 08 00 45 00 ..)Q......BV..E. 0010 00 60 02 26 00 00 40 11 39 ba a5 e3 f9 6b a5 e3 .`.&..@.9....k.. 0020 f9 7a 01 f4 01 f4 00 4c 7f 3c 5d f0 97 c5 d9 e2 .z.....L.<]..... 0030 a5 7f b5 50 e8 82 a5 ec 4a dd 05 10 02 01 00 00 ...P....J....... 0040 00 00 00 00 00 44 b5 46 e2 38 c9 01 6c 5d 9f b4 .....D.F.8..l].. 0050 4f dd b2 1a e7 2a d3 89 f9 61 41 32 c4 e0 a4 8f O....*...aA2.... 0060 03 f0 c0 59 9d e8 da b5 9c dc 92 12 f9 5c ...Y.........\ Frame 7 (342 bytes on wire, 342 bytes captured) Arrival Time: Jul 10, 2007 11:33:33.477857000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 3.018776000 seconds Frame Number: 7 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Destination: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0092 (146) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa65 [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.107 (165.227.249.107) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xbf4d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5DF097C5D9E2A57F Responder cookie: 0xB550E882A5EC4ADD Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x129ABF77 Length: 300 Encrypted payload (272 bytes) 0000 00 c0 02 11 42 56 00 0c 29 51 89 a7 08 00 45 00 ....BV..)Q....E. 0010 01 48 00 92 40 00 40 11 fa 65 a5 e3 f9 7a a5 e3 .H..@.@..e...z.. 0020 f9 6b 01 f4 01 f4 01 34 bf 4d 5d f0 97 c5 d9 e2 .k.....4.M]..... 0030 a5 7f b5 50 e8 82 a5 ec 4a dd 08 10 20 01 12 9a ...P....J... ... 0040 bf 77 00 00 01 2c ad 45 a8 86 62 a8 a3 75 09 d4 .w...,.E..b..u.. 0050 dd 8f 21 8d 5c 7d 00 3c 94 6a 6e 02 fa 7b 4c b6 ..!.\}.<.jn..{L. 0060 49 40 2f 77 38 ee f1 a7 e4 d7 13 7d fa 70 4d 26 I@/w8......}.pM& 0070 1c a9 16 40 41 fb 08 a8 3a c0 31 62 7f 50 6d 2e ...@A...:.1b.Pm. 0080 ad 09 56 5c 8b 73 8e a7 c2 8a e3 15 81 79 49 78 ..V\.s.......yIx 0090 ff ea 8c 8c b2 cc 91 62 55 1d 05 06 62 d2 c5 83 .......bU...b... 00a0 25 a6 2e 99 d4 86 06 ae 8d e9 d4 d6 11 23 dc b3 %............#.. 00b0 9a e1 d7 fd 87 d2 2b 3a d2 41 a0 3c 8b 3a 4e 53 ......+:.A.<.:NS 00c0 55 86 15 d8 eb 7a 65 ff 43 3c 83 c6 8b 54 25 8a U....ze.C<...T%. 00d0 e9 61 3e cf aa 0f 6f 60 d4 73 c9 c1 7e 43 a1 11 .a>...o`.s..~C.. 00e0 c1 29 79 5c 35 39 8d 1c 44 1c ca 94 6c fa 5f 1e .)y\59..D...l._. 00f0 fd 8f 56 f9 d3 8f 6b 6b 94 ff a8 c4 b9 8a 53 f2 ..V...kk......S. 0100 f7 bc a1 04 37 40 6c 71 8e 29 3d b3 c6 a3 ff cf ....7@lq.)=..... 0110 ad 60 f1 15 28 73 96 ab f9 34 2b 69 05 f1 15 a5 .`..(s...4+i.... 0120 a2 da 64 17 74 da 7f 05 37 af c3 81 80 1f 31 05 ..d.t...7.....1. 0130 c9 2e 3d 9e 39 49 36 1a b7 c3 da 52 96 50 fd 11 ..=.9I6....R.P.. 0140 fb bf 9e 66 36 89 9a 81 5d d4 a3 aa db 29 02 b9 ...f6...]....).. 0150 b6 6e 39 f2 90 25 .n9..% Frame 8 (326 bytes on wire, 326 bytes captured) Arrival Time: Jul 10, 2007 11:33:34.827181000 Time delta from previous packet: 1.349324000 seconds Time since reference or first frame: 4.368100000 seconds Frame Number: 8 Packet Length: 326 bytes Capture Length: 326 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:c0:02:11:42:56 (00:c0:02:11:42:56), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Source: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0227 (551) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x38e1 [correct] Good: True Bad : False Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x7134 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x5DF097C5D9E2A57F Responder cookie: 0xB550E882A5EC4ADD Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x129ABF77 Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 51 89 a7 00 c0 02 11 42 56 08 00 45 00 ..)Q......BV..E. 0010 01 38 02 27 00 00 40 11 38 e1 a5 e3 f9 6b a5 e3 .8.'..@.8....k.. 0020 f9 7a 01 f4 01 f4 01 24 71 34 5d f0 97 c5 d9 e2 .z.....$q4]..... 0030 a5 7f b5 50 e8 82 a5 ec 4a dd 08 10 20 01 12 9a ...P....J... ... 0040 bf 77 00 00 01 1c 74 57 56 5a be 0c 58 e2 86 94 .w....tWVZ..X... 0050 0a 05 d2 ac 5a b6 7f b9 84 a4 81 e5 df 93 ed 3e ....Z..........> 0060 43 fb 99 26 01 d9 94 1a 52 68 2c b0 b8 bc 50 65 C..&....Rh,...Pe 0070 2a 72 96 60 9f e5 05 63 06 3c 68 8d c7 b4 47 84 *r.`...c.x 0040 fd 68 b5 39 19 c2 f4 2d 26 bb 77 4f 4d 3e d5 b8 .h.9...-&.wOM>.. 0050 dc de bc 17 b9 e2 64 1f af 07 59 54 93 98 5b 6c ......d...YT..[l 0060 c2 a3 df c8 02 34 11 4a 22 fd ed c3 cf 60 9e 06 .....4.J"....`.. 0070 0b 34 1a d1 4d 8e 30 4e 39 bf 51 5e 0e 8b .4..M.0N9.Q^.. Frame 14 (128 bytes on wire, 128 bytes captured) Arrival Time: Jul 10, 2007 11:33:36.391770000 Time delta from previous packet: 0.534177000 seconds Time since reference or first frame: 5.932689000 seconds Frame Number: 14 Packet Length: 128 bytes Capture Length: 128 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:c0:02:11:42:56 (00:c0:02:11:42:56), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Source: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Type: IP (0x0800) Trailer: 726E Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x30dc (12508) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 30 Protocol: ESP (0x32) Header checksum: 0x2cd3 [correct] Good: True Bad : False Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0x8012fd2f Sequence: 1 Data (84 bytes) 0000 00 0c 29 51 89 a7 00 c0 02 11 42 56 08 00 45 00 ..)Q......BV..E. 0010 00 70 30 dc 00 00 1e 32 2c d3 a5 e3 f9 6b a5 e3 .p0....2,....k.. 0020 f9 7a 80 12 fd 2f 00 00 00 01 1a 70 1b 56 f0 03 .z.../.....p.V.. 0030 d2 76 82 b6 af 8c 30 f5 46 b5 68 97 96 bb b5 1a .v....0.F.h..... 0040 f9 ad 51 99 90 2a 77 60 e0 bc 5e 59 10 2e 77 21 ..Q..*w`..^Y..w! 0050 70 30 15 bd 99 99 b9 ec d3 a0 a3 2d d8 a2 35 9f p0.........-..5. 0060 3c 72 33 8d 6e 36 59 0d 71 9f 7b 72 fb 38 ca 42 0060 38 8e b5 11 01 5e 3a 24 00 6d 4d b1 05 aa 17 41 8....^:$.mM....A 0070 21 34 83 9e 42 f1 a3 33 66 a4 89 22 a4 2b 00 00 !4..B..3f..".+.. Frame 16 (126 bytes on wire, 126 bytes captured) Arrival Time: Jul 10, 2007 11:33:36.868879000 Time delta from previous packet: 0.476515000 seconds Time since reference or first frame: 6.409798000 seconds Frame Number: 16 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Destination: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x002d (45) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7c81 [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.107 (165.227.249.107) Encapsulating Security Payload SPI: 0xd3b0822c Sequence: 3 Data (84 bytes) 0000 00 c0 02 11 42 56 00 0c 29 51 89 a7 08 00 45 00 ....BV..)Q....E. 0010 00 70 00 2d 00 00 ff 32 7c 81 a5 e3 f9 7a a5 e3 .p.-...2|....z.. 0020 f9 6b d3 b0 82 2c 00 00 00 03 08 e7 dd 94 a2 a6 .k...,.......... 0030 4c 79 2a 5b 70 85 87 6c be 65 ab 24 de ca 82 21 Ly*[p..l.e.$...! 0040 eb 28 9e 99 88 c0 15 fe 1a e9 cd 76 54 a7 83 c8 .(.........vT... 0050 fc 7f 4e e5 6b 96 83 6f 20 da 9b 3c 94 b8 9a a1 ..N.k..o ..<.... 0060 1f 33 9b a7 72 47 36 d4 2b 85 b2 bc 76 60 a6 29 .3..rG6.+...v`.) 0070 99 cf 0b 45 ff 69 e3 b6 7a 74 8a c7 ae 10 ...E.i..zt.... Frame 17 (128 bytes on wire, 128 bytes captured) Arrival Time: Jul 10, 2007 11:33:36.871050000 Time delta from previous packet: 0.002171000 seconds Time since reference or first frame: 6.411969000 seconds Frame Number: 17 Packet Length: 128 bytes Capture Length: 128 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:c0:02:11:42:56 (00:c0:02:11:42:56), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Source: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Type: IP (0x0800) Trailer: 6561 Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x2963 (10595) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 30 Protocol: ESP (0x32) Header checksum: 0x344c [correct] Good: True Bad : False Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0x8012fd2f Sequence: 3 Data (84 bytes) 0000 00 0c 29 51 89 a7 00 c0 02 11 42 56 08 00 45 00 ..)Q......BV..E. 0010 00 70 29 63 00 00 1e 32 34 4c a5 e3 f9 6b a5 e3 .p)c...24L...k.. 0020 f9 7a 80 12 fd 2f 00 00 00 03 4d b1 05 aa 17 41 .z.../....M....A 0030 21 34 2f 6d aa fe 8e 6d 24 39 31 05 17 3b be 80 !4/m...m$91..;.. 0040 ee b3 e2 a0 56 60 e9 16 2e 89 8c 7d 3e e8 a6 5e ....V`.....}>..^ 0050 ae c0 d3 75 1e 43 6c ae 89 d9 d3 a3 f1 32 57 29 ...u.Cl......2W) 0060 32 11 6f b4 f3 8e 29 f6 95 a3 f8 b9 95 5e 26 7c 2.o...)......^&| 0070 fa 7f 8b 06 e9 52 03 80 a4 e3 09 21 bb 97 65 61 .....R.....!..ea Frame 18 (126 bytes on wire, 126 bytes captured) Arrival Time: Jul 10, 2007 11:33:37.880000000 Time delta from previous packet: 1.008950000 seconds Time since reference or first frame: 7.420919000 seconds Frame Number: 18 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Destination: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.107 (165.227.249.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x002e (46) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7c80 [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.107 (165.227.249.107) Encapsulating Security Payload SPI: 0xd3b0822c Sequence: 4 Data (84 bytes) 0000 00 c0 02 11 42 56 00 0c 29 51 89 a7 08 00 45 00 ....BV..)Q....E. 0010 00 70 00 2e 00 00 ff 32 7c 80 a5 e3 f9 7a a5 e3 .p.....2|....z.. 0020 f9 6b d3 b0 82 2c 00 00 00 04 ff 8f 2e fb 25 cc .k...,........%. 0030 fe 00 8a 5e c5 d0 ce d3 91 cf da 6d 2d 68 00 7b ...^.......m-h.{ 0040 bf a1 11 88 b5 b5 0b f2 6b 5b e9 3f db 38 10 d6 ........k[.?.8.. 0050 99 a4 3b 68 72 ac 22 58 0a 93 b6 6c 70 37 9f d7 ..;hr."X...lp7.. 0060 57 b6 4b a3 41 3c 9e 1a 1b ac 76 22 a4 64 9c 5a W.K.A<....v".d.Z 0070 a7 73 ca 03 18 bc a8 85 48 df 9c b7 19 84 .s......H..... Frame 19 (128 bytes on wire, 128 bytes captured) Arrival Time: Jul 10, 2007 11:33:37.881536000 Time delta from previous packet: 0.001536000 seconds Time since reference or first frame: 7.422455000 seconds Frame Number: 19 Packet Length: 128 bytes Capture Length: 128 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:c0:02:11:42:56 (00:c0:02:11:42:56), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Source: 00:c0:02:11:42:56 (00:c0:02:11:42:56) Type: IP (0x0800) Trailer: 6E61 Internet Protocol, Src: 165.227.249.107 (165.227.249.107), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x23fc (9212) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 30 Protocol: ESP (0x32) Header checksum: 0x39b3 [correct] Good: True Bad : False Source: 165.227.249.107 (165.227.249.107) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0x8012fd2f Sequence: 4 Data (84 bytes) 0000 00 0c 29 51 89 a7 00 c0 02 11 42 56 08 00 45 00 ..)Q......BV..E. 0010 00 70 23 fc 00 00 1e 32 39 b3 a5 e3 f9 6b a5 e3 .p#....29....k.. 0020 f9 7a 80 12 fd 2f 00 00 00 04 f8 b9 95 5e 26 7c .z.../.......^&| 0030 fa 7f 71 84 13 d3 3a 5a b7 6b 96 b5 47 e6 9c ff ..q...:Z.k..G... 0040 7b 57 3b f5 db 48 b1 68 1a 97 d9 f4 c3 1a 4e 97 {W;..H.h......N. 0050 41 65 2e 9f 0c 2e 3c 23 62 33 38 50 d4 9c 5b 03 Ae....<#b38P..[. 0060 9d f1 73 80 03 0b 47 b0 70 55 ef 2b 8f 31 f3 e3 ..s...G.pU.+.1.. 0070 4c 0e ce 62 02 54 12 63 62 a1 e7 3a 63 00 6e 61 L..b.T.cb..:c.na