Frame 1 (174 bytes on wire, 174 bytes captured) Arrival Time: Jun 30, 2005 11:27:00.408126000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 174 bytes Capture Length: 174 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:0c:41:90:f1:c1 Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0x2e200299 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 156 Identification: 0x0120 (288) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa69 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.133 (165.227.249.133) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 136 Checksum: 0xaafb (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x905E63E5D70B0E99 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 128 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 44 Vendor ID: Check Point Check Point Product: VPN-1 Version: NG with Application Intelligence R55 0000 00 0c 41 90 f1 c1 00 0c 29 89 f2 82 08 00 45 00 ..A.....).....E. 0010 00 9c 01 20 40 00 40 11 fa 69 a5 e3 f9 7a a5 e3 ... @.@..i...z.. 0020 f9 85 01 f4 01 f4 00 88 aa fb 90 5e 63 e5 d7 0b ...........^c... 0030 0e 99 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 80 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 00 00 ............p... 0080 00 2c f4 ed 19 e0 c1 14 eb 51 6f aa ac 0e e3 7d .,.......Qo....} 0090 af 28 07 b4 38 1f 00 00 00 01 00 00 13 8d 42 c2 .(..8.........B. 00a0 1b 96 00 00 00 00 18 00 00 00 2e 20 02 99 ........... .. Frame 2 (130 bytes on wire, 130 bytes captured) Arrival Time: Jun 30, 2005 11:27:00.409803000 Time delta from previous packet: 0.001677000 seconds Time since reference or first frame: 0.001677000 seconds Frame Number: 2 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0c:41:90:f1:c1, Dst: 00:0c:29:89:f2:82 Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Type: IP (0x0800) Frame check sequence: 0xb8507880 (correct) Internet Protocol, Src Addr: 165.227.249.133 (165.227.249.133), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb5 (correct) Source: 165.227.249.133 (165.227.249.133) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0x02b2 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x905E63E5D70B0E99 Responder cookie: 0xB4CFBA6386E4F32F Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 84 Security Association payload Next payload: NONE (0) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0c 29 89 f2 82 00 0c 41 90 f1 c1 08 00 45 00 ..).....A.....E. 0010 00 70 00 00 40 00 40 11 fb b5 a5 e3 f9 85 a5 e3 .p..@.@......... 0020 f9 7a 01 f4 01 f4 00 5c 02 b2 90 5e 63 e5 d7 0b .z.....\...^c... 0030 0e 99 b4 cf ba 63 86 e4 f3 2f 01 10 02 00 00 00 .....c.../...... 0040 00 00 00 00 00 54 00 00 00 38 00 00 00 01 00 00 .....T...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 b8 50 ............p..P 0080 78 80 x. Frame 3 (230 bytes on wire, 230 bytes captured) Arrival Time: Jun 30, 2005 11:27:00.425858000 Time delta from previous packet: 0.016055000 seconds Time since reference or first frame: 0.017732000 seconds Frame Number: 3 Packet Length: 230 bytes Capture Length: 230 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:0c:41:90:f1:c1 Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0x7444acbe (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x0121 (289) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa30 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.133 (165.227.249.133) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0xc762 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x905E63E5D70B0E99 Responder cookie: 0xB4CFBA6386E4F32F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 24 Nonce Data 0000 00 0c 41 90 f1 c1 00 0c 29 89 f2 82 08 00 45 00 ..A.....).....E. 0010 00 d4 01 21 40 00 40 11 fa 30 a5 e3 f9 7a a5 e3 ...!@.@..0...z.. 0020 f9 85 01 f4 01 f4 00 c0 c7 62 90 5e 63 e5 d7 0b .........b.^c... 0030 0e 99 b4 cf ba 63 86 e4 f3 2f 04 10 02 00 00 00 .....c.../...... 0040 00 00 00 00 00 b8 0a 00 00 84 d0 60 0c ca 0c 83 ...........`.... 0050 d0 31 b2 62 a8 eb d4 08 2e 62 64 bc f5 d1 2e 3e .1.b.....bd....> 0060 53 73 0b f9 00 95 3d de 2a 6f 40 de cf 3a ac 9b Ss....=.*o@..:.. 0070 65 a8 21 23 12 cd d5 d3 6d 02 cf 6b c8 46 98 c4 e.!#....m..k.F.. 0080 db 3b 67 c1 cd a5 d9 79 cb 4f 66 2b cb 35 55 43 .;g....y.Of+.5UC 0090 05 fc d5 05 c7 43 34 c5 18 42 40 e8 59 ac 66 c4 .....C4..B@.Y.f. 00a0 04 56 e0 c2 f0 7e 7b 59 93 f5 60 36 fe 61 ac 98 .V...~{Y..`6.a.. 00b0 d0 e1 6f af 00 37 e3 91 92 f3 8d 14 96 c7 36 89 ..o..7........6. 00c0 22 54 be b6 e9 48 09 50 e3 f8 00 00 00 18 fe e4 "T...H.P........ 00d0 4d 67 d7 c3 5e 4d cb 80 58 bf a7 d9 c4 09 c7 42 Mg..^M..X......B 00e0 2d 95 74 44 ac be -.tD.. Frame 4 (226 bytes on wire, 226 bytes captured) Arrival Time: Jun 30, 2005 11:27:00.540143000 Time delta from previous packet: 0.114285000 seconds Time since reference or first frame: 0.132017000 seconds Frame Number: 4 Packet Length: 226 bytes Capture Length: 226 bytes Ethernet II, Src: 00:0c:41:90:f1:c1, Dst: 00:0c:29:89:f2:82 Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Type: IP (0x0800) Frame check sequence: 0xf010ddfa (correct) Internet Protocol, Src Addr: 165.227.249.133 (165.227.249.133), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb55 (correct) Source: 165.227.249.133 (165.227.249.133) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xfb0e (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x905E63E5D70B0E99 Responder cookie: 0xB4CFBA6386E4F32F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 89 f2 82 00 0c 41 90 f1 c1 08 00 45 00 ..).....A.....E. 0010 00 d0 00 00 40 00 40 11 fb 55 a5 e3 f9 85 a5 e3 ....@.@..U...... 0020 f9 7a 01 f4 01 f4 00 bc fb 0e 90 5e 63 e5 d7 0b .z.........^c... 0030 0e 99 b4 cf ba 63 86 e4 f3 2f 04 10 02 00 00 00 .....c.../...... 0040 00 00 00 00 00 b4 0a 00 00 84 50 a4 d9 5f 4c c7 ..........P.._L. 0050 83 39 3d a8 cc 4e 7f 44 e4 51 e9 e5 a0 53 96 5a .9=..N.D.Q...S.Z 0060 55 f6 2d bb cf 3d 57 ab a9 02 e7 04 e6 f3 59 3a U.-..=W.......Y: 0070 98 11 82 62 e5 e5 d1 ec a9 af 75 24 69 bf 83 43 ...b......u$i..C 0080 ac 6c c9 3e 8c 0a fa 36 5f d8 8d 6a a3 e7 92 83 .l.>...6_..j.... 0090 3e d3 22 cf b2 b2 e3 7f 15 57 52 cf 7e 2b d9 41 >."......WR.~+.A 00a0 97 30 21 bf b9 74 8b 3d a8 74 8e 4e 0e a2 ea e8 .0!..t.=.t.N.... 00b0 63 5c 91 68 d4 f5 76 af 2a ad 2d e7 e4 94 93 57 c\.h..v.*.-....W 00c0 b1 75 84 e8 5a 46 38 53 53 c7 00 00 00 14 36 c8 .u..ZF8SS.....6. 00d0 71 bc 05 f4 3d 1a ee 9d 68 85 87 62 0e 5f f0 10 q...=...h..b._.. 00e0 dd fa .. Frame 5 (114 bytes on wire, 114 bytes captured) Arrival Time: Jun 30, 2005 11:27:00.547183000 Time delta from previous packet: 0.007040000 seconds Time since reference or first frame: 0.139057000 seconds Frame Number: 5 Packet Length: 114 bytes Capture Length: 114 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:0c:41:90:f1:c1 Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0xf01aa9c1 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0122 (290) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaa3 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.133 (165.227.249.133) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x60e3 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x905E63E5D70B0E99 Responder cookie: 0xB4CFBA6386E4F32F Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 41 90 f1 c1 00 0c 29 89 f2 82 08 00 45 00 ..A.....).....E. 0010 00 60 01 22 40 00 40 11 fa a3 a5 e3 f9 7a a5 e3 .`."@.@......z.. 0020 f9 85 01 f4 01 f4 00 4c 60 e3 90 5e 63 e5 d7 0b .......L`..^c... 0030 0e 99 b4 cf ba 63 86 e4 f3 2f 05 10 02 01 00 00 .....c.../...... 0040 00 00 00 00 00 44 e0 09 a9 cb c1 63 0f 46 79 a4 .....D.....c.Fy. 0050 29 38 08 c6 a7 b8 35 42 4c de 9b 56 30 15 77 f8 )8....5BL..V0.w. 0060 22 8c c6 07 b4 36 d6 75 36 d7 38 c1 3b 05 f0 1a "....6.u6.8.;... 0070 a9 c1 .. Frame 6 (114 bytes on wire, 114 bytes captured) Arrival Time: Jun 30, 2005 11:27:00.549376000 Time delta from previous packet: 0.002193000 seconds Time since reference or first frame: 0.141250000 seconds Frame Number: 6 Packet Length: 114 bytes Capture Length: 114 bytes Ethernet II, Src: 00:0c:41:90:f1:c1, Dst: 00:0c:29:89:f2:82 Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Type: IP (0x0800) Frame check sequence: 0xb2d82666 (correct) Internet Protocol, Src Addr: 165.227.249.133 (165.227.249.133), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc5 (correct) Source: 165.227.249.133 (165.227.249.133) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0xd400 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x905E63E5D70B0E99 Responder cookie: 0xB4CFBA6386E4F32F Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 89 f2 82 00 0c 41 90 f1 c1 08 00 45 00 ..).....A.....E. 0010 00 60 00 00 40 00 40 11 fb c5 a5 e3 f9 85 a5 e3 .`..@.@......... 0020 f9 7a 01 f4 01 f4 00 4c d4 00 90 5e 63 e5 d7 0b .z.....L...^c... 0030 0e 99 b4 cf ba 63 86 e4 f3 2f 05 10 02 01 00 00 .....c.../...... 0040 00 00 00 00 00 44 6e f0 f8 74 93 f0 0c 3b 7d 44 .....Dn..t...;}D 0050 55 27 fd 43 08 ea cf e8 ea e7 b8 2c 5d f3 3c 26 U'.C.......,].<& 0060 dc 60 32 f5 fc 90 eb 2e 37 5c 32 6c cf ff b2 d8 .`2.....7\2l.... 0070 26 66 &f Frame 7 (346 bytes on wire, 346 bytes captured) Arrival Time: Jun 30, 2005 11:27:00.556036000 Time delta from previous packet: 0.006660000 seconds Time since reference or first frame: 0.147910000 seconds Frame Number: 7 Packet Length: 346 bytes Capture Length: 346 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:0c:41:90:f1:c1 Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0x283b664f (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0123 (291) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xf9ba (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.133 (165.227.249.133) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x2956 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x905E63E5D70B0E99 Responder cookie: 0xB4CFBA6386E4F32F Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0xFD127591 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 41 90 f1 c1 00 0c 29 89 f2 82 08 00 45 00 ..A.....).....E. 0010 01 48 01 23 40 00 40 11 f9 ba a5 e3 f9 7a a5 e3 .H.#@.@......z.. 0020 f9 85 01 f4 01 f4 01 34 29 56 90 5e 63 e5 d7 0b .......4)V.^c... 0030 0e 99 b4 cf ba 63 86 e4 f3 2f 08 10 20 01 fd 12 .....c.../.. ... 0040 75 91 00 00 01 2c ab bb 8e 5b 2b c7 07 ec 2c 34 u....,...[+...,4 0050 46 fd 41 d8 db 28 91 50 1f a3 dc 21 b9 3f 2a 61 F.A..(.P...!.?*a 0060 55 0f d1 23 16 44 ea 56 40 ca cb a2 b3 13 93 7c U..#.D.V@......| 0070 7f 98 aa b4 48 a7 d7 83 7d aa f7 0e f5 da fa da ....H...}....... 0080 f6 92 15 35 95 77 00 06 10 8e 95 3c e3 6d f7 53 ...5.w.....<.m.S 0090 26 37 aa 22 3e ae b2 00 6b f9 a2 4f 5e d6 01 b0 &7.">...k..O^... 00a0 2f b7 1f e2 3d 56 2e 31 60 e5 4a 7d cd 63 4c bf /...=V.1`.J}.cL. 00b0 3a 98 5e 31 e0 5f f1 50 a0 df 08 01 39 c1 be 5e :.^1._.P....9..^ 00c0 66 6e fa c5 5e d7 e2 39 78 8b d0 8b da f3 10 68 fn..^..9x......h 00d0 fc 2d cd 62 39 fb 58 58 5b 2e 17 4a 1c 5c 6e f0 .-.b9.XX[..J.\n. 00e0 6c 2c e1 27 a4 6e 29 c0 aa 2f 2b c8 72 bb 46 60 l,.'.n)../+.r.F` 00f0 3e be 35 50 d7 ab 9a a4 1a 72 af 7c 73 21 d8 37 >.5P.....r.|s!.7 0100 29 a6 0e 69 39 18 39 b6 2c 5e 3e 4b 9a ce 8c a0 )..i9.9.,^>K.... 0110 28 6c 40 47 87 a3 62 c3 66 92 de d9 f2 f6 1d ab (l@G..b.f....... 0120 71 0d 0d 36 81 6b 0e 55 63 b9 a2 d8 4f 34 cf 34 q..6.k.Uc...O4.4 0130 7f 64 ab bd f6 e1 25 e5 80 2a 7c 28 85 b6 e3 2e .d....%..*|(.... 0140 13 c3 25 d9 9d 96 84 fa 52 59 99 35 db 3f af 72 ..%.....RY.5.?.r 0150 c1 05 d0 4c bb 9a 28 3b 66 4f ...L..(;fO Frame 8 (338 bytes on wire, 338 bytes captured) Arrival Time: Jun 30, 2005 11:27:00.680584000 Time delta from previous packet: 0.124548000 seconds Time since reference or first frame: 0.272458000 seconds Frame Number: 8 Packet Length: 338 bytes Capture Length: 338 bytes Ethernet II, Src: 00:0c:41:90:f1:c1, Dst: 00:0c:29:89:f2:82 Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Type: IP (0x0800) Frame check sequence: 0xa1a8a108 (correct) Internet Protocol, Src Addr: 165.227.249.133 (165.227.249.133), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfae5 (correct) Source: 165.227.249.133 (165.227.249.133) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x4a49 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x905E63E5D70B0E99 Responder cookie: 0xB4CFBA6386E4F32F Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0xFD127591 Length: 292 Encrypted payload (264 bytes) 0000 00 0c 29 89 f2 82 00 0c 41 90 f1 c1 08 00 45 00 ..).....A.....E. 0010 01 40 00 00 40 00 40 11 fa e5 a5 e3 f9 85 a5 e3 .@..@.@......... 0020 f9 7a 01 f4 01 f4 01 2c 4a 49 90 5e 63 e5 d7 0b .z.....,JI.^c... 0030 0e 99 b4 cf ba 63 86 e4 f3 2f 08 10 20 01 fd 12 .....c.../.. ... 0040 75 91 00 00 01 24 21 58 16 7c de ce 4f f1 d7 d0 u....$!X.|..O... 0050 04 22 c0 05 3c 22 91 e4 2b 2b 28 8a c6 7e 33 b9 ."..<"..++(..~3. 0060 eb ad a1 a9 06 d6 d7 a1 6e f8 fd 79 2e 60 bf 4e ........n..y.`.N 0070 4f 66 9a 66 d5 9d 89 ce 75 46 52 6e ab 82 8e 42 Of.f....uFRn...B 0080 2a 17 01 6f 11 e6 b1 a0 ff 0d 91 2c a0 83 fc df *..o.......,.... 0090 fa 9b 4c b2 35 2f 50 cd 37 dd b4 e1 6c 3c a9 6f ..L.5/P.7...l<.o 00a0 ed bc b2 f2 0a 89 3e 9f 12 c1 bb 05 28 d3 83 e8 ......>.....(... 00b0 7b 74 d3 b2 d2 13 95 c8 76 31 d9 46 90 80 d2 e7 {t......v1.F.... 00c0 74 19 f0 c8 8e ce 1e 5d 61 22 1a ac 91 28 f4 eb t......]a"...(.. 00d0 a2 62 7e 7f ad 08 8b f6 f8 ac 32 54 7c 68 90 e3 .b~.......2T|h.. 00e0 c4 69 17 e2 42 b9 a1 8f 71 bf be 08 4f 88 71 51 .i..B...q...O.qQ 00f0 1b d9 26 d2 67 8b b7 0a 7d 50 bb 60 b0 20 3d 6b ..&.g...}P.`. =k 0100 b4 ec 90 ba 4c 98 15 f2 30 90 c0 1f e5 39 bb f3 ....L...0....9.. 0110 60 19 6b 55 8f c2 83 61 03 d0 c1 1e 09 18 e1 2e `.kU...a........ 0120 01 69 c4 52 15 78 ca 6a 86 68 35 ff da 1c 8c 38 .i.R.x.j.h5....8 0130 0b de ae 59 6e b7 9a 92 6e f9 b1 e7 1b b8 a8 9e ...Yn...n....... 0140 8f c5 5e f5 30 d0 e7 15 e7 c3 99 51 88 55 a1 a8 ..^.0......Q.U.. 0150 a1 08 .. Frame 9 (106 bytes on wire, 106 bytes captured) Arrival Time: Jun 30, 2005 11:27:00.715764000 Time delta from previous packet: 0.035180000 seconds Time since reference or first frame: 0.307638000 seconds Frame Number: 9 Packet Length: 106 bytes Capture Length: 106 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:0c:41:90:f1:c1 Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0x79b397ff (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0124 (292) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaa9 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.133 (165.227.249.133) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x04f2 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x905E63E5D70B0E99 Responder cookie: 0xB4CFBA6386E4F32F Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0xFD127591 Length: 60 Encrypted payload (32 bytes) 0000 00 0c 41 90 f1 c1 00 0c 29 89 f2 82 08 00 45 00 ..A.....).....E. 0010 00 58 01 24 40 00 40 11 fa a9 a5 e3 f9 7a a5 e3 .X.$@.@......z.. 0020 f9 85 01 f4 01 f4 00 44 04 f2 90 5e 63 e5 d7 0b .......D...^c... 0030 0e 99 b4 cf ba 63 86 e4 f3 2f 08 10 20 01 fd 12 .....c.../.. ... 0040 75 91 00 00 00 3c 62 45 3a d4 64 8e ed eb fe b8 u.........T../..... 0040 0a 7c 2a dd ad 5c 6c 75 60 37 e6 fb 70 e7 b6 65 .|*..\lu`7..p..e 0050 ce b9 a5 12 16 3e f3 c7 3d 47 3f 84 e4 b8 32 7b .....>..=G?...2{ 0060 7b d2 62 08 62 55 bf e0 9b b6 d5 b2 93 67 ae e8 {.b.bU.......g.. 0070 51 01 ab 80 00 19 2a a2 01 fb a6 c9 17 97 e2 95 Q.....*......... 0080 6d 76 mv Frame 16 (130 bytes on wire, 130 bytes captured) Arrival Time: Jun 30, 2005 11:27:02.453284000 Time delta from previous packet: 0.987256000 seconds Time since reference or first frame: 2.045158000 seconds Frame Number: 16 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:0c:41:90:f1:c1 Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0x4796eb02 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x009d (157) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7bf7 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.133 (165.227.249.133) Encapsulating Security Payload SPI: 0xea1c4e4a Sequence: 3 Data (84 bytes) 0000 00 0c 41 90 f1 c1 00 0c 29 89 f2 82 08 00 45 00 ..A.....).....E. 0010 00 70 00 9d 00 00 ff 32 7b f7 a5 e3 f9 7a a5 e3 .p.....2{....z.. 0020 f9 85 ea 1c 4e 4a 00 00 00 03 1c d7 88 c8 97 cf ....NJ.......... 0030 d4 a2 98 30 f5 7f b1 5a 2e 1d 17 6b 1e cc a4 45 ...0...Z...k...E 0040 7e 57 1c 4f 7d c2 aa 02 b0 f7 83 4d b6 9f 15 1e ~W.O}......M.... 0050 40 b4 db 66 3e 7a ab d0 8e 18 c9 86 f4 71 8c dc @..f>z.......q.. 0060 43 9c 6f 6c 65 7d 72 fa 2e 09 2c 82 14 6a 3d 7e C.ole}r...,..j=~ 0070 92 25 c5 c8 19 2d 45 da a6 5a 85 e2 92 b2 47 96 .%...-E..Z....G. 0080 eb 02 .. Frame 17 (130 bytes on wire, 130 bytes captured) Arrival Time: Jun 30, 2005 11:27:02.454174000 Time delta from previous packet: 0.000890000 seconds Time since reference or first frame: 2.046048000 seconds Frame Number: 17 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0c:41:90:f1:c1, Dst: 00:0c:29:89:f2:82 Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Type: IP (0x0800) Frame check sequence: 0x6f791315 (correct) Internet Protocol, Src Addr: 165.227.249.133 (165.227.249.133), Dst Addr: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x09db (2523) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x31ba (correct) Source: 165.227.249.133 (165.227.249.133) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0x12746c6a Sequence: 3 Data (84 bytes) 0000 00 0c 29 89 f2 82 00 0c 41 90 f1 c1 08 00 45 00 ..).....A.....E. 0010 00 70 09 db 00 00 40 32 31 ba a5 e3 f9 85 a5 e3 .p....@21....... 0020 f9 7a 12 74 6c 6a 00 00 00 03 9a 9b 9c 9d 9e 9f .z.tlj.......... 0030 a0 a1 72 66 1a 74 67 59 60 c2 d3 79 06 5c 3a 22 ..rf.tgY`..y.\:" 0040 50 ab 7e f9 4b 13 bb a5 1c 1a 40 f8 2f 7c 36 6f P.~.K.....@./|6o 0050 5a 16 38 c4 f1 fc b1 f3 36 5d 24 69 f5 64 e6 ed Z.8.....6]$i.d.. 0060 c8 b8 0f ef 2e 1c 2f 9d 1f f4 72 a0 23 3b 37 0f ....../...r.#;7. 0070 30 09 20 16 ab 58 f2 6d c8 50 1d 83 65 37 6f 79 0. ..X.m.P..e7oy 0080 13 15 .. Frame 18 (130 bytes on wire, 130 bytes captured) Arrival Time: Jun 30, 2005 11:27:03.461429000 Time delta from previous packet: 1.007255000 seconds Time since reference or first frame: 3.053303000 seconds Frame Number: 18 Packet Length: 130 bytes Capture Length: 130 bytes Ethernet II, Src: 00:0c:29:89:f2:82, Dst: 00:0c:41:90:f1:c1 Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0xbae14498 (correct) Internet Protocol, Src Addr: 165.227.249.122 (165.227.249.122), Dst Addr: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x009e (158) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7bf6 (correct) Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.133 (165.227.249.133) Encapsulating Security Payload SPI: 0xea1c4e4a Sequence: 4 Data (84 bytes) 0000 00 0c 41 90 f1 c1 00 0c 29 89 f2 82 08 00 45 00 ..A.....).....E. 0010 00 70 00 9e 00 00 ff 32 7b f6 a5 e3 f9 7a a5 e3 .p.....2{....z.. 0020 f9 85 ea 1c 4e 4a 00 00 00 04 1f 8d c4 f4 ae 1c ....NJ.......... 0030 3b cf c3 43 61 39 c3 e5 a2 5f 6b f4 04 6c c5 39 ;..Ca9..._k..l.9 0040 b9 3e e8 68 26 63 26 38 82 2f 11 9e a8 a5 96 24 .>.h&c&8./.....$ 0050 39 15 e3 ad 3e f8 c0 ef 9b 6a f1 99 b0 3f 14 a2 9...>....j...?.. 0060 c1 ae bd 1e 8f 3d 74 97 e3 8a 27 13 fd 21 b7 ca .....=t...'..!.. 0070 15 d9 a2 d1 36 62 3c 70 15 d3 6a 9c 51 70 ba e1 ....6b