Frame 1 (170 bytes on wire, 170 bytes captured) Arrival Time: Aug 11, 2010 11:08:18.639823000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 170 bytes Capture Length: 170 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 156 Identification: 0x86d8 (34520) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb4b9 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 136 Checksum: 0x1bb2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 128 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: Check Point Next payload: NONE (0) Payload length: 44 Vendor ID: Check Point Check Point Product: VPN-1 Version: NG with Application Intelligence R55 Check Point Vendor ID parameters 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 00 9c 86 d8 00 00 40 11 b4 b9 a5 e3 f9 7a a5 e3 ......@......z.. 0020 f9 7d 01 f4 01 f4 00 88 1b b2 bb 42 71 7a 41 45 .}.........BqzAE 0030 26 32 00 00 00 00 00 00 00 00 01 10 02 00 00 00 &2.............. 0040 00 00 00 00 00 80 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 00 00 ............p... 0080 00 2c f4 ed 19 e0 c1 14 eb 51 6f aa ac 0e e3 7d .,.......Qo....} 0090 af 28 07 b4 38 1f 00 00 00 01 00 00 13 8d 4c 62 .(..8.........Lb 00a0 e6 fb 00 00 00 00 18 00 00 00 .......... Frame 2 (170 bytes on wire, 170 bytes captured) Arrival Time: Aug 11, 2010 11:08:18.639841000 [Time delta from previous captured frame: 0.000018000 seconds] [Time delta from previous displayed frame: 0.000018000 seconds] [Time since reference or first frame: 0.000018000 seconds] Frame Number: 2 Frame Length: 170 bytes Capture Length: 170 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 156 Identification: 0x86d8 (34520) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb4b9 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 136 Checksum: 0x1bb2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 128 Security Association payload Next payload: Vendor ID (13) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: Check Point Next payload: NONE (0) Payload length: 44 Vendor ID: Check Point Check Point Product: VPN-1 Version: NG with Application Intelligence R55 Check Point Vendor ID parameters 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 00 9c 86 d8 00 00 40 11 b4 b9 a5 e3 f9 7a a5 e3 ......@......z.. 0020 f9 7d 01 f4 01 f4 00 88 1b b2 bb 42 71 7a 41 45 .}.........BqzAE 0030 26 32 00 00 00 00 00 00 00 00 01 10 02 00 00 00 &2.............. 0040 00 00 00 00 00 80 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 00 00 ............p... 0080 00 2c f4 ed 19 e0 c1 14 eb 51 6f aa ac 0e e3 7d .,.......Qo....} 0090 af 28 07 b4 38 1f 00 00 00 01 00 00 13 8d 4c 62 .(..8.........Lb 00a0 e6 fb 00 00 00 00 18 00 00 00 .......... Frame 3 (126 bytes on wire, 126 bytes captured) Arrival Time: Aug 11, 2010 11:08:18.644784000 [Time delta from previous captured frame: 0.004943000 seconds] [Time delta from previous displayed frame: 0.004943000 seconds] [Time since reference or first frame: 0.004961000 seconds] Frame Number: 3 Frame Length: 126 bytes Capture Length: 126 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.125 (165.227.249.125), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x033f (831) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x387f [correct] [Good: True] [Bad : False] Source: 165.227.249.125 (165.227.249.125) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0xbaa6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 4C9A83C6E910BD9D Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 84 Security Association payload Next payload: NONE (0) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0c 29 51 89 a7 00 09 5b 2b a8 d7 08 00 45 00 ..)Q....[+....E. 0010 00 70 03 3f 00 00 40 11 38 7f a5 e3 f9 7d a5 e3 .p.?..@.8....}.. 0020 f9 7a 01 f4 01 f4 00 5c ba a6 bb 42 71 7a 41 45 .z.....\...BqzAE 0030 26 32 4c 9a 83 c6 e9 10 bd 9d 01 10 02 00 00 00 &2L............. 0040 00 00 00 00 00 54 00 00 00 38 00 00 00 01 00 00 .....T...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 ............p. Frame 4 (226 bytes on wire, 226 bytes captured) Arrival Time: Aug 11, 2010 11:08:18.645835000 [Time delta from previous captured frame: 0.001051000 seconds] [Time delta from previous displayed frame: 0.001051000 seconds] [Time since reference or first frame: 0.006012000 seconds] Frame Number: 4 Frame Length: 226 bytes Capture Length: 226 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x86d9 (34521) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb480 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x94db [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 4C9A83C6E910BD9D Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 24 Nonce Data 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 00 d4 86 d9 00 00 40 11 b4 80 a5 e3 f9 7a a5 e3 ......@......z.. 0020 f9 7d 01 f4 01 f4 00 c0 94 db bb 42 71 7a 41 45 .}.........BqzAE 0030 26 32 4c 9a 83 c6 e9 10 bd 9d 04 10 02 00 00 00 &2L............. 0040 00 00 00 00 00 b8 0a 00 00 84 7b 30 8c 7c 5c 3f ..........{0.|\? 0050 c6 33 61 e5 ac 72 c1 ef f6 1b fc d1 5b f4 b8 e9 .3a..r......[... 0060 ef 61 51 cf 33 81 d2 35 22 f7 56 4d 73 93 51 77 .aQ.3..5".VMs.Qw 0070 fb de e5 08 d3 dd bf 3b 30 63 18 1c 47 08 b5 eb .......;0c..G... 0080 75 24 04 9e 1f dc 85 67 8e 0b ec 6a 2b 13 70 84 u$.....g...j+.p. 0090 7c 1f ac 66 2c bc e7 f6 7e 5c 3e b2 6b fa 92 ee |..f,...~\>.k... 00a0 43 30 0b 4a ad 9a 38 e7 67 f5 e7 3f e7 ae 29 a2 C0.J..8.g..?..). 00b0 76 0c b6 b1 97 64 c4 ff 5a d3 5d 82 b8 27 6b 18 v....d..Z.]..'k. 00c0 e7 57 3b 14 8a d4 f9 cf d0 fd 00 00 00 18 aa 1c .W;............. 00d0 19 bc ba 67 fe 0f 65 dc c0 8f 45 0a 7d 77 bb 34 ...g..e...E.}w.4 00e0 08 61 .a Frame 5 (226 bytes on wire, 226 bytes captured) Arrival Time: Aug 11, 2010 11:08:18.645850000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 0.006027000 seconds] Frame Number: 5 Frame Length: 226 bytes Capture Length: 226 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x86d9 (34521) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb480 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x94db [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 4C9A83C6E910BD9D Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 24 Nonce Data 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 00 d4 86 d9 00 00 40 11 b4 80 a5 e3 f9 7a a5 e3 ......@......z.. 0020 f9 7d 01 f4 01 f4 00 c0 94 db bb 42 71 7a 41 45 .}.........BqzAE 0030 26 32 4c 9a 83 c6 e9 10 bd 9d 04 10 02 00 00 00 &2L............. 0040 00 00 00 00 00 b8 0a 00 00 84 7b 30 8c 7c 5c 3f ..........{0.|\? 0050 c6 33 61 e5 ac 72 c1 ef f6 1b fc d1 5b f4 b8 e9 .3a..r......[... 0060 ef 61 51 cf 33 81 d2 35 22 f7 56 4d 73 93 51 77 .aQ.3..5".VMs.Qw 0070 fb de e5 08 d3 dd bf 3b 30 63 18 1c 47 08 b5 eb .......;0c..G... 0080 75 24 04 9e 1f dc 85 67 8e 0b ec 6a 2b 13 70 84 u$.....g...j+.p. 0090 7c 1f ac 66 2c bc e7 f6 7e 5c 3e b2 6b fa 92 ee |..f,...~\>.k... 00a0 43 30 0b 4a ad 9a 38 e7 67 f5 e7 3f e7 ae 29 a2 C0.J..8.g..?..). 00b0 76 0c b6 b1 97 64 c4 ff 5a d3 5d 82 b8 27 6b 18 v....d..Z.]..'k. 00c0 e7 57 3b 14 8a d4 f9 cf d0 fd 00 00 00 18 aa 1c .W;............. 00d0 19 bc ba 67 fe 0f 65 dc c0 8f 45 0a 7d 77 bb 34 ...g..e...E.}w.4 00e0 08 61 .a Frame 6 (214 bytes on wire, 214 bytes captured) Arrival Time: Aug 11, 2010 11:08:19.049990000 [Time delta from previous captured frame: 0.404140000 seconds] [Time delta from previous displayed frame: 0.404140000 seconds] [Time since reference or first frame: 0.410167000 seconds] Frame Number: 6 Frame Length: 214 bytes Capture Length: 214 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.125 (165.227.249.125), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 200 Identification: 0x0340 (832) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3826 [correct] [Good: True] [Bad : False] Source: 165.227.249.125 (165.227.249.125) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 180 Checksum: 0xdee4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 4C9A83C6E910BD9D Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 172 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 12 Nonce Data 0000 00 0c 29 51 89 a7 00 09 5b 2b a8 d7 08 00 45 00 ..)Q....[+....E. 0010 00 c8 03 40 00 00 40 11 38 26 a5 e3 f9 7d a5 e3 ...@..@.8&...}.. 0020 f9 7a 01 f4 01 f4 00 b4 de e4 bb 42 71 7a 41 45 .z.........BqzAE 0030 26 32 4c 9a 83 c6 e9 10 bd 9d 04 10 02 00 00 00 &2L............. 0040 00 00 00 00 00 ac 0a 00 00 84 82 c4 ac 77 40 70 .............w@p 0050 67 2f 5c 69 e1 26 69 e5 09 06 1c 0e 51 0b 60 e0 g/\i.&i.....Q.`. 0060 57 6e 61 b5 7d a8 0b 96 d7 41 a5 00 40 63 f9 75 Wna.}....A..@c.u 0070 78 61 88 a3 dd 41 f6 11 8e d8 59 a9 36 9f cc 69 xa...A....Y.6..i 0080 ef 1f 91 2a 34 cb 44 25 ef 3d 34 8a 7b c8 d7 58 ...*4.D%.=4.{..X 0090 dc 07 aa fa 4f 96 8b 5f b9 04 72 21 0d 05 57 2d ....O.._..r!..W- 00a0 9a 3a 4e 1a a5 7b da a6 85 df 6d 90 87 a9 91 6e .:N..{....m....n 00b0 44 fe e0 81 eb ce 9e f1 37 e5 1f 63 8e 70 12 a9 D.......7..c.p.. 00c0 82 62 f7 83 20 61 1e b0 49 a7 00 00 00 0c f9 24 .b.. a..I......$ 00d0 00 32 3d 5c fa 4c .2=\.L Frame 7 (110 bytes on wire, 110 bytes captured) Arrival Time: Aug 11, 2010 11:08:19.059387000 [Time delta from previous captured frame: 0.009397000 seconds] [Time delta from previous displayed frame: 0.009397000 seconds] [Time since reference or first frame: 0.419564000 seconds] Frame Number: 7 Frame Length: 110 bytes Capture Length: 110 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x86da (34522) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb4f3 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x6e56 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 4C9A83C6E910BD9D Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 00 60 86 da 00 00 40 11 b4 f3 a5 e3 f9 7a a5 e3 .`....@......z.. 0020 f9 7d 01 f4 01 f4 00 4c 6e 56 bb 42 71 7a 41 45 .}.....LnV.BqzAE 0030 26 32 4c 9a 83 c6 e9 10 bd 9d 05 10 02 01 00 00 &2L............. 0040 00 00 00 00 00 44 ae 5a c6 e2 2e ae 0c f3 da 75 .....D.Z.......u 0050 e6 d2 9b ea e1 3a dd 75 d0 4d 04 35 2a 28 6a 55 .....:.u.M.5*(jU 0060 d2 6b b6 7c 20 4d 32 d0 63 56 ce ed f7 b1 .k.| M2.cV.... Frame 8 (110 bytes on wire, 110 bytes captured) Arrival Time: Aug 11, 2010 11:08:19.059404000 [Time delta from previous captured frame: 0.000017000 seconds] [Time delta from previous displayed frame: 0.000017000 seconds] [Time since reference or first frame: 0.419581000 seconds] Frame Number: 8 Frame Length: 110 bytes Capture Length: 110 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x86da (34522) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb4f3 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x6e56 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 4C9A83C6E910BD9D Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 00 60 86 da 00 00 40 11 b4 f3 a5 e3 f9 7a a5 e3 .`....@......z.. 0020 f9 7d 01 f4 01 f4 00 4c 6e 56 bb 42 71 7a 41 45 .}.....LnV.BqzAE 0030 26 32 4c 9a 83 c6 e9 10 bd 9d 05 10 02 01 00 00 &2L............. 0040 00 00 00 00 00 44 ae 5a c6 e2 2e ae 0c f3 da 75 .....D.Z.......u 0050 e6 d2 9b ea e1 3a dd 75 d0 4d 04 35 2a 28 6a 55 .....:.u.M.5*(jU 0060 d2 6b b6 7c 20 4d 32 d0 63 56 ce ed f7 b1 .k.| M2.cV.... Frame 9 (110 bytes on wire, 110 bytes captured) Arrival Time: Aug 11, 2010 11:08:19.555338000 [Time delta from previous captured frame: 0.495934000 seconds] [Time delta from previous displayed frame: 0.495934000 seconds] [Time since reference or first frame: 0.915515000 seconds] Frame Number: 9 Frame Length: 110 bytes Capture Length: 110 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.125 (165.227.249.125), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0341 (833) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x388d [correct] [Good: True] [Bad : False] Source: 165.227.249.125 (165.227.249.125) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x5935 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 4C9A83C6E910BD9D Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 51 89 a7 00 09 5b 2b a8 d7 08 00 45 00 ..)Q....[+....E. 0010 00 60 03 41 00 00 40 11 38 8d a5 e3 f9 7d a5 e3 .`.A..@.8....}.. 0020 f9 7a 01 f4 01 f4 00 4c 59 35 bb 42 71 7a 41 45 .z.....LY5.BqzAE 0030 26 32 4c 9a 83 c6 e9 10 bd 9d 05 10 02 01 00 00 &2L............. 0040 00 00 00 00 00 44 f3 4a c7 26 83 d8 f9 2a af 91 .....D.J.&...*.. 0050 b2 5f 93 84 14 06 e8 54 ed 46 1d 66 1c 7d 44 1d ._.....T.F.f.}D. 0060 3f 2c d0 b1 24 19 32 42 a6 1c aa d9 05 23 ?,..$.2B.....# Frame 10 (342 bytes on wire, 342 bytes captured) Arrival Time: Aug 11, 2010 11:08:19.557592000 [Time delta from previous captured frame: 0.002254000 seconds] [Time delta from previous displayed frame: 0.002254000 seconds] [Time since reference or first frame: 0.917769000 seconds] Frame Number: 10 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x86db (34523) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb40a [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xf050 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 4C9A83C6E910BD9D Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x5c88ec72 Length: 300 Encrypted payload (272 bytes) 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 01 48 86 db 00 00 40 11 b4 0a a5 e3 f9 7a a5 e3 .H....@......z.. 0020 f9 7d 01 f4 01 f4 01 34 f0 50 bb 42 71 7a 41 45 .}.....4.P.BqzAE 0030 26 32 4c 9a 83 c6 e9 10 bd 9d 08 10 20 01 5c 88 &2L......... .\. 0040 ec 72 00 00 01 2c db 77 e9 7a 6a d6 ca cb 3f 19 .r...,.w.zj...?. 0050 19 e0 84 ee 30 d5 a9 76 03 36 33 a6 66 1f 41 60 ....0..v.63.f.A` 0060 f2 02 3d d8 1a 3a 9a 5e d6 72 23 47 ae 2f b3 4d ..=..:.^.r#G./.M 0070 d5 5d cb 30 70 84 8d c7 59 3b 54 5e 50 c4 6b ec .].0p...Y;T^P.k. 0080 e3 95 85 b8 73 18 27 70 01 ae 12 15 04 95 2f dd ....s.'p....../. 0090 d8 da 3a 88 82 37 9a 8a c1 67 f5 bd 88 64 0a 3c ..:..7...g...d.< 00a0 5b a4 76 e8 05 30 20 19 a4 7a 27 f5 df 76 fb 38 [.v..0 ..z'..v.8 00b0 ee b0 9f 6e 0e f9 11 36 8d c4 e3 3c 8e 16 9f 1a ...n...6...<.... 00c0 fe 58 24 d7 08 85 b6 c8 1a 75 c3 66 c5 5e fe 9c .X$......u.f.^.. 00d0 e1 4b 6e 5c c0 2a 7a 1c b3 5f b8 74 1f 4c 2b 7f .Kn\.*z.._.t.L+. 00e0 eb 9c be 19 52 14 ba 1b 34 b0 b1 1d 73 cc b9 27 ....R...4...s..' 00f0 7d 06 0e da c5 f5 2e b2 9b b3 d2 c4 97 44 ae e9 }............D.. 0100 85 7e f8 42 5b 83 d9 30 a3 72 9a a1 15 46 23 be .~.B[..0.r...F#. 0110 b3 dd 02 f6 02 49 1e 4a e6 a2 db 12 1f e2 18 f8 .....I.J........ 0120 23 5a 3b 6a 36 44 65 05 13 ed 5c 45 f6 83 84 22 #Z;j6De...\E..." 0130 40 d0 85 29 ab 42 62 dd 01 39 e3 af 4f 06 e4 dc @..).Bb..9..O... 0140 2a 74 56 a8 f9 84 00 ef 9e fa 15 9f 75 1d ee 3a *tV.........u..: 0150 fd 9d eb 7c b5 01 ...|.. Frame 11 (342 bytes on wire, 342 bytes captured) Arrival Time: Aug 11, 2010 11:08:19.557614000 [Time delta from previous captured frame: 0.000022000 seconds] [Time delta from previous displayed frame: 0.000022000 seconds] [Time since reference or first frame: 0.917791000 seconds] Frame Number: 11 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x86db (34523) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb40a [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xf050 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 4C9A83C6E910BD9D Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x5c88ec72 Length: 300 Encrypted payload (272 bytes) 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 01 48 86 db 00 00 40 11 b4 0a a5 e3 f9 7a a5 e3 .H....@......z.. 0020 f9 7d 01 f4 01 f4 01 34 f0 50 bb 42 71 7a 41 45 .}.....4.P.BqzAE 0030 26 32 4c 9a 83 c6 e9 10 bd 9d 08 10 20 01 5c 88 &2L......... .\. 0040 ec 72 00 00 01 2c db 77 e9 7a 6a d6 ca cb 3f 19 .r...,.w.zj...?. 0050 19 e0 84 ee 30 d5 a9 76 03 36 33 a6 66 1f 41 60 ....0..v.63.f.A` 0060 f2 02 3d d8 1a 3a 9a 5e d6 72 23 47 ae 2f b3 4d ..=..:.^.r#G./.M 0070 d5 5d cb 30 70 84 8d c7 59 3b 54 5e 50 c4 6b ec .].0p...Y;T^P.k. 0080 e3 95 85 b8 73 18 27 70 01 ae 12 15 04 95 2f dd ....s.'p....../. 0090 d8 da 3a 88 82 37 9a 8a c1 67 f5 bd 88 64 0a 3c ..:..7...g...d.< 00a0 5b a4 76 e8 05 30 20 19 a4 7a 27 f5 df 76 fb 38 [.v..0 ..z'..v.8 00b0 ee b0 9f 6e 0e f9 11 36 8d c4 e3 3c 8e 16 9f 1a ...n...6...<.... 00c0 fe 58 24 d7 08 85 b6 c8 1a 75 c3 66 c5 5e fe 9c .X$......u.f.^.. 00d0 e1 4b 6e 5c c0 2a 7a 1c b3 5f b8 74 1f 4c 2b 7f .Kn\.*z.._.t.L+. 00e0 eb 9c be 19 52 14 ba 1b 34 b0 b1 1d 73 cc b9 27 ....R...4...s..' 00f0 7d 06 0e da c5 f5 2e b2 9b b3 d2 c4 97 44 ae e9 }............D.. 0100 85 7e f8 42 5b 83 d9 30 a3 72 9a a1 15 46 23 be .~.B[..0.r...F#. 0110 b3 dd 02 f6 02 49 1e 4a e6 a2 db 12 1f e2 18 f8 .....I.J........ 0120 23 5a 3b 6a 36 44 65 05 13 ed 5c 45 f6 83 84 22 #Z;j6De...\E..." 0130 40 d0 85 29 ab 42 62 dd 01 39 e3 af 4f 06 e4 dc @..).Bb..9..O... 0140 2a 74 56 a8 f9 84 00 ef 9e fa 15 9f 75 1d ee 3a *tV.........u..: 0150 fd 9d eb 7c b5 01 ...|.. Frame 12 (326 bytes on wire, 326 bytes captured) Arrival Time: Aug 11, 2010 11:08:19.965753000 [Time delta from previous captured frame: 0.408139000 seconds] [Time delta from previous displayed frame: 0.408139000 seconds] [Time since reference or first frame: 1.325930000 seconds] Frame Number: 12 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.125 (165.227.249.125), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0342 (834) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x37b4 [correct] [Good: True] [Bad : False] Source: 165.227.249.125 (165.227.249.125) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x09cf [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 4C9A83C6E910BD9D Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x5c88ec72 Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 51 89 a7 00 09 5b 2b a8 d7 08 00 45 00 ..)Q....[+....E. 0010 01 38 03 42 00 00 40 11 37 b4 a5 e3 f9 7d a5 e3 .8.B..@.7....}.. 0020 f9 7a 01 f4 01 f4 01 24 09 cf bb 42 71 7a 41 45 .z.....$...BqzAE 0030 26 32 4c 9a 83 c6 e9 10 bd 9d 08 10 20 01 5c 88 &2L......... .\. 0040 ec 72 00 00 01 1c 7a d5 99 72 3c 05 95 9b 60 2c .r....z..r<...`, 0050 1d 60 af ac 82 df ae ff c4 6a ad 46 8b 2e fd b1 .`.......j.F.... 0060 8b 9e d0 42 8c dd 35 f0 c7 2a 03 5c 1d 8a 7a 38 ...B..5..*.\..z8 0070 e5 8a fa b0 15 37 3e dd 90 24 8e 4f c3 79 08 16 .....7>..$.O.y.. 0080 9b 55 f9 15 41 be f8 49 98 6e 03 65 2f 51 31 7c .U..A..I.n.e/Q1| 0090 6b 80 b7 cc 1b 94 37 d1 9d ef fc ad 44 3f d2 df k.....7.....D?.. 00a0 fc 3d 94 89 b5 3e bd 2a 18 d2 af 7b 25 1a 77 ff .=...>.*...{%.w. 00b0 05 0f eb b4 01 ec 14 e6 88 4f 6c 99 2f db 0d 8d .........Ol./... 00c0 25 48 74 6a 27 b9 25 34 91 4d 4c 8c f6 4f dd c8 %Htj'.%4.ML..O.. 00d0 42 6c c1 16 1d da 89 34 89 a8 65 d5 d8 a3 6a ac Bl.....4..e...j. 00e0 da e7 8e c7 ca 1d 46 20 65 78 4d e4 a9 35 82 70 ......F exM..5.p 00f0 2d a6 c2 26 1e cc c4 77 55 64 b1 0a a6 49 86 96 -..&...wUd...I.. 0100 17 f2 cf a8 5a 44 5c a0 26 52 d5 e9 83 79 1f 16 ....ZD\.&R...y.. 0110 4e fd 7f ed d9 17 7e 5e 55 72 ea d6 87 5b 19 62 N.....~^Ur...[.b 0120 b2 9d dc 6c bd bd 5e 55 6a 84 00 4e 46 ee 63 52 ...l..^Uj..NF.cR 0130 c5 7c 9e 88 c3 f9 8e 58 45 8b 8c 43 f6 c5 37 de .|.....XE..C..7. 0140 e7 7e 35 04 11 6b .~5..k Frame 13 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 11, 2010 11:08:19.970221000 [Time delta from previous captured frame: 0.004468000 seconds] [Time delta from previous displayed frame: 0.004468000 seconds] [Time since reference or first frame: 1.330398000 seconds] Frame Number: 13 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x86dc (34524) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb4f9 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x859b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 4C9A83C6E910BD9D Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x5c88ec72 Length: 60 Encrypted payload (32 bytes) 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 00 58 86 dc 00 00 40 11 b4 f9 a5 e3 f9 7a a5 e3 .X....@......z.. 0020 f9 7d 01 f4 01 f4 00 44 85 9b bb 42 71 7a 41 45 .}.....D...BqzAE 0030 26 32 4c 9a 83 c6 e9 10 bd 9d 08 10 20 01 5c 88 &2L......... .\. 0040 ec 72 00 00 00 3c 3c 8b 46 8c dc 74 0d e4 79 f5 .r...<<.F..t..y. 0050 b9 4d 98 b0 23 d5 22 13 91 4f 53 25 96 f7 46 61 .M..#."..OS%..Fa 0060 c9 b8 a1 1d 0e a6 ...... Frame 14 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 11, 2010 11:08:19.970240000 [Time delta from previous captured frame: 0.000019000 seconds] [Time delta from previous displayed frame: 0.000019000 seconds] [Time since reference or first frame: 1.330417000 seconds] Frame Number: 14 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x86dc (34524) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb4f9 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x859b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 4C9A83C6E910BD9D Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x5c88ec72 Length: 60 Encrypted payload (32 bytes) 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 00 58 86 dc 00 00 40 11 b4 f9 a5 e3 f9 7a a5 e3 .X....@......z.. 0020 f9 7d 01 f4 01 f4 00 44 85 9b bb 42 71 7a 41 45 .}.....D...BqzAE 0030 26 32 4c 9a 83 c6 e9 10 bd 9d 08 10 20 01 5c 88 &2L......... .\. 0040 ec 72 00 00 00 3c 3c 8b 46 8c dc 74 0d e4 79 f5 .r...<<.F..t..y. 0050 b9 4d 98 b0 23 d5 22 13 91 4f 53 25 96 f7 46 61 .M..#."..OS%..Fa 0060 c9 b8 a1 1d 0e a6 ...... Frame 15 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 11, 2010 11:08:20.071063000 [Time delta from previous captured frame: 0.100823000 seconds] [Time delta from previous displayed frame: 0.100823000 seconds] [Time since reference or first frame: 1.431240000 seconds] Frame Number: 15 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x86dd (34525) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb4f8 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x859b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 4C9A83C6E910BD9D Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x5c88ec72 Length: 60 Encrypted payload (32 bytes) 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 00 58 86 dd 00 00 40 11 b4 f8 a5 e3 f9 7a a5 e3 .X....@......z.. 0020 f9 7d 01 f4 01 f4 00 44 85 9b bb 42 71 7a 41 45 .}.....D...BqzAE 0030 26 32 4c 9a 83 c6 e9 10 bd 9d 08 10 20 01 5c 88 &2L......... .\. 0040 ec 72 00 00 00 3c 3c 8b 46 8c dc 74 0d e4 79 f5 .r...<<.F..t..y. 0050 b9 4d 98 b0 23 d5 22 13 91 4f 53 25 96 f7 46 61 .M..#."..OS%..Fa 0060 c9 b8 a1 1d 0e a6 ...... Frame 16 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 11, 2010 11:08:20.071082000 [Time delta from previous captured frame: 0.000019000 seconds] [Time delta from previous displayed frame: 0.000019000 seconds] [Time since reference or first frame: 1.431259000 seconds] Frame Number: 16 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x86dd (34525) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb4f8 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x859b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 4C9A83C6E910BD9D Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x5c88ec72 Length: 60 Encrypted payload (32 bytes) 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 00 58 86 dd 00 00 40 11 b4 f8 a5 e3 f9 7a a5 e3 .X....@......z.. 0020 f9 7d 01 f4 01 f4 00 44 85 9b bb 42 71 7a 41 45 .}.....D...BqzAE 0030 26 32 4c 9a 83 c6 e9 10 bd 9d 08 10 20 01 5c 88 &2L......... .\. 0040 ec 72 00 00 00 3c 3c 8b 46 8c dc 74 0d e4 79 f5 .r...<<.F..t..y. 0050 b9 4d 98 b0 23 d5 22 13 91 4f 53 25 96 f7 46 61 .M..#."..OS%..Fa 0060 c9 b8 a1 1d 0e a6 ...... Frame 17 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 11, 2010 11:08:20.171340000 [Time delta from previous captured frame: 0.100258000 seconds] [Time delta from previous displayed frame: 0.100258000 seconds] [Time since reference or first frame: 1.531517000 seconds] Frame Number: 17 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x86de (34526) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb4f7 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x859b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 4C9A83C6E910BD9D Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x5c88ec72 Length: 60 Encrypted payload (32 bytes) 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 00 58 86 de 00 00 40 11 b4 f7 a5 e3 f9 7a a5 e3 .X....@......z.. 0020 f9 7d 01 f4 01 f4 00 44 85 9b bb 42 71 7a 41 45 .}.....D...BqzAE 0030 26 32 4c 9a 83 c6 e9 10 bd 9d 08 10 20 01 5c 88 &2L......... .\. 0040 ec 72 00 00 00 3c 3c 8b 46 8c dc 74 0d e4 79 f5 .r...<<.F..t..y. 0050 b9 4d 98 b0 23 d5 22 13 91 4f 53 25 96 f7 46 61 .M..#."..OS%..Fa 0060 c9 b8 a1 1d 0e a6 ...... Frame 18 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 11, 2010 11:08:20.171359000 [Time delta from previous captured frame: 0.000019000 seconds] [Time delta from previous displayed frame: 0.000019000 seconds] [Time since reference or first frame: 1.531536000 seconds] Frame Number: 18 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x86de (34526) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb4f7 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x859b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: BB42717A41452632 Responder cookie: 4C9A83C6E910BD9D Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x5c88ec72 Length: 60 Encrypted payload (32 bytes) 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 00 58 86 de 00 00 40 11 b4 f7 a5 e3 f9 7a a5 e3 .X....@......z.. 0020 f9 7d 01 f4 01 f4 00 44 85 9b bb 42 71 7a 41 45 .}.....D...BqzAE 0030 26 32 4c 9a 83 c6 e9 10 bd 9d 08 10 20 01 5c 88 &2L......... .\. 0040 ec 72 00 00 00 3c 3c 8b 46 8c dc 74 0d e4 79 f5 .r...<<.F..t..y. 0050 b9 4d 98 b0 23 d5 22 13 91 4f 53 25 96 f7 46 61 .M..#."..OS%..Fa 0060 c9 b8 a1 1d 0e a6 ...... Frame 19 (126 bytes on wire, 126 bytes captured) Arrival Time: Aug 11, 2010 11:08:20.271547000 [Time delta from previous captured frame: 0.100188000 seconds] [Time delta from previous displayed frame: 0.100188000 seconds] [Time since reference or first frame: 1.631724000 seconds] Frame Number: 19 Frame Length: 126 bytes Capture Length: 126 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0020 (32) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7c7c [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) Encapsulating Security Payload ESP SPI: 0xdec0dfb8 ESP Sequence: 1 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 00 70 00 20 00 00 ff 32 7c 7c a5 e3 f9 7a a5 e3 .p. ...2||...z.. 0020 f9 7d de c0 df b8 00 00 00 01 10 74 26 41 af 0a .}.........t&A.. 0030 97 37 16 fb d5 39 a8 4d 97 2e 57 10 82 7a 15 bc .7...9.M..W..z.. 0040 5d 3a b9 02 5b 0b 01 c4 6f 6d 7b 47 8a b4 7c 71 ]:..[...om{G..|q 0050 ea 68 df 93 b1 db 8f 98 2d 13 0a 49 03 23 d8 a6 .h......-..I.#.. 0060 af df c4 4d 63 b2 ae ca 94 89 4f 6b fc 11 ff ab ...Mc.....Ok.... 0070 d6 67 24 df 24 ec c4 52 ae 32 3a e1 84 02 .g$.$..R.2:... Frame 20 (126 bytes on wire, 126 bytes captured) Arrival Time: Aug 11, 2010 11:08:20.271567000 [Time delta from previous captured frame: 0.000020000 seconds] [Time delta from previous displayed frame: 0.000020000 seconds] [Time since reference or first frame: 1.631744000 seconds] Frame Number: 20 Frame Length: 126 bytes Capture Length: 126 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0020 (32) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7c7c [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) Encapsulating Security Payload ESP SPI: 0xdec0dfb8 ESP Sequence: 1 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 00 70 00 20 00 00 ff 32 7c 7c a5 e3 f9 7a a5 e3 .p. ...2||...z.. 0020 f9 7d de c0 df b8 00 00 00 01 10 74 26 41 af 0a .}.........t&A.. 0030 97 37 16 fb d5 39 a8 4d 97 2e 57 10 82 7a 15 bc .7...9.M..W..z.. 0040 5d 3a b9 02 5b 0b 01 c4 6f 6d 7b 47 8a b4 7c 71 ]:..[...om{G..|q 0050 ea 68 df 93 b1 db 8f 98 2d 13 0a 49 03 23 d8 a6 .h......-..I.#.. 0060 af df c4 4d 63 b2 ae ca 94 89 4f 6b fc 11 ff ab ...Mc.....Ok.... 0070 d6 67 24 df 24 ec c4 52 ae 32 3a e1 84 02 .g$.$..R.2:... Frame 21 (126 bytes on wire, 126 bytes captured) Arrival Time: Aug 11, 2010 11:08:20.471404000 [Time delta from previous captured frame: 0.199837000 seconds] [Time delta from previous displayed frame: 0.199837000 seconds] [Time since reference or first frame: 1.831581000 seconds] Frame Number: 21 Frame Length: 126 bytes Capture Length: 126 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.125 (165.227.249.125), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0e03 (3587) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 30 Protocol: ESP (0x32) Header checksum: 0x4f9a [correct] [Good: True] [Bad : False] Source: 165.227.249.125 (165.227.249.125) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload ESP SPI: 0xc19f2d9c ESP Sequence: 1 0000 00 0c 29 51 89 a7 00 09 5b 2b a8 d7 08 00 45 00 ..)Q....[+....E. 0010 00 70 0e 03 00 00 1e 32 4f 9a a5 e3 f9 7d a5 e3 .p.....2O....}.. 0020 f9 7a c1 9f 2d 9c 00 00 00 01 e7 5f 2b 5f d9 9e .z..-......_+_.. 0030 f6 22 c0 44 52 ce 52 4d 0b a7 23 ab 34 36 8b 70 .".DR.RM..#.46.p 0040 fd dd 95 dc 1d c8 9e 92 d8 b0 6d 00 bb c1 9e ce ..........m..... 0050 a4 12 81 4a 05 b9 4d 2b e2 82 a5 fa 12 da ba 1a ...J..M+........ 0060 9f 0e cf f1 90 af 7b aa d1 a7 f6 80 3b 16 ad a0 ......{.....;... 0070 f5 eb e3 a7 29 1d c5 20 73 d2 7d 06 d9 5c ....).. s.}..\ Frame 22 (126 bytes on wire, 126 bytes captured) Arrival Time: Aug 11, 2010 11:08:20.475542000 [Time delta from previous captured frame: 0.004138000 seconds] [Time delta from previous displayed frame: 0.004138000 seconds] [Time since reference or first frame: 1.835719000 seconds] Frame Number: 22 Frame Length: 126 bytes Capture Length: 126 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0021 (33) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7c7b [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) Encapsulating Security Payload ESP SPI: 0xdec0dfb8 ESP Sequence: 2 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 00 70 00 21 00 00 ff 32 7c 7b a5 e3 f9 7a a5 e3 .p.!...2|{...z.. 0020 f9 7d de c0 df b8 00 00 00 02 a6 17 b7 02 93 06 .}.............. 0030 95 ea f7 4c b1 42 2f 93 14 a8 20 1a da 77 de 4e ...L.B/... ..w.N 0040 d1 a2 88 32 55 36 ee cb 3a cb 9d a8 06 f8 f6 79 ...2U6..:......y 0050 e6 64 04 10 4c de 5d dc 6d 91 64 cd 75 f2 95 88 .d..L.].m.d.u... 0060 1d 8f 92 9c 90 62 7c d7 60 ea 1d 7c 39 3c a7 ef .....b|.`..|9<.. 0070 14 1c d5 f3 17 22 b8 a9 13 b0 38 e5 fa 2a ....."....8..* Frame 23 (126 bytes on wire, 126 bytes captured) Arrival Time: Aug 11, 2010 11:08:20.475559000 [Time delta from previous captured frame: 0.000017000 seconds] [Time delta from previous displayed frame: 0.000017000 seconds] [Time since reference or first frame: 1.835736000 seconds] Frame Number: 23 Frame Length: 126 bytes Capture Length: 126 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0021 (33) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7c7b [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.125 (165.227.249.125) Encapsulating Security Payload ESP SPI: 0xdec0dfb8 ESP Sequence: 2 0000 00 09 5b 2b a8 d7 00 0c 29 51 89 a7 08 00 45 00 ..[+....)Q....E. 0010 00 70 00 21 00 00 ff 32 7c 7b a5 e3 f9 7a a5 e3 .p.!...2|{...z.. 0020 f9 7d de c0 df b8 00 00 00 02 a6 17 b7 02 93 06 .}.............. 0030 95 ea f7 4c b1 42 2f 93 14 a8 20 1a da 77 de 4e ...L.B/... ..w.N 0040 d1 a2 88 32 55 36 ee cb 3a cb 9d a8 06 f8 f6 79 ...2U6..:......y 0050 e6 64 04 10 4c de 5d dc 6d 91 64 cd 75 f2 95 88 .d..L.].m.d.u... 0060 1d 8f 92 9c 90 62 7c d7 60 ea 1d 7c 39 3c a7 ef .....b|.`..|9<.. 0070 14 1c d5 f3 17 22 b8 a9 13 b0 38 e5 fa 2a ....."....8..* Frame 24 (126 bytes on wire, 126 bytes captured) Arrival Time: Aug 11, 2010 11:08:20.477863000 [Time delta from previous captured frame: 0.002304000 seconds] [Time delta from previous displayed frame: 0.002304000 seconds] [Time since reference or first frame: 1.838040000 seconds] Frame Number: 24 Frame Length: 126 bytes Capture Length: 126 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.125 (165.227.249.125), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0xe44c (58444) Flags: 0x00 0.. = Reserved bit: Not Set .0. = Don't fragment: Not Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 30 Protocol: ESP (0x32) Header checksum: 0x7950 [correct] [Good: True] [Bad : False] Source: 165.227.249.125 (165.227.249.125) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload ESP SPI: 0xc19f2d9c ESP Sequence: 2 0000 00 0c 29 51 89 a7 00 09 5b 2b a8 d7 08 00 45 00 ..)Q....[+....E. 0010 00 70 e4 4c 00 00 1e 32 79 50 a5 e3 f9 7d a5 e3 .p.L...2yP...}.. 0020 f9 7a c1 9f 2d 9c 00 00 00 02 f6 80 3b 16 ad a0 .z..-.......;... 0030 f5 eb cd d1 1e 3c 35 ad 21 63 c3 a2 8f ce 52 fb .....<5.!c....R. 0040 19 c0 eb 98 ef f7 25 d9 40 eb bb 3e fc 3d ff a7 ......%.@..>.=.. 0050 77 11 64 b4 f1 78 1c 1b 26 33 ae 9c f5 57 6b c0 w.d..x..&3...Wk. 0060 12 65 9a 0c c8 54 2a 5a 35 f8 25 9b 74 59 7d f6 .e...T*Z5.%.tY}. 0070 3d b2 7b 06 f3 b6 6e 50 5b 40 ee be f9 a3 =.{...nP[@....