Frame 1 (170 bytes on wire, 170 bytes captured) Arrival Time: Sep 20, 2007 14:57:49.089411000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 170 bytes Capture Length: 170 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Destination: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.131 (165.227.249.131) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 156 Identification: 0x0080 (128) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb0b [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.131 (165.227.249.131) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 136 Checksum: 0xee0b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3123E426BF8C16F5 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 128 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 44 Vendor ID: Check Point Check Point Product: VPN-1 Version: NG with Application Intelligence R55 Check Point Vendor ID parameters 0000 00 1b 2f 37 c7 b9 00 0c 29 51 89 a7 08 00 45 00 ../7....)Q....E. 0010 00 9c 00 80 40 00 40 11 fb 0b a5 e3 f9 7a a5 e3 ....@.@......z.. 0020 f9 83 01 f4 01 f4 00 88 ee 0b 31 23 e4 26 bf 8c ..........1#.&.. 0030 16 f5 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 80 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 00 00 ............p... 0080 00 2c f4 ed 19 e0 c1 14 eb 51 6f aa ac 0e e3 7d .,.......Qo....} 0090 af 28 07 b4 38 1f 00 00 00 01 00 00 13 8d 46 92 .(..8.........F. 00a0 c2 d4 00 00 00 00 18 00 00 00 .......... Frame 2 (146 bytes on wire, 146 bytes captured) Arrival Time: Sep 20, 2007 14:57:49.363132000 Time delta from previous packet: 0.273721000 seconds Time since reference or first frame: 0.273721000 seconds Frame Number: 2 Packet Length: 146 bytes Capture Length: 146 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Source: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.131 (165.227.249.131), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba3 [correct] Good: True Bad : False Source: 165.227.249.131 (165.227.249.131) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0x622d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3123E426BF8C16F5 Responder cookie: 0x971CD80150DA4E7E Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 51 89 a7 00 1b 2f 37 c7 b9 08 00 45 00 ..)Q..../7....E. 0010 00 84 00 00 40 00 40 11 fb a3 a5 e3 f9 83 a5 e3 ....@.@......... 0020 f9 7a 01 f4 01 f4 00 70 62 2d 31 23 e4 26 bf 8c .z.....pb-1#.&.. 0030 16 f5 97 1c d8 01 50 da 4e 7e 01 10 02 00 00 00 ......P.N~...... 0040 00 00 00 00 00 68 0d 00 00 38 00 00 00 01 00 00 .....h...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 00 00 ............p... 0080 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 0090 01 00 .. Frame 3 (226 bytes on wire, 226 bytes captured) Arrival Time: Sep 20, 2007 14:57:49.363134000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.273723000 seconds Frame Number: 3 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Destination: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.131 (165.227.249.131) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x0081 (129) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfad2 [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.131 (165.227.249.131) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x2099 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3123E426BF8C16F5 Responder cookie: 0x971CD80150DA4E7E Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 24 Nonce Data 0000 00 1b 2f 37 c7 b9 00 0c 29 51 89 a7 08 00 45 00 ../7....)Q....E. 0010 00 d4 00 81 40 00 40 11 fa d2 a5 e3 f9 7a a5 e3 ....@.@......z.. 0020 f9 83 01 f4 01 f4 00 c0 20 99 31 23 e4 26 bf 8c ........ .1#.&.. 0030 16 f5 97 1c d8 01 50 da 4e 7e 04 10 02 00 00 00 ......P.N~...... 0040 00 00 00 00 00 b8 0a 00 00 84 f4 10 f5 7f 85 71 ...............q 0050 3f 86 53 9f 6f 8a f8 2c bd 80 d0 c5 83 90 30 b8 ?.S.o..,......0. 0060 0b 71 f8 30 5d 37 6d 1d 6f 75 0f 2f 90 c2 d0 4b .q.0]7m.ou./...K 0070 82 72 ee 57 70 3e 5b dd 28 ca 17 60 f0 d4 df 2c .r.Wp>[.(..`..., 0080 9c 04 0a 07 5c af 2c 4c b7 ee 3f ce 34 d0 91 aa ....\.,L..?.4... 0090 03 65 64 44 f3 94 e6 ed 2c 89 5d cd 5b d9 02 61 .edD....,.].[..a 00a0 7d 7e 9f b4 35 1d 20 3f de 09 aa 45 42 1f 45 e7 }~..5. ?...EB.E. 00b0 a1 6c be a0 a0 e2 2d fc 38 c3 a6 10 8b b2 58 9f .l....-.8.....X. 00c0 b2 e8 ff 04 44 98 3a e1 67 ef 00 00 00 18 82 bb ....D.:.g....... 00d0 5d 02 d3 56 d7 4c 4e 5f c5 0f db 1e 31 b3 46 79 ]..V.LN_....1.Fy 00e0 d0 ef .. Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Sep 20, 2007 14:57:49.677652000 Time delta from previous packet: 0.314518000 seconds Time since reference or first frame: 0.588241000 seconds Frame Number: 4 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Source: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.131 (165.227.249.131), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb57 [correct] Good: True Bad : False Source: 165.227.249.131 (165.227.249.131) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xb7d9 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3123E426BF8C16F5 Responder cookie: 0x971CD80150DA4E7E Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 51 89 a7 00 1b 2f 37 c7 b9 08 00 45 00 ..)Q..../7....E. 0010 00 d0 00 00 40 00 40 11 fb 57 a5 e3 f9 83 a5 e3 ....@.@..W...... 0020 f9 7a 01 f4 01 f4 00 bc b7 d9 31 23 e4 26 bf 8c .z........1#.&.. 0030 16 f5 97 1c d8 01 50 da 4e 7e 04 10 02 00 00 00 ......P.N~...... 0040 00 00 00 00 00 b4 0a 00 00 84 b4 21 00 dc 1d d1 ...........!.... 0050 e7 ba ba cc 39 dc 94 2d 25 c3 4f 6a ad 8f dc 14 ....9..-%.Oj.... 0060 70 4c 7d a1 30 e1 fb 7f db 8d 7a 1b 18 8a 4e 36 pL}.0.....z...N6 0070 bf 30 5c 34 5c 42 96 a0 48 d1 41 42 a4 87 cb 8b .0\4\B..H.AB.... 0080 55 89 92 2b 94 c6 18 47 85 a7 0e a5 44 17 62 5f U..+...G....D.b_ 0090 99 e3 05 83 51 3c bc 51 b4 1c 33 08 d5 8d 25 64 ....Q<.Q..3...%d 00a0 df 71 f5 06 2a 4f d5 95 23 f7 da a9 eb 66 3f cd .q..*O..#....f?. 00b0 ec 4a 89 74 31 d7 d0 9d 5e e9 c1 17 2d 98 03 7f .J.t1...^...-... 00c0 4b 42 67 98 f2 a7 78 28 9e 55 00 00 00 14 e5 61 KBg...x(.U.....a 00d0 d0 f4 3c e7 0e 46 5a 42 62 89 54 8d e2 06 ..<..FZBb.T... Frame 5 (110 bytes on wire, 110 bytes captured) Arrival Time: Sep 20, 2007 14:57:49.677654000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.588243000 seconds Frame Number: 5 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Destination: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.131 (165.227.249.131) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0082 (130) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb45 [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.131 (165.227.249.131) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x3312 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3123E426BF8C16F5 Responder cookie: 0x971CD80150DA4E7E Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 1b 2f 37 c7 b9 00 0c 29 51 89 a7 08 00 45 00 ../7....)Q....E. 0010 00 60 00 82 40 00 40 11 fb 45 a5 e3 f9 7a a5 e3 .`..@.@..E...z.. 0020 f9 83 01 f4 01 f4 00 4c 33 12 31 23 e4 26 bf 8c .......L3.1#.&.. 0030 16 f5 97 1c d8 01 50 da 4e 7e 05 10 02 01 00 00 ......P.N~...... 0040 00 00 00 00 00 44 d6 59 49 1d 98 10 e8 f2 bd 28 .....D.YI......( 0050 01 6a 01 1d da 4e 43 50 5a 4c de 19 4f 20 19 8b .j...NCPZL..O .. 0060 7b 85 bd d0 f6 09 b6 d0 a5 85 4c ce 90 9e {.........L... Frame 6 (110 bytes on wire, 110 bytes captured) Arrival Time: Sep 20, 2007 14:57:49.786027000 Time delta from previous packet: 0.108373000 seconds Time since reference or first frame: 0.696616000 seconds Frame Number: 6 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Source: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.131 (165.227.249.131), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc7 [correct] Good: True Bad : False Source: 165.227.249.131 (165.227.249.131) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0xfa11 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3123E426BF8C16F5 Responder cookie: 0x971CD80150DA4E7E Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 51 89 a7 00 1b 2f 37 c7 b9 08 00 45 00 ..)Q..../7....E. 0010 00 60 00 00 40 00 40 11 fb c7 a5 e3 f9 83 a5 e3 .`..@.@......... 0020 f9 7a 01 f4 01 f4 00 4c fa 11 31 23 e4 26 bf 8c .z.....L..1#.&.. 0030 16 f5 97 1c d8 01 50 da 4e 7e 05 10 02 01 00 00 ......P.N~...... 0040 00 00 00 00 00 44 fa 95 ec 1b 35 a9 d0 c6 80 63 .....D....5....c 0050 88 2c 00 59 a9 5a 84 8e 18 17 e2 f9 f0 e1 84 45 .,.Y.Z.........E 0060 81 90 aa 36 49 43 55 84 e0 ee bb 30 c6 23 ...6ICU....0.# Frame 7 (342 bytes on wire, 342 bytes captured) Arrival Time: Sep 20, 2007 14:57:49.786030000 Time delta from previous packet: 0.000003000 seconds Time since reference or first frame: 0.696619000 seconds Frame Number: 7 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Destination: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.131 (165.227.249.131) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0083 (131) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa5c [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.131 (165.227.249.131) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xc044 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3123E426BF8C16F5 Responder cookie: 0x971CD80150DA4E7E Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x05DC617E Length: 300 Encrypted payload (272 bytes) 0000 00 1b 2f 37 c7 b9 00 0c 29 51 89 a7 08 00 45 00 ../7....)Q....E. 0010 01 48 00 83 40 00 40 11 fa 5c a5 e3 f9 7a a5 e3 .H..@.@..\...z.. 0020 f9 83 01 f4 01 f4 01 34 c0 44 31 23 e4 26 bf 8c .......4.D1#.&.. 0030 16 f5 97 1c d8 01 50 da 4e 7e 08 10 20 01 05 dc ......P.N~.. ... 0040 61 7e 00 00 01 2c be 0f 84 dc cd 5c fb 8f 20 c8 a~...,.....\.. . 0050 11 10 bb 47 d1 48 b1 e5 02 4f 41 bf d2 5a 11 aa ...G.H...OA..Z.. 0060 10 51 2d ce a7 eb db 55 b0 43 92 89 65 24 75 f9 .Q-....U.C..e$u. 0070 ab 64 02 55 16 d9 57 03 ea a0 aa a2 75 f3 8b d4 .d.U..W.....u... 0080 66 24 92 2b b7 d7 71 a2 19 a0 44 53 8f 7c 05 32 f$.+..q...DS.|.2 0090 c1 59 cf 03 fd 96 7b 08 10 76 6d 4d 02 c6 38 e1 .Y....{..vmM..8. 00a0 18 c2 c7 dc 03 f3 24 e8 b6 a3 76 b2 7b 0b be ed ......$...v.{... 00b0 95 10 d3 73 6e ca c4 fa 2f 70 17 48 d4 37 ee 5d ...sn.../p.H.7.] 00c0 18 07 e4 99 f4 04 61 ad 6b a5 2a a8 da 8b cc bd ......a.k.*..... 00d0 af d1 dd 4a 6a 2e dc ec 96 24 f7 fd dd 16 df 5b ...Jj....$.....[ 00e0 b0 fe b3 fa 9e b0 d5 19 d6 c7 1b 41 85 0a 0b a4 ...........A.... 00f0 a5 ac b5 cb 83 4f c7 dd 0c db 7f 14 2f 2d 3c a4 .....O....../-<. 0100 f6 36 c0 a8 69 94 2c 9c cf 91 cb 38 95 cc 2b e0 .6..i.,....8..+. 0110 ce f3 0c 81 e4 75 83 ea d6 6c 52 d5 e7 03 fa 01 .....u...lR..... 0120 82 f5 89 4c a1 20 00 bf 9c 02 6d 0b 7e ef 7b e5 ...L. ....m.~.{. 0130 51 50 cb cd aa 4b 39 ba d0 41 f8 d4 d5 c5 05 8d QP...K9..A...... 0140 12 17 43 2c ea 9d db 9d 0b 33 12 59 38 e9 88 29 ..C,.....3.Y8..) 0150 85 b7 08 d0 cb e5 ...... Frame 8 (334 bytes on wire, 334 bytes captured) Arrival Time: Sep 20, 2007 14:57:50.153783000 Time delta from previous packet: 0.367753000 seconds Time since reference or first frame: 1.064372000 seconds Frame Number: 8 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Source: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.131 (165.227.249.131), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfae7 [correct] Good: True Bad : False Source: 165.227.249.131 (165.227.249.131) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x91d1 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3123E426BF8C16F5 Responder cookie: 0x971CD80150DA4E7E Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x05DC617E Length: 292 Encrypted payload (264 bytes) 0000 00 0c 29 51 89 a7 00 1b 2f 37 c7 b9 08 00 45 00 ..)Q..../7....E. 0010 01 40 00 00 40 00 40 11 fa e7 a5 e3 f9 83 a5 e3 .@..@.@......... 0020 f9 7a 01 f4 01 f4 01 2c 91 d1 31 23 e4 26 bf 8c .z.....,..1#.&.. 0030 16 f5 97 1c d8 01 50 da 4e 7e 08 10 20 01 05 dc ......P.N~.. ... 0040 61 7e 00 00 01 24 1d 7c 66 83 4a 56 99 32 aa 65 a~...$.|f.JV.2.e 0050 d1 87 30 f9 42 c9 1b 56 ca f1 e4 fb 0b 2c e1 39 ..0.B..V.....,.9 0060 a7 21 50 51 96 6a ce 8d 26 ad 09 44 d3 07 e4 f9 .!PQ.j..&..D.... 0070 39 c6 29 25 53 df ec c3 7e a4 fb 83 f7 3b 95 71 9.)%S...~....;.q 0080 1b 5d 17 ed 19 55 eb be 40 46 2b 1f 15 b4 c7 32 .]...U..@F+....2 0090 37 25 d5 52 fd 1e 02 96 b8 32 2f 47 88 9d f6 d6 7%.R.....2/G.... 00a0 0e cb ca ca cb 67 82 c5 9c e5 71 70 88 c8 3c 71 .....g....qp..bC.'...Z...o..j 0060 65 ea 4c ca 1c ad f8 53 60 5c 4d 4d be 1b 32 a2 e.L....S`\MM..2. 0070 25 e1 2b 56 99 be a0 d6 52 d0 4e d5 46 0e %.+V....R.N.F. Frame 17 (126 bytes on wire, 126 bytes captured) Arrival Time: Sep 20, 2007 14:57:51.752661000 Time delta from previous packet: 0.122544000 seconds Time since reference or first frame: 2.663250000 seconds Frame Number: 17 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Source: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.131 (165.227.249.131), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x5563 (21859) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xe633 [correct] Good: True Bad : False Source: 165.227.249.131 (165.227.249.131) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0x174a0508 Sequence: 3 Data (84 bytes) 0000 00 0c 29 51 89 a7 00 1b 2f 37 c7 b9 08 00 45 00 ..)Q..../7....E. 0010 00 70 55 63 00 00 40 32 e6 33 a5 e3 f9 83 a5 e3 .pUc..@2.3...... 0020 f9 7a 17 4a 05 08 00 00 00 03 09 43 86 f8 fa 1b .z.J.......C.... 0030 eb 14 b7 18 e3 80 91 2d d0 28 02 43 a1 30 9f 70 .......-.(.C.0.p 0040 7a 41 64 5f 1a 3c e1 1a 17 70 9a 31 5d 08 94 a5 zAd_.<...p.1]... 0050 88 42 74 33 a9 4d 5e 2e 2b 34 9d a3 4c 09 f8 ba .Bt3.M^.+4..L... 0060 2a 4f fa 02 c7 3c 9d 15 70 56 fb 10 a0 61 5d df *O...<..pV...a]. 0070 d8 43 50 0f 8c e8 bd 04 29 60 31 b0 69 80 .CP.....)`1.i. Frame 18 (126 bytes on wire, 126 bytes captured) Arrival Time: Sep 20, 2007 14:57:52.590378000 Time delta from previous packet: 0.837717000 seconds Time since reference or first frame: 3.500967000 seconds Frame Number: 18 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Destination: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.131 (165.227.249.131) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x001f (31) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7c77 [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.131 (165.227.249.131) Encapsulating Security Payload SPI: 0xc5068c84 Sequence: 4 Data (84 bytes) 0000 00 1b 2f 37 c7 b9 00 0c 29 51 89 a7 08 00 45 00 ../7....)Q....E. 0010 00 70 00 1f 00 00 ff 32 7c 77 a5 e3 f9 7a a5 e3 .p.....2|w...z.. 0020 f9 83 c5 06 8c 84 00 00 00 04 4d f5 76 e2 40 4e ..........M.v.@N 0030 85 a9 f3 e8 9f 08 37 fe 93 2c 0e 13 7d 7b df 9a ......7..,..}{.. 0040 e1 37 ed 37 70 0b 2c cb 14 ba 17 ea b4 25 23 7d .7.7p.,......%#} 0050 d8 87 bf a8 79 a5 c7 dc da fd a7 ba c1 75 d5 ad ....y........u.. 0060 32 b4 41 02 74 ec 0b 67 3c be 9e c8 b5 8f b9 02 2.A.t..g<....... 0070 b1 1b ea 2f 0a 68 de bc 8d 96 b4 34 db 98 .../.h.....4.. Frame 19 (126 bytes on wire, 126 bytes captured) Arrival Time: Sep 20, 2007 14:57:52.751893000 Time delta from previous packet: 0.161515000 seconds Time since reference or first frame: 3.662482000 seconds Frame Number: 19 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Source: 00:1b:2f:37:c7:b9 (00:1b:2f:37:c7:b9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.131 (165.227.249.131), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x5564 (21860) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xe632 [correct] Good: True Bad : False Source: 165.227.249.131 (165.227.249.131) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0x174a0508 Sequence: 4 Data (84 bytes) 0000 00 0c 29 51 89 a7 00 1b 2f 37 c7 b9 08 00 45 00 ..)Q..../7....E. 0010 00 70 55 64 00 00 40 32 e6 32 a5 e3 f9 83 a5 e3 .pUd..@2.2...... 0020 f9 7a 17 4a 05 08 00 00 00 04 fb 10 a0 61 5d df .z.J.........a]. 0030 d8 43 c1 a1 15 e2 62 66 e6 64 cd 03 d6 af 36 2c .C....bf.d....6, 0040 92 9a 91 53 e3 20 bd 4a cd 1e da 8b 31 7b 95 65 ...S. .J....1{.e 0050 d8 5c 90 67 4b d5 69 f9 c4 53 7d a8 a1 b9 97 d2 .\.gK.i..S}..... 0060 b8 e2 88 70 4e ab 7d 72 b7 b5 5e 07 e2 4e 8a b8 ...pN.}r..^..N.. 0070 f3 4a cb 93 50 b4 6a d0 ea 4b 4b 2a 80 1a .J..P.j..KK*..