Frame 1 (178 bytes on wire, 178 bytes captured) Arrival Time: Mar 25, 2004 14:42:33.454231000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 178 bytes Capture Length: 178 bytes Ethernet II, Src: 00:0c:29:fc:0c:9f, Dst: 00:00:24:c0:92:d1 Destination: 00:00:24:c0:92:d1 (00:00:24:c0:92:d1) Source: 00:0c:29:fc:0c:9f (00:0c:29:fc:0c:9f) Type: IP (0x0800) Frame check sequence: 0x0b86ced5 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 160 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb96 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.116 (165.227.249.116) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 140 Checksum: 0xf566 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xF5DFA7292EEAA0CA Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 132 Security Association payload Next payload: Vendor ID (13) Length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 48 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 40 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 44 Vendor ID: Check Point Check Point Product: VPN-1 Version: NG with Application Intelligence R55 0000 00 00 24 c0 92 d1 00 0c 29 fc 0c 9f 08 00 45 00 ..$.....).....E. 0010 00 a0 00 00 40 00 40 11 fb 96 a5 e3 f9 7a a5 e3 ....@.@......z.. 0020 f9 74 01 f4 01 f4 00 8c f5 66 f5 df a7 29 2e ea .t.......f...).. 0030 a0 ca 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 84 0d 00 00 3c 00 00 00 01 00 00 .........<...... 0050 00 01 00 00 00 30 01 01 00 01 00 00 00 28 01 01 .....0.......(.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 00 0c 00 04 00 00 ................ 0080 70 80 00 00 00 2c f4 ed 19 e0 c1 14 eb 51 6f aa p....,.......Qo. 0090 ac 0e e3 7d af 28 07 b4 38 1f 00 00 00 01 00 00 ...}.(..8....... 00a0 13 8d 00 00 00 00 00 00 00 00 18 80 00 00 0b 86 ................ 00b0 ce d5 .. Frame 2 (134 bytes on wire, 134 bytes captured) Arrival Time: Mar 25, 2004 14:42:33.459242000 Time delta from previous packet: 0.005011000 seconds Time since reference or first frame: 0.005011000 seconds Frame Number: 2 Packet Length: 134 bytes Capture Length: 134 bytes Ethernet II, Src: 00:00:24:c0:92:d1, Dst: 00:0c:29:fc:0c:9f Destination: 00:0c:29:fc:0c:9f (00:0c:29:fc:0c:9f) Source: 00:00:24:c0:92:d1 (00:00:24:c0:92:d1) Type: IP (0x0800) Frame check sequence: 0x651d20b9 (correct) Internet Protocol, Src Addr: 165.227.249.116 (165.227.249.116), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 116 Identification: 0x0001 (1) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 30 Protocol: UDP (0x11) Header checksum: 0x5dc2 (correct) Source: 165.227.249.116 (165.227.249.116) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 96 Checksum: 0xda94 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xF5DFA7292EEAA0CA Responder cookie: 0x57652AAA3D983E50 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 88 Security Association payload Next payload: NONE (0) Length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 48 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 40 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0c 29 fc 0c 9f 00 00 24 c0 92 d1 08 00 45 00 ..).....$.....E. 0010 00 74 00 01 00 00 1e 11 5d c2 a5 e3 f9 74 a5 e3 .t......]....t.. 0020 f9 7a 01 f4 01 f4 00 60 da 94 f5 df a7 29 2e ea .z.....`.....).. 0030 a0 ca 57 65 2a aa 3d 98 3e 50 01 10 02 00 00 00 ..We*.=.>P...... 0040 00 00 00 00 00 58 00 00 00 3c 00 00 00 01 00 00 .....X...<...... 0050 00 01 00 00 00 30 01 01 00 01 00 00 00 28 01 01 .....0.......(.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 00 0c 00 04 00 00 ................ 0080 70 80 65 1d 20 b9 p.e. . Frame 3 (230 bytes on wire, 230 bytes captured) Arrival Time: Mar 25, 2004 14:42:33.465678000 Time delta from previous packet: 0.006436000 seconds Time since reference or first frame: 0.011447000 seconds Frame Number: 3 Packet Length: 230 bytes Capture Length: 230 bytes Ethernet II, Src: 00:0c:29:fc:0c:9f, Dst: 00:00:24:c0:92:d1 Destination: 00:00:24:c0:92:d1 (00:00:24:c0:92:d1) Source: 00:0c:29:fc:0c:9f (00:0c:29:fc:0c:9f) Type: IP (0x0800) Frame check sequence: 0x8da43c50 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb62 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.116 (165.227.249.116) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x011c (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xF5DFA7292EEAA0CA Responder cookie: 0x57652AAA3D983E50 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 24 Nonce Data 0000 00 00 24 c0 92 d1 00 0c 29 fc 0c 9f 08 00 45 00 ..$.....).....E. 0010 00 d4 00 00 40 00 40 11 fb 62 a5 e3 f9 7a a5 e3 ....@.@..b...z.. 0020 f9 74 01 f4 01 f4 00 c0 01 1c f5 df a7 29 2e ea .t...........).. 0030 a0 ca 57 65 2a aa 3d 98 3e 50 04 10 02 00 00 00 ..We*.=.>P...... 0040 00 00 00 00 00 b8 0a 00 00 84 30 69 4e cc db da ..........0iN... 0050 d8 3b c3 07 3f 64 84 7b c2 2d 99 e8 6e 21 a9 11 .;..?d.{.-..n!.. 0060 b4 c3 1b fa 2a d5 5e 81 84 5d ea d2 e1 82 8a d9 ....*.^..]...... 0070 04 de f5 59 49 af 5d 54 a3 f6 97 c4 ca 18 05 50 ...YI.]T.......P 0080 7d bd a1 1f f4 88 d5 82 eb 4f 78 b9 dc c5 51 81 }........Ox...Q. 0090 58 4e d2 03 43 1e 67 d0 89 3a a9 71 88 53 8f bd XN..C.g..:.q.S.. 00a0 a7 87 bc 18 85 e0 5b f5 99 65 a7 80 9c 2f 88 1f ......[..e.../.. 00b0 7f 9e b9 28 e5 7f e4 57 be 26 9e 47 3f 7f 75 8c ...(...W.&.G?.u. 00c0 26 5a 20 46 54 86 6e bc 60 50 00 00 00 18 9f 68 &Z FT.n.`P.....h 00d0 ed ac 8c 8c 80 2b 4e 46 ff 52 1a 4b 69 57 4b 38 .....+NF.R.KiWK8 00e0 b4 a9 8d a4 3c 50 ....

P...... 0040 00 00 00 00 00 ac 0a 00 00 84 37 89 bf 52 36 0e ..........7..R6. 0050 f7 9b 11 fc 2f ae a2 02 75 ea 4a ce d3 30 47 9d ..../...u.J..0G. 0060 35 32 cb d2 1c 79 e1 92 58 d5 9b a4 7f b2 0d 78 52...y..X......x 0070 58 00 13 8f 32 70 07 65 e9 e9 06 15 8a b5 7c 75 X...2p.e......|u 0080 bf 03 c0 04 89 29 00 2a 20 d6 52 25 d6 40 16 bf .....).* .R%.@.. 0090 50 0b a3 8b 61 92 73 2e 66 31 a6 b7 e5 a1 7c 0c P...a.s.f1....|. 00a0 59 c7 25 b9 9e dc 5e cd 93 c4 96 0d 88 ab 0b 4a Y.%...^........J 00b0 72 55 d2 bf fd e1 7e 2c 03 eb ef 59 47 9c e5 f6 rU....~,...YG... 00c0 70 fd bd 5b 74 48 dd 98 4f 38 00 00 00 0c 98 5f p..[tH..O8....._ 00d0 2a da 6c b7 50 a6 a2 66 3a 60 *.l.P..f:` Frame 5 (122 bytes on wire, 122 bytes captured) Arrival Time: Mar 25, 2004 14:42:35.298013000 Time delta from previous packet: 0.008830000 seconds Time since reference or first frame: 1.843782000 seconds Frame Number: 5 Packet Length: 122 bytes Capture Length: 122 bytes Ethernet II, Src: 00:0c:29:fc:0c:9f, Dst: 00:00:24:c0:92:d1 Destination: 00:00:24:c0:92:d1 (00:00:24:c0:92:d1) Source: 00:0c:29:fc:0c:9f (00:0c:29:fc:0c:9f) Type: IP (0x0800) Frame check sequence: 0x7e668f55 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbce (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.116 (165.227.249.116) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x4bcd (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xF5DFA7292EEAA0CA Responder cookie: 0x57652AAA3D983E50 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 00 24 c0 92 d1 00 0c 29 fc 0c 9f 08 00 45 00 ..$.....).....E. 0010 00 68 00 00 40 00 40 11 fb ce a5 e3 f9 7a a5 e3 .h..@.@......z.. 0020 f9 74 01 f4 01 f4 00 54 4b cd f5 df a7 29 2e ea .t.....TK....).. 0030 a0 ca 57 65 2a aa 3d 98 3e 50 05 10 02 01 00 00 ..We*.=.>P...... 0040 00 00 00 00 00 4c 1d 98 44 65 ce 07 29 d9 7c 25 .....L..De..).|% 0050 10 36 1d 9b b7 b3 75 e5 32 2b 23 94 e8 02 9d 42 .6....u.2+#....B 0060 50 2e 1d 70 25 35 ac d5 6a 1d 26 ff db a8 b9 c6 P..p%5..j.&..... 0070 ea c8 14 90 8c c5 7e 66 8f 55 ......~f.U Frame 6 (122 bytes on wire, 122 bytes captured) Arrival Time: Mar 25, 2004 14:42:37.298294000 Time delta from previous packet: 2.000281000 seconds Time since reference or first frame: 3.844063000 seconds Frame Number: 6 Packet Length: 122 bytes Capture Length: 122 bytes Ethernet II, Src: 00:0c:29:fc:0c:9f, Dst: 00:00:24:c0:92:d1 Destination: 00:00:24:c0:92:d1 (00:00:24:c0:92:d1) Source: 00:0c:29:fc:0c:9f (00:0c:29:fc:0c:9f) Type: IP (0x0800) Frame check sequence: 0x7e668f55 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbce (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.116 (165.227.249.116) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x4bcd (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xF5DFA7292EEAA0CA Responder cookie: 0x57652AAA3D983E50 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 00 24 c0 92 d1 00 0c 29 fc 0c 9f 08 00 45 00 ..$.....).....E. 0010 00 68 00 00 40 00 40 11 fb ce a5 e3 f9 7a a5 e3 .h..@.@......z.. 0020 f9 74 01 f4 01 f4 00 54 4b cd f5 df a7 29 2e ea .t.....TK....).. 0030 a0 ca 57 65 2a aa 3d 98 3e 50 05 10 02 01 00 00 ..We*.=.>P...... 0040 00 00 00 00 00 4c 1d 98 44 65 ce 07 29 d9 7c 25 .....L..De..).|% 0050 10 36 1d 9b b7 b3 75 e5 32 2b 23 94 e8 02 9d 42 .6....u.2+#....B 0060 50 2e 1d 70 25 35 ac d5 6a 1d 26 ff db a8 b9 c6 P..p%5..j.&..... 0070 ea c8 14 90 8c c5 7e 66 8f 55 ......~f.U Frame 7 (122 bytes on wire, 122 bytes captured) Arrival Time: Mar 25, 2004 14:42:37.435944000 Time delta from previous packet: 0.137650000 seconds Time since reference or first frame: 3.981713000 seconds Frame Number: 7 Packet Length: 122 bytes Capture Length: 122 bytes Ethernet II, Src: 00:00:24:c0:92:d1, Dst: 00:0c:29:fc:0c:9f Destination: 00:0c:29:fc:0c:9f (00:0c:29:fc:0c:9f) Source: 00:00:24:c0:92:d1 (00:00:24:c0:92:d1) Type: IP (0x0800) Frame check sequence: 0x916317ee (correct) Internet Protocol, Src Addr: 165.227.249.116 (165.227.249.116), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0003 (3) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 30 Protocol: UDP (0x11) Header checksum: 0x5dcc (correct) Source: 165.227.249.116 (165.227.249.116) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x5ab3 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xF5DFA7292EEAA0CA Responder cookie: 0x57652AAA3D983E50 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 fc 0c 9f 00 00 24 c0 92 d1 08 00 45 00 ..).....$.....E. 0010 00 68 00 03 00 00 1e 11 5d cc a5 e3 f9 74 a5 e3 .h......]....t.. 0020 f9 7a 01 f4 01 f4 00 54 5a b3 f5 df a7 29 2e ea .z.....TZ....).. 0030 a0 ca 57 65 2a aa 3d 98 3e 50 05 10 02 01 00 00 ..We*.=.>P...... 0040 00 00 00 00 00 4c ff 75 56 bf 38 11 2a 11 98 b1 .....L.uV.8.*... 0050 ba 72 d9 b1 03 6f ba b7 fe 6b 7c 91 43 d4 47 d7 .r...o...k|.C.G. 0060 0f 76 8f 0e 0a 05 a5 d2 00 b7 b9 83 d5 f8 00 bf .v.............. 0070 ac 0b f2 fd c7 8a 91 63 17 ee .......c.. Frame 8 (362 bytes on wire, 362 bytes captured) Arrival Time: Mar 25, 2004 14:42:37.444779000 Time delta from previous packet: 0.008835000 seconds Time since reference or first frame: 3.990548000 seconds Frame Number: 8 Packet Length: 362 bytes Capture Length: 362 bytes Ethernet II, Src: 00:0c:29:fc:0c:9f, Dst: 00:00:24:c0:92:d1 Destination: 00:00:24:c0:92:d1 (00:00:24:c0:92:d1) Source: 00:0c:29:fc:0c:9f (00:0c:29:fc:0c:9f) Type: IP (0x0800) Frame check sequence: 0xf9957be8 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 344 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfade (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.116 (165.227.249.116) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 324 Checksum: 0x98db (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xF5DFA7292EEAA0CA Responder cookie: 0x57652AAA3D983E50 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x31B91410 Length: 316 Encrypted payload (288 bytes) 0000 00 00 24 c0 92 d1 00 0c 29 fc 0c 9f 08 00 45 00 ..$.....).....E. 0010 01 58 00 00 40 00 40 11 fa de a5 e3 f9 7a a5 e3 .X..@.@......z.. 0020 f9 74 01 f4 01 f4 01 44 98 db f5 df a7 29 2e ea .t.....D.....).. 0030 a0 ca 57 65 2a aa 3d 98 3e 50 08 10 20 01 31 b9 ..We*.=.>P.. .1. 0040 14 10 00 00 01 3c 40 57 11 96 6e 46 c7 70 69 22 .....<@W..nF.pi" 0050 21 3d 54 b3 b6 3e 9a 5d 13 af 63 82 c3 97 91 07 !=T..>.]..c..... 0060 18 0b 76 7d 27 c3 f4 35 1c 47 0b 8b cb 87 d3 00 ..v}'..5.G...... 0070 72 e0 ee e8 1b 1e 96 8f 03 64 18 5f 96 a0 69 75 r........d._..iu 0080 6e 5f 7c cb d3 a7 0e 06 78 16 b2 0b 8a 7d a1 df n_|.....x....}.. 0090 70 e5 5d 89 59 08 3e 5d e4 2e df 6d c7 42 53 84 p.].Y.>]...m.BS. 00a0 0e 23 92 26 5d 2f 6c 7f f5 8f 37 a7 95 7c 81 90 .#.&]/l...7..|.. 00b0 5d 7f c0 db 3a 3e 5e 65 96 81 2a e8 0c 34 03 f2 ]...:>^e..*..4.. 00c0 c2 0f a4 4a fe 78 d8 b9 be 20 ed 1a 0a dc 17 dd ...J.x... ...... 00d0 7e c9 0f e3 84 b1 bd fe 64 93 09 cf 34 9f c1 cd ~.......d...4... 00e0 77 8c 83 d4 a3 b3 62 a7 bc 4c 39 5f 66 79 43 cf w.....b..L9_fyC. 00f0 e3 79 3a 3c 20 5d ab 17 15 d2 06 c4 2e 82 c3 f6 .y:< ].......... 0100 29 0d 6a 04 b4 b5 e3 9e 68 7b d7 69 0f 82 57 4a ).j.....h{.i..WJ 0110 a3 6f e9 29 f6 ce 85 14 bc 14 b1 9c 14 bd 69 63 .o.)..........ic 0120 d7 ae b8 f4 37 cf f0 5b a9 a8 e8 83 c5 39 aa 9b ....7..[.....9.. 0130 06 50 1f 0a 71 75 f5 b2 b7 31 3e a2 c9 52 58 bd .P..qu...1>..RX. 0140 f1 4c 23 06 03 72 15 e1 e4 ae c3 19 9b c5 4b 26 .L#..r........K& 0150 0c 4e e0 e4 eb bb 6a 13 cc 9a a3 60 2b ab 2c a4 .N....j....`+.,. 0160 b2 b6 b4 d6 56 06 f9 95 7b e8 ....V...{. Frame 9 (346 bytes on wire, 346 bytes captured) Arrival Time: Mar 25, 2004 14:42:39.247306000 Time delta from previous packet: 1.802527000 seconds Time since reference or first frame: 5.793075000 seconds Frame Number: 9 Packet Length: 346 bytes Capture Length: 346 bytes Ethernet II, Src: 00:00:24:c0:92:d1, Dst: 00:0c:29:fc:0c:9f Destination: 00:0c:29:fc:0c:9f (00:0c:29:fc:0c:9f) Source: 00:00:24:c0:92:d1 (00:00:24:c0:92:d1) Type: IP (0x0800) Frame check sequence: 0x3259d6f1 (correct) Internet Protocol, Src Addr: 165.227.249.116 (165.227.249.116), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0004 (4) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 30 Protocol: UDP (0x11) Header checksum: 0x5ceb (correct) Source: 165.227.249.116 (165.227.249.116) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x6e9f (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xF5DFA7292EEAA0CA Responder cookie: 0x57652AAA3D983E50 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x31B91410 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 fc 0c 9f 00 00 24 c0 92 d1 08 00 45 00 ..).....$.....E. 0010 01 48 00 04 00 00 1e 11 5c eb a5 e3 f9 74 a5 e3 .H......\....t.. 0020 f9 7a 01 f4 01 f4 01 34 6e 9f f5 df a7 29 2e ea .z.....4n....).. 0030 a0 ca 57 65 2a aa 3d 98 3e 50 08 10 20 01 31 b9 ..We*.=.>P.. .1. 0040 14 10 00 00 01 2c 94 7c 72 cf e9 e6 f3 32 28 44 .....,.|r....2(D 0050 a0 e9 cc 90 57 2f ac cb 1f 93 00 d9 44 a3 3d ad ....W/......D.=. 0060 11 0a 59 c1 0a 95 c6 b8 c0 fd c7 90 f6 9b 3b 1d ..Y...........;. 0070 6d 96 97 21 f4 9c 08 c2 ba aa 14 e7 12 a5 ef dc m..!............ 0080 0a eb b1 0d fc c1 6c be 14 7c 7c a7 8a 4f ee 95 ......l..||..O.. 0090 9c 6b 95 37 6d 54 fe 41 65 c3 70 61 cf cd 76 e1 .k.7mT.Ae.pa..v. 00a0 c8 0b 6a 37 76 a8 55 bf e0 1f 02 0c 7e b4 07 ff ..j7v.U.....~... 00b0 28 0d 07 41 93 ab b9 57 0c 9c b6 a8 ca 4c ea 79 (..A...W.....L.y 00c0 49 c3 78 8a 34 cf 6b 8d 41 81 fd 49 3d 46 98 91 I.x.4.k.A..I=F.. 00d0 6a 6e ec f0 66 a2 c7 a7 13 c1 41 1f 97 0a c1 ab jn..f.....A..... 00e0 ee 13 22 4f fc 7b 9c c9 36 5b ff fe e5 12 8c ca .."O.{..6[...... 00f0 0b 91 8f 10 08 db ac 87 53 68 05 3e ec 49 9e 25 ........Sh.>.I.% 0100 7a 6d 64 89 09 27 df 1b 0d 2a 36 97 d0 49 19 05 zmd..'...*6..I.. 0110 fe 51 ba c8 ba c6 b3 2a e4 d4 20 ef e6 ed 3b ff .Q.....*.. ...;. 0120 53 5f 05 41 4f 51 60 17 69 06 fc 70 9b 8b 92 01 S_.AOQ`.i..p.... 0130 af 14 29 a9 ce 08 cd db d2 70 5f 6e c0 1d 7d d1 ..)......p_n..}. 0140 68 50 a0 22 54 94 2d a8 f6 fa 85 2d 28 87 cd 7d hP."T.-....-(..} 0150 15 fe 0c db 2e e8 32 59 d6 f1 ......2Y.. Frame 10 (106 bytes on wire, 106 bytes captured) Arrival Time: Mar 25, 2004 14:42:39.255749000 Time delta from previous packet: 0.008443000 seconds Time since reference or first frame: 5.801518000 seconds Frame Number: 10 Packet Length: 106 bytes Capture Length: 106 bytes Ethernet II, Src: 00:0c:29:fc:0c:9f, Dst: 00:00:24:c0:92:d1 Destination: 00:00:24:c0:92:d1 (00:00:24:c0:92:d1) Source: 00:0c:29:fc:0c:9f (00:0c:29:fc:0c:9f) Type: IP (0x0800) Frame check sequence: 0xa1e9b62c (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbde (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.116 (165.227.249.116) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x9e8b (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xF5DFA7292EEAA0CA Responder cookie: 0x57652AAA3D983E50 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x31B91410 Length: 60 Encrypted payload (32 bytes) 0000 00 00 24 c0 92 d1 00 0c 29 fc 0c 9f 08 00 45 00 ..$.....).....E. 0010 00 58 00 00 40 00 40 11 fb de a5 e3 f9 7a a5 e3 .X..@.@......z.. 0020 f9 74 01 f4 01 f4 00 44 9e 8b f5 df a7 29 2e ea .t.....D.....).. 0030 a0 ca 57 65 2a aa 3d 98 3e 50 08 10 20 01 31 b9 ..We*.=.>P.. .1. 0040 14 10 00 00 00 3c 46 78 f9 e2 d6 e8 36 be 3a 30 .....P.. .1. 0040 14 10 00 00 00 3c 46 78 f9 e2 d6 e8 36 be 3a 30 .....P.. .1. 0040 14 10 00 00 00 3c 46 78 f9 e2 d6 e8 36 be 3a 30 ......&. 0050 68 d5 9c 62 99 73 83 c2 bc 8b ec e5 3f ec 80 b3 h..b.s......?... 0060 0c 7a d7 9c 4e e5 28 56 2a bf 85 29 9d bb ea 67 .z..N.(V*..)...g 0070 c1 32 6b c2 46 b3 fa f9 01 d3 ee f2 33 e1 b7 35 .2k.F.......3..5 0080 b1 ff f6 30 5d 16 4d f2 9b ea ...0].M... Frame 14 (138 bytes on wire, 138 bytes captured) Arrival Time: Mar 25, 2004 14:42:39.564233000 Time delta from previous packet: 0.000198000 seconds Time since reference or first frame: 6.110002000 seconds Frame Number: 14 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:50:fc:84:d2:ec, Dst: 00:00:24:c0:92:d1 Destination: 00:00:24:c0:92:d1 (00:00:24:c0:92:d1) Source: 00:50:fc:84:d2:ec (00:50:fc:84:d2:ec) Type: IP (0x0800) Frame check sequence: 0xd6864a07 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x00d6 (214) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 254 Protocol: ESP (0x32) Header checksum: 0x7cc7 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.116 (165.227.249.116) Encapsulating Security Payload SPI: 0x2c2f23a8 Sequence: 1 Data (92 bytes) 0000 00 00 24 c0 92 d1 00 50 fc 84 d2 ec 08 00 45 00 ..$....P......E. 0010 00 78 00 d6 00 00 fe 32 7c c7 a5 e3 f9 7a a5 e3 .x.....2|....z.. 0020 f9 74 2c 2f 23 a8 00 00 00 01 ca 92 f9 ee fd 51 .t,/#..........Q 0030 69 00 87 97 14 3d 95 49 61 69 f1 a2 c3 f2 2a e2 i....=.Iai....*. 0040 69 ae 2d 29 8e 04 d0 e4 6e 12 cf 9d 3e ea 26 9b i.-)....n...>.&. 0050 68 d5 9c 62 99 73 83 c2 bc 8b ec e5 3f ec 80 b3 h..b.s......?... 0060 0c 7a d7 9c 4e e5 28 56 2a bf 85 29 9d bb ea 67 .z..N.(V*..)...g 0070 c1 32 6b c2 46 b3 fa f9 01 d3 ee f2 33 e1 b7 35 .2k.F.......3..5 0080 b1 ff f6 30 5d 16 d6 86 4a 07 ...0]...J. Frame 15 (138 bytes on wire, 138 bytes captured) Arrival Time: Mar 25, 2004 14:42:41.407946000 Time delta from previous packet: 1.843713000 seconds Time since reference or first frame: 7.953715000 seconds Frame Number: 15 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:00:24:c0:92:d1, Dst: 00:0c:29:fc:0c:9f Destination: 00:0c:29:fc:0c:9f (00:0c:29:fc:0c:9f) Source: 00:00:24:c0:92:d1 (00:00:24:c0:92:d1) Type: IP (0x0800) Frame check sequence: 0xc74335e1 (correct) Internet Protocol, Src Addr: 165.227.249.116 (165.227.249.116), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0005 (5) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 30 Protocol: ESP (0x32) Header checksum: 0x5d99 (correct) Source: 165.227.249.116 (165.227.249.116) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0xd3143c5e Sequence: 1 Data (92 bytes) 0000 00 0c 29 fc 0c 9f 00 00 24 c0 92 d1 08 00 45 00 ..).....$.....E. 0010 00 78 00 05 00 00 1e 32 5d 99 a5 e3 f9 74 a5 e3 .x.....2]....t.. 0020 f9 7a d3 14 3c 5e 00 00 00 01 9d 1c 36 ff b5 21 .z..<^......6..! 0030 36 e3 44 9d 34 00 24 3d cb 03 99 e2 79 37 cb 91 6.D.4.$=....y7.. 0040 04 8a 6b b0 25 3f 41 6b 70 26 d8 88 b3 a2 6c 73 ..k.%?Akp&....ls 0050 7d 6e 2d 22 d4 94 f6 31 0c bd 3d a7 5e df b5 5a }n-"...1..=.^..Z 0060 d8 fb 75 bc b5 aa 16 f5 02 33 46 ee 66 b4 17 98 ..u......3F.f... 0070 58 00 23 75 59 f4 e6 ac 44 74 d0 dd 6a 6a 3b 20 X.#uY...Dt..jj; 0080 ef d4 7c 0f 78 25 c7 43 35 e1 ..|.x%.C5. Frame 16 (138 bytes on wire, 138 bytes captured) Arrival Time: Mar 25, 2004 14:42:44.040890000 Time delta from previous packet: 2.632944000 seconds Time since reference or first frame: 10.586659000 seconds Frame Number: 16 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:0c:29:fc:0c:9f, Dst: 00:50:fc:84:d2:ec Destination: 00:50:fc:84:d2:ec (00:50:fc:84:d2:ec) Source: 00:0c:29:fc:0c:9f (00:0c:29:fc:0c:9f) Type: IP (0x0800) Frame check sequence: 0xd3956e7f (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x00d7 (215) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7bc6 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.116 (165.227.249.116) Encapsulating Security Payload SPI: 0x2c2f23a8 Sequence: 2 Data (92 bytes) 0000 00 50 fc 84 d2 ec 00 0c 29 fc 0c 9f 08 00 45 00 .P......).....E. 0010 00 78 00 d7 00 00 ff 32 7b c6 a5 e3 f9 7a a5 e3 .x.....2{....z.. 0020 f9 74 2c 2f 23 a8 00 00 00 02 85 29 9d bb ea 67 .t,/#......)...g 0030 c1 32 6b c2 46 b3 fa f9 01 d3 e8 f5 1e 23 e2 de .2k.F........#.. 0040 45 e6 d4 d0 15 94 54 33 87 bd 26 2d 25 aa 43 7f E.....T3..&-%.C. 0050 79 8a c8 15 27 0f 30 36 92 3b db bf e9 37 34 09 y...'.06.;...74. 0060 4e 05 61 a7 3f 94 ac f4 1d bc 4d 88 7a f1 a5 ef N.a.?.....M.z... 0070 b9 54 f0 09 36 1d 6e 1d 24 39 b2 be f4 b9 ed 9f .T..6.n.$9...... 0080 85 a6 a2 39 74 e4 d3 95 6e 7f ...9t...n. Frame 17 (138 bytes on wire, 138 bytes captured) Arrival Time: Mar 25, 2004 14:42:44.041087000 Time delta from previous packet: 0.000197000 seconds Time since reference or first frame: 10.586856000 seconds Frame Number: 17 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:50:fc:84:d2:ec, Dst: 00:00:24:c0:92:d1 Destination: 00:00:24:c0:92:d1 (00:00:24:c0:92:d1) Source: 00:50:fc:84:d2:ec (00:50:fc:84:d2:ec) Type: IP (0x0800) Frame check sequence: 0x48e1bf92 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x00d7 (215) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 254 Protocol: ESP (0x32) Header checksum: 0x7cc6 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.116 (165.227.249.116) Encapsulating Security Payload SPI: 0x2c2f23a8 Sequence: 2 Data (92 bytes) 0000 00 00 24 c0 92 d1 00 50 fc 84 d2 ec 08 00 45 00 ..$....P......E. 0010 00 78 00 d7 00 00 fe 32 7c c6 a5 e3 f9 7a a5 e3 .x.....2|....z.. 0020 f9 74 2c 2f 23 a8 00 00 00 02 85 29 9d bb ea 67 .t,/#......)...g 0030 c1 32 6b c2 46 b3 fa f9 01 d3 e8 f5 1e 23 e2 de .2k.F........#.. 0040 45 e6 d4 d0 15 94 54 33 87 bd 26 2d 25 aa 43 7f E.....T3..&-%.C. 0050 79 8a c8 15 27 0f 30 36 92 3b db bf e9 37 34 09 y...'.06.;...74. 0060 4e 05 61 a7 3f 94 ac f4 1d bc 4d 88 7a f1 a5 ef N.a.?.....M.z... 0070 b9 54 f0 09 36 1d 6e 1d 24 39 b2 be f4 b9 ed 9f .T..6.n.$9...... 0080 85 a6 a2 39 74 e4 48 e1 bf 92 ...9t.H... Frame 18 (138 bytes on wire, 138 bytes captured) Arrival Time: Mar 25, 2004 14:42:44.043819000 Time delta from previous packet: 0.002732000 seconds Time since reference or first frame: 10.589588000 seconds Frame Number: 18 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:00:24:c0:92:d1, Dst: 00:0c:29:fc:0c:9f Destination: 00:0c:29:fc:0c:9f (00:0c:29:fc:0c:9f) Source: 00:00:24:c0:92:d1 (00:00:24:c0:92:d1) Type: IP (0x0800) Frame check sequence: 0x208b0b8b (correct) Internet Protocol, Src Addr: 165.227.249.116 (165.227.249.116), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0006 (6) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 30 Protocol: ESP (0x32) Header checksum: 0x5d98 (correct) Source: 165.227.249.116 (165.227.249.116) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0xd3143c5e Sequence: 2 Data (92 bytes) 0000 00 0c 29 fc 0c 9f 00 00 24 c0 92 d1 08 00 45 00 ..).....$.....E. 0010 00 78 00 06 00 00 1e 32 5d 98 a5 e3 f9 74 a5 e3 .x.....2]....t.. 0020 f9 7a d3 14 3c 5e 00 00 00 02 46 ee 66 b4 17 98 .z..<^....F.f... 0030 58 00 23 75 59 f4 e6 ac 44 74 86 33 ef 81 19 1a X.#uY...Dt.3.... 0040 b9 3a 84 85 09 51 c7 37 dd b6 1b e2 d0 93 ae 3d .:...Q.7.......= 0050 85 c2 c9 07 aa 3b ad 83 8a 86 fd 1c 9e 8a 52 88 .....;........R. 0060 2d 99 94 98 d6 24 f1 b1 b5 76 cc aa 6a 04 1a 68 -....$...v..j..h 0070 f2 3a 59 cf 4f b4 b1 86 b9 97 d8 9f 51 c6 39 ba .:Y.O.......Q.9. 0080 c6 ad a1 ef 7a 2b 20 8b 0b 8b ....z+ ... Frame 19 (138 bytes on wire, 138 bytes captured) Arrival Time: Mar 25, 2004 14:42:45.068634000 Time delta from previous packet: 1.024815000 seconds Time since reference or first frame: 11.614403000 seconds Frame Number: 19 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:0c:29:fc:0c:9f, Dst: 00:50:fc:84:d2:ec Destination: 00:50:fc:84:d2:ec (00:50:fc:84:d2:ec) Source: 00:0c:29:fc:0c:9f (00:0c:29:fc:0c:9f) Type: IP (0x0800) Frame check sequence: 0x429ec0c4 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x00d8 (216) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7bc5 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.116 (165.227.249.116) Encapsulating Security Payload SPI: 0x2c2f23a8 Sequence: 3 Data (92 bytes) 0000 00 50 fc 84 d2 ec 00 0c 29 fc 0c 9f 08 00 45 00 .P......).....E. 0010 00 78 00 d8 00 00 ff 32 7b c5 a5 e3 f9 7a a5 e3 .x.....2{....z.. 0020 f9 74 2c 2f 23 a8 00 00 00 03 4d 88 7a f1 a5 ef .t,/#.....M.z... 0030 b9 54 f0 09 36 1d 6e 1d 24 39 fa 38 37 38 61 e9 .T..6.n.$9.878a. 0040 88 48 fd 89 bc ce 83 6e 42 49 2a 84 4f 49 a0 a2 .H.....nBI*.OI.. 0050 d9 47 af 7a ff 93 50 b9 10 a1 22 c8 a1 1b 64 76 .G.z..P..."...dv 0060 ce bc a7 fd 3b 1f 4b 31 86 8d c2 6d fa 58 92 cd ....;.K1...m.X.. 0070 7d f7 e0 14 e0 13 b1 69 92 c9 3b c8 e4 67 9d d0 }......i..;..g.. 0080 a4 77 fd e4 95 85 42 9e c0 c4 .w....B... Frame 20 (138 bytes on wire, 138 bytes captured) Arrival Time: Mar 25, 2004 14:42:45.068879000 Time delta from previous packet: 0.000245000 seconds Time since reference or first frame: 11.614648000 seconds Frame Number: 20 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:50:fc:84:d2:ec, Dst: 00:00:24:c0:92:d1 Destination: 00:00:24:c0:92:d1 (00:00:24:c0:92:d1) Source: 00:50:fc:84:d2:ec (00:50:fc:84:d2:ec) Type: IP (0x0800) Frame check sequence: 0xd9ea1129 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.116 (165.227.249.116) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x00d8 (216) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 254 Protocol: ESP (0x32) Header checksum: 0x7cc5 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.116 (165.227.249.116) Encapsulating Security Payload SPI: 0x2c2f23a8 Sequence: 3 Data (92 bytes) 0000 00 00 24 c0 92 d1 00 50 fc 84 d2 ec 08 00 45 00 ..$....P......E. 0010 00 78 00 d8 00 00 fe 32 7c c5 a5 e3 f9 7a a5 e3 .x.....2|....z.. 0020 f9 74 2c 2f 23 a8 00 00 00 03 4d 88 7a f1 a5 ef .t,/#.....M.z... 0030 b9 54 f0 09 36 1d 6e 1d 24 39 fa 38 37 38 61 e9 .T..6.n.$9.878a. 0040 88 48 fd 89 bc ce 83 6e 42 49 2a 84 4f 49 a0 a2 .H.....nBI*.OI.. 0050 d9 47 af 7a ff 93 50 b9 10 a1 22 c8 a1 1b 64 76 .G.z..P..."...dv 0060 ce bc a7 fd 3b 1f 4b 31 86 8d c2 6d fa 58 92 cd ....;.K1...m.X.. 0070 7d f7 e0 14 e0 13 b1 69 92 c9 3b c8 e4 67 9d d0 }......i..;..g.. 0080 a4 77 fd e4 95 85 d9 ea 11 29 .w.......) Frame 21 (138 bytes on wire, 138 bytes captured) Arrival Time: Mar 25, 2004 14:42:45.071328000 Time delta from previous packet: 0.002449000 seconds Time since reference or first frame: 11.617097000 seconds Frame Number: 21 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:00:24:c0:92:d1, Dst: 00:0c:29:fc:0c:9f Destination: 00:0c:29:fc:0c:9f (00:0c:29:fc:0c:9f) Source: 00:00:24:c0:92:d1 (00:00:24:c0:92:d1) Type: IP (0x0800) Frame check sequence: 0x13d3275c (correct) Internet Protocol, Src Addr: 165.227.249.116 (165.227.249.116), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0007 (7) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 30 Protocol: ESP (0x32) Header checksum: 0x5d97 (correct) Source: 165.227.249.116 (165.227.249.116) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0xd3143c5e Sequence: 3 Data (92 bytes) 0000 00 0c 29 fc 0c 9f 00 00 24 c0 92 d1 08 00 45 00 ..).....$.....E. 0010 00 78 00 07 00 00 1e 32 5d 97 a5 e3 f9 74 a5 e3 .x.....2]....t.. 0020 f9 7a d3 14 3c 5e 00 00 00 03 cc aa 6a 04 1a 68 .z..<^......j..h 0030 f2 3a 59 cf 4f b4 b1 86 b9 97 ad fb b3 d0 0c 18 .:Y.O........... 0040 1b 97 e7 70 21 a9 0b 61 7a cb 15 b6 3d e1 dc 8c ...p!..az...=... 0050 6e 68 4f f8 ed 68 e5 b1 2c 22 03 7a 95 01 77 99 nhO..h..,".z..w. 0060 a1 80 3f f5 07 60 67 37 56 48 cf 06 53 21 d6 76 ..?..`g7VH..S!.v 0070 46 68 36 7b 3c 0b 7d 71 03 c7 c2 fc 3c cb 82 82 Fh6{<.}q....<... 0080 23 a7 a2 a7 61 c1 13 d3 27 5c #...a...'\ Frame 22 (346 bytes on wire, 346 bytes captured) Arrival Time: Mar 25, 2004 14:42:46.234764000 Time delta from previous packet: 1.163436000 seconds Time since reference or first frame: 12.780533000 seconds Frame Number: 22 Packet Length: 346 bytes Capture Length: 346 bytes Ethernet II, Src: 00:00:24:c0:92:d1, Dst: 00:0c:29:fc:0c:9f Destination: 00:0c:29:fc:0c:9f (00:0c:29:fc:0c:9f) Source: 00:00:24:c0:92:d1 (00:00:24:c0:92:d1) Type: IP (0x0800) Frame check sequence: 0x4c4ced25 (correct) Internet Protocol, Src Addr: 165.227.249.116 (165.227.249.116), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0008 (8) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 30 Protocol: UDP (0x11) Header checksum: 0x5ce7 (correct) Source: 165.227.249.116 (165.227.249.116) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x6e9f (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xF5DFA7292EEAA0CA Responder cookie: 0x57652AAA3D983E50 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x31B91410 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 fc 0c 9f 00 00 24 c0 92 d1 08 00 45 00 ..).....$.....E. 0010 01 48 00 08 00 00 1e 11 5c e7 a5 e3 f9 74 a5 e3 .H......\....t.. 0020 f9 7a 01 f4 01 f4 01 34 6e 9f f5 df a7 29 2e ea .z.....4n....).. 0030 a0 ca 57 65 2a aa 3d 98 3e 50 08 10 20 01 31 b9 ..We*.=.>P.. .1. 0040 14 10 00 00 01 2c 94 7c 72 cf e9 e6 f3 32 28 44 .....,.|r....2(D 0050 a0 e9 cc 90 57 2f ac cb 1f 93 00 d9 44 a3 3d ad ....W/......D.=. 0060 11 0a 59 c1 0a 95 c6 b8 c0 fd c7 90 f6 9b 3b 1d ..Y...........;. 0070 6d 96 97 21 f4 9c 08 c2 ba aa 14 e7 12 a5 ef dc m..!............ 0080 0a eb b1 0d fc c1 6c be 14 7c 7c a7 8a 4f ee 95 ......l..||..O.. 0090 9c 6b 95 37 6d 54 fe 41 65 c3 70 61 cf cd 76 e1 .k.7mT.Ae.pa..v. 00a0 c8 0b 6a 37 76 a8 55 bf e0 1f 02 0c 7e b4 07 ff ..j7v.U.....~... 00b0 28 0d 07 41 93 ab b9 57 0c 9c b6 a8 ca 4c ea 79 (..A...W.....L.y 00c0 49 c3 78 8a 34 cf 6b 8d 41 81 fd 49 3d 46 98 91 I.x.4.k.A..I=F.. 00d0 6a 6e ec f0 66 a2 c7 a7 13 c1 41 1f 97 0a c1 ab jn..f.....A..... 00e0 ee 13 22 4f fc 7b 9c c9 36 5b ff fe e5 12 8c ca .."O.{..6[...... 00f0 0b 91 8f 10 08 db ac 87 53 68 05 3e ec 49 9e 25 ........Sh.>.I.% 0100 7a 6d 64 89 09 27 df 1b 0d 2a 36 97 d0 49 19 05 zmd..'...*6..I.. 0110 fe 51 ba c8 ba c6 b3 2a e4 d4 20 ef e6 ed 3b ff .Q.....*.. ...;. 0120 53 5f 05 41 4f 51 60 17 69 06 fc 70 9b 8b 92 01 S_.AOQ`.i..p.... 0130 af 14 29 a9 ce 08 cd db d2 70 5f 6e c0 1d 7d d1 ..)......p_n..}. 0140 68 50 a0 22 54 94 2d a8 f6 fa 85 2d 28 87 cd 7d hP."T.-....-(..} 0150 15 fe 0c db 2e e8 4c 4c ed 25 ......LL.%