Frame 1 (174 bytes on wire, 174 bytes captured) Arrival Time: May 27, 2009 16:24:10.622261000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 174 bytes Capture Length: 174 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 160 Identification: 0x007a (122) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb06 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 140 Checksum: 0xf5d6 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 4A241BF023A6DB41 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 132 Security Association payload Next payload: Vendor ID (13) Payload length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 48 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 40 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: Check Point Next payload: NONE (0) Payload length: 44 Vendor ID: Check Point Check Point Product: VPN-1 Version: NG with Application Intelligence R55 Check Point Vendor ID parameters 0000 00 24 b2 31 e1 3d 00 0c 29 51 89 a7 08 00 45 00 .$.1.=..)Q....E. 0010 00 a0 00 7a 40 00 40 11 fb 06 a5 e3 f9 7a a5 e3 ...z@.@......z.. 0020 f9 8a 01 f4 01 f4 00 8c f5 d6 4a 24 1b f0 23 a6 ..........J$..#. 0030 db 41 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .A.............. 0040 00 00 00 00 00 84 0d 00 00 3c 00 00 00 01 00 00 .........<...... 0050 00 01 00 00 00 30 01 01 00 01 00 00 00 28 01 01 .....0.......(.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 00 0c 00 04 00 00 ................ 0080 70 80 00 00 00 2c f4 ed 19 e0 c1 14 eb 51 6f aa p....,.......Qo. 0090 ac 0e e3 7d af 28 07 b4 38 1f 00 00 00 01 00 00 ...}.(..8....... 00a0 13 8d 48 62 bf 59 00 00 00 00 18 00 00 00 ..Hb.Y........ Frame 2 (174 bytes on wire, 174 bytes captured) Arrival Time: May 27, 2009 16:24:10.622268000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 0.000007000 seconds] Frame Number: 2 Frame Length: 174 bytes Capture Length: 174 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 160 Identification: 0x007a (122) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb06 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 140 Checksum: 0xf5d6 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 4A241BF023A6DB41 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 132 Security Association payload Next payload: Vendor ID (13) Payload length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 48 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 40 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: Check Point Next payload: NONE (0) Payload length: 44 Vendor ID: Check Point Check Point Product: VPN-1 Version: NG with Application Intelligence R55 Check Point Vendor ID parameters 0000 00 24 b2 31 e1 3d 00 0c 29 51 89 a7 08 00 45 00 .$.1.=..)Q....E. 0010 00 a0 00 7a 40 00 40 11 fb 06 a5 e3 f9 7a a5 e3 ...z@.@......z.. 0020 f9 8a 01 f4 01 f4 00 8c f5 d6 4a 24 1b f0 23 a6 ..........J$..#. 0030 db 41 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .A.............. 0040 00 00 00 00 00 84 0d 00 00 3c 00 00 00 01 00 00 .........<...... 0050 00 01 00 00 00 30 01 01 00 01 00 00 00 28 01 01 .....0.......(.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 00 0c 00 04 00 00 ................ 0080 70 80 00 00 00 2c f4 ed 19 e0 c1 14 eb 51 6f aa p....,.......Qo. 0090 ac 0e e3 7d af 28 07 b4 38 1f 00 00 00 01 00 00 ...}.(..8....... 00a0 13 8d 48 62 bf 59 00 00 00 00 18 00 00 00 ..Hb.Y........ Frame 3 (170 bytes on wire, 170 bytes captured) Arrival Time: May 27, 2009 16:24:10.805875000 [Time delta from previous captured frame: 0.183607000 seconds] [Time delta from previous displayed frame: 0.183607000 seconds] [Time since reference or first frame: 0.183614000 seconds] Frame Number: 3 Frame Length: 170 bytes Capture Length: 170 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 156 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb84 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 136 Checksum: 0x8d90 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 4A241BF023A6DB41 Responder cookie: E52F14B2A2BE123D Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 128 Security Association payload Next payload: Vendor ID (13) Payload length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 48 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 1 Next payload: NONE (0) Payload length: 40 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 51 89 a7 00 24 b2 31 e1 3d 08 00 45 00 ..)Q...$.1.=..E. 0010 00 9c 00 00 40 00 40 11 fb 84 a5 e3 f9 8a a5 e3 ....@.@......... 0020 f9 7a 01 f4 01 f4 00 88 8d 90 4a 24 1b f0 23 a6 .z........J$..#. 0030 db 41 e5 2f 14 b2 a2 be 12 3d 01 10 02 00 00 00 .A./.....=...... 0040 00 00 00 00 00 80 0d 00 00 3c 00 00 00 01 00 00 .........<...... 0050 00 01 00 00 00 30 01 01 00 01 00 00 00 28 01 01 .....0.......(.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 00 0c 00 04 00 00 ................ 0080 70 80 0d 00 00 14 3b 90 31 dc e4 fc f8 8b 48 9a p.....;.1.....H. 0090 92 39 63 dd 0c 49 00 00 00 14 70 03 cb c1 09 7d .9c..I....p....} 00a0 be 9c 26 00 ba 69 83 bc 8b 35 ..&..i...5 Frame 4 (226 bytes on wire, 226 bytes captured) Arrival Time: May 27, 2009 16:24:10.809493000 [Time delta from previous captured frame: 0.003618000 seconds] [Time delta from previous displayed frame: 0.003618000 seconds] [Time since reference or first frame: 0.187232000 seconds] Frame Number: 4 Frame Length: 226 bytes Capture Length: 226 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x007b (123) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfad1 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x1d3d [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 4A241BF023A6DB41 Responder cookie: E52F14B2A2BE123D Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 24 Nonce Data 0000 00 24 b2 31 e1 3d 00 0c 29 51 89 a7 08 00 45 00 .$.1.=..)Q....E. 0010 00 d4 00 7b 40 00 40 11 fa d1 a5 e3 f9 7a a5 e3 ...{@.@......z.. 0020 f9 8a 01 f4 01 f4 00 c0 1d 3d 4a 24 1b f0 23 a6 .........=J$..#. 0030 db 41 e5 2f 14 b2 a2 be 12 3d 04 10 02 00 00 00 .A./.....=...... 0040 00 00 00 00 00 b8 0a 00 00 84 67 9a 5f a4 77 e5 ..........g._.w. 0050 24 be 14 15 6e 3b 86 2f 86 5b 8b d7 ac ba 4f 3b $...n;./.[....O; 0060 67 59 fc 85 89 d9 2e 54 4e 1b a1 2c 1a 69 ee ae gY.....TN..,.i.. 0070 08 94 fe c6 b9 60 51 51 ac 38 bd 37 33 d1 2b 5a .....`QQ.8.73.+Z 0080 ff 47 0e d6 ee 58 b1 7a 4a 61 54 46 1c 9d e4 de .G...X.zJaTF.... 0090 eb 45 c9 3a 35 e1 9f eb 67 45 19 26 49 2c 85 82 .E.:5...gE.&I,.. 00a0 e6 e1 bf b6 a9 77 96 9c ce df 90 02 64 7c 67 66 .....w......d|gf 00b0 0f d1 e5 ee fe f4 35 b2 03 08 5d 5b 81 21 ea 60 ......5...][.!.` 00c0 cc c8 69 95 c2 78 4a ad 47 60 00 00 00 18 1b d2 ..i..xJ.G`...... 00d0 99 ea 31 14 28 79 f1 70 26 e1 dc 30 88 84 db 7d ..1.(y.p&..0...} 00e0 ed ac .. Frame 5 (226 bytes on wire, 226 bytes captured) Arrival Time: May 27, 2009 16:24:10.809504000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 0.187243000 seconds] Frame Number: 5 Frame Length: 226 bytes Capture Length: 226 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x007b (123) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfad1 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x1d3d [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 4A241BF023A6DB41 Responder cookie: E52F14B2A2BE123D Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 24 Nonce Data 0000 00 24 b2 31 e1 3d 00 0c 29 51 89 a7 08 00 45 00 .$.1.=..)Q....E. 0010 00 d4 00 7b 40 00 40 11 fa d1 a5 e3 f9 7a a5 e3 ...{@.@......z.. 0020 f9 8a 01 f4 01 f4 00 c0 1d 3d 4a 24 1b f0 23 a6 .........=J$..#. 0030 db 41 e5 2f 14 b2 a2 be 12 3d 04 10 02 00 00 00 .A./.....=...... 0040 00 00 00 00 00 b8 0a 00 00 84 67 9a 5f a4 77 e5 ..........g._.w. 0050 24 be 14 15 6e 3b 86 2f 86 5b 8b d7 ac ba 4f 3b $...n;./.[....O; 0060 67 59 fc 85 89 d9 2e 54 4e 1b a1 2c 1a 69 ee ae gY.....TN..,.i.. 0070 08 94 fe c6 b9 60 51 51 ac 38 bd 37 33 d1 2b 5a .....`QQ.8.73.+Z 0080 ff 47 0e d6 ee 58 b1 7a 4a 61 54 46 1c 9d e4 de .G...X.zJaTF.... 0090 eb 45 c9 3a 35 e1 9f eb 67 45 19 26 49 2c 85 82 .E.:5...gE.&I,.. 00a0 e6 e1 bf b6 a9 77 96 9c ce df 90 02 64 7c 67 66 .....w......d|gf 00b0 0f d1 e5 ee fe f4 35 b2 03 08 5d 5b 81 21 ea 60 ......5...][.!.` 00c0 cc c8 69 95 c2 78 4a ad 47 60 00 00 00 18 1b d2 ..i..xJ.G`...... 00d0 99 ea 31 14 28 79 f1 70 26 e1 dc 30 88 84 db 7d ..1.(y.p&..0...} 00e0 ed ac .. Frame 6 (242 bytes on wire, 242 bytes captured) Arrival Time: May 27, 2009 16:24:11.257557000 [Time delta from previous captured frame: 0.448053000 seconds] [Time delta from previous displayed frame: 0.448053000 seconds] [Time since reference or first frame: 0.635296000 seconds] Frame Number: 6 Frame Length: 242 bytes Capture Length: 242 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb3c [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0x0139 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 4A241BF023A6DB41 Responder cookie: E52F14B2A2BE123D Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 20 Nonce Data Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 51 89 a7 00 24 b2 31 e1 3d 08 00 45 00 ..)Q...$.1.=..E. 0010 00 e4 00 00 40 00 40 11 fb 3c a5 e3 f9 8a a5 e3 ....@.@..<...... 0020 f9 7a 01 f4 01 f4 00 d0 01 39 4a 24 1b f0 23 a6 .z.......9J$..#. 0030 db 41 e5 2f 14 b2 a2 be 12 3d 04 10 02 00 00 00 .A./.....=...... 0040 00 00 00 00 00 c8 0a 00 00 84 5e fc f7 30 41 ad ..........^..0A. 0050 b9 d9 82 8b 81 8a 1d 82 a2 d6 32 75 fe 29 dc 4d ..........2u.).M 0060 15 13 31 ec 71 1e c7 7a 80 56 69 b8 a1 26 aa f2 ..1.q..z.Vi..&.. 0070 21 08 89 1c 06 f3 9b 76 9e 95 ed cb 60 c4 5e 26 !......v....`.^& 0080 2f b3 05 ac bc f2 38 2c ae 71 16 f2 ac 85 7b a1 /.....8,.q....{. 0090 87 ec d2 3a 34 3b 5c 8a b7 61 8d 98 89 6c 18 1a ...:4;\..a...l.. 00a0 06 80 89 bb 25 f5 89 2d 20 c4 7e 77 2d 13 d4 aa ....%..- .~w-... 00b0 e2 8d 73 20 0a ad ec 40 99 73 59 56 9c 45 54 00 ..s ...@.sYV.ET. 00c0 41 55 c0 46 f0 35 51 e6 20 b2 0d 00 00 14 e4 c6 AU.F.5Q. ....... 00d0 b7 06 e6 e7 a5 ef 87 5b 48 50 04 0d c9 d8 00 00 .......[HP...... 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 7 (118 bytes on wire, 118 bytes captured) Arrival Time: May 27, 2009 16:24:11.265079000 [Time delta from previous captured frame: 0.007522000 seconds] [Time delta from previous displayed frame: 0.007522000 seconds] [Time since reference or first frame: 0.642818000 seconds] Frame Number: 7 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x007c (124) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb3c [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xfd2c [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 4A241BF023A6DB41 Responder cookie: E52F14B2A2BE123D Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 51 89 a7 08 00 45 00 .$.1.=..)Q....E. 0010 00 68 00 7c 40 00 40 11 fb 3c a5 e3 f9 7a a5 e3 .h.|@.@..<...z.. 0020 f9 8a 01 f4 01 f4 00 54 fd 2c 4a 24 1b f0 23 a6 .......T.,J$..#. 0030 db 41 e5 2f 14 b2 a2 be 12 3d 05 10 02 01 00 00 .A./.....=...... 0040 00 00 00 00 00 4c 4c 4c c5 0c a8 21 9c e8 1d 5c .....LLL...!...\ 0050 71 8d 3d ba 3f d6 cf d1 2e ed ae 49 b2 5f a5 b1 q.=.?......I._.. 0060 43 bb 3a 77 17 0c db 55 02 1a d6 0a f3 a4 70 77 C.:w...U......pw 0070 87 54 96 67 71 a4 .T.gq. Frame 8 (118 bytes on wire, 118 bytes captured) Arrival Time: May 27, 2009 16:24:11.265092000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 0.642831000 seconds] Frame Number: 8 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x007c (124) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb3c [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xfd2c [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 4A241BF023A6DB41 Responder cookie: E52F14B2A2BE123D Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 51 89 a7 08 00 45 00 .$.1.=..)Q....E. 0010 00 68 00 7c 40 00 40 11 fb 3c a5 e3 f9 7a a5 e3 .h.|@.@..<...z.. 0020 f9 8a 01 f4 01 f4 00 54 fd 2c 4a 24 1b f0 23 a6 .......T.,J$..#. 0030 db 41 e5 2f 14 b2 a2 be 12 3d 05 10 02 01 00 00 .A./.....=...... 0040 00 00 00 00 00 4c 4c 4c c5 0c a8 21 9c e8 1d 5c .....LLL...!...\ 0050 71 8d 3d ba 3f d6 cf d1 2e ed ae 49 b2 5f a5 b1 q.=.?......I._.. 0060 43 bb 3a 77 17 0c db 55 02 1a d6 0a f3 a4 70 77 C.:w...U......pw 0070 87 54 96 67 71 a4 .T.gq. Frame 9 (118 bytes on wire, 118 bytes captured) Arrival Time: May 27, 2009 16:24:11.821785000 [Time delta from previous captured frame: 0.556693000 seconds] [Time delta from previous displayed frame: 0.556693000 seconds] [Time since reference or first frame: 1.199524000 seconds] Frame Number: 9 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb8 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xba51 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 4A241BF023A6DB41 Responder cookie: E52F14B2A2BE123D Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 51 89 a7 00 24 b2 31 e1 3d 08 00 45 00 ..)Q...$.1.=..E. 0010 00 68 00 00 40 00 40 11 fb b8 a5 e3 f9 8a a5 e3 .h..@.@......... 0020 f9 7a 01 f4 01 f4 00 54 ba 51 4a 24 1b f0 23 a6 .z.....T.QJ$..#. 0030 db 41 e5 2f 14 b2 a2 be 12 3d 05 10 02 01 00 00 .A./.....=...... 0040 00 00 00 00 00 4c 5f e1 42 91 0b 33 bd f3 9a 5c .....L_.B..3...\ 0050 1d 78 0c db b2 3d d7 ae aa 64 62 81 7b 45 aa b6 .x...=...db.{E.. 0060 9b e8 8b e6 8c 57 59 1c 69 6f 43 74 7d a9 4f 01 .....WY.ioCt}.O. 0070 36 9b 54 2d e8 56 6.T-.V Frame 10 (358 bytes on wire, 358 bytes captured) Arrival Time: May 27, 2009 16:24:11.827877000 [Time delta from previous captured frame: 0.006092000 seconds] [Time delta from previous displayed frame: 0.006092000 seconds] [Time since reference or first frame: 1.205616000 seconds] Frame Number: 10 Frame Length: 358 bytes Capture Length: 358 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 344 Identification: 0x007d (125) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa4b [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 324 Checksum: 0xb526 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 4A241BF023A6DB41 Responder cookie: E52F14B2A2BE123D Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x9ebfcd22 Length: 316 Encrypted payload (288 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 51 89 a7 08 00 45 00 .$.1.=..)Q....E. 0010 01 58 00 7d 40 00 40 11 fa 4b a5 e3 f9 7a a5 e3 .X.}@.@..K...z.. 0020 f9 8a 01 f4 01 f4 01 44 b5 26 4a 24 1b f0 23 a6 .......D.&J$..#. 0030 db 41 e5 2f 14 b2 a2 be 12 3d 08 10 20 01 9e bf .A./.....=.. ... 0040 cd 22 00 00 01 3c 11 a1 1f ea dd ca a1 84 5e d6 ."...<........^. 0050 7c 27 7a db 61 5b a5 d6 54 ea ea ff bb 98 68 f2 |'z.a[..T.....h. 0060 9c 92 01 0a 82 58 fa 21 aa f9 4c ec de 04 48 69 .....X.!..L...Hi 0070 f5 c9 2e 76 1e 83 8d b1 24 b2 13 10 5a 57 2d 3a ...v....$...ZW-: 0080 29 48 6e 47 f9 8d d9 b9 65 7f 1b 84 04 16 89 77 )HnG....e......w 0090 39 1e 48 73 73 ec 62 b4 ad 33 ca 12 a7 40 57 dd 9.Hss.b..3...@W. 00a0 65 56 5b 02 39 09 04 73 84 e1 70 81 64 dd c5 8e eV[.9..s..p.d... 00b0 bf b1 a0 81 84 a2 41 b7 ab 4b f9 56 0f 97 2c d8 ......A..K.V..,. 00c0 e5 7a a7 9d 2b 52 68 bd 74 4c 09 fb 9b 01 85 59 .z..+Rh.tL.....Y 00d0 0f d1 a9 40 ea 0d 68 dd 45 0b 19 1b d8 c6 ea 9d ...@..h.E....... 00e0 a3 bc d2 62 6a c8 b3 76 9d 56 5e f8 1f 48 bd 24 ...bj..v.V^..H.$ 00f0 12 28 df c7 3c 9b ab 3a 5c a5 dd b3 6c a6 0d 24 .(..<..:\...l..$ 0100 30 88 b0 fd 80 f9 f3 f2 45 1e 6b b5 16 95 68 ef 0.......E.k...h. 0110 9e f0 7e ed f5 c0 19 84 f9 b0 b4 2e 99 9d 58 72 ..~...........Xr 0120 53 9a d4 9c 3f 1d 23 96 fa 2c 74 56 27 94 f4 b2 S...?.#..,tV'... 0130 95 58 a4 58 0f 7a 4c d9 83 82 fc c1 97 fc b7 9d .X.X.zL......... 0140 64 ba 74 42 19 54 71 ab 48 da 73 7e 2a f4 49 cd d.tB.Tq.H.s~*.I. 0150 7d 79 87 d2 d5 08 80 fd e5 47 0d 2f 01 24 ab c1 }y.......G./.$.. 0160 6a 90 db be 26 ce j...&. Frame 11 (358 bytes on wire, 358 bytes captured) Arrival Time: May 27, 2009 16:24:11.827889000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 1.205628000 seconds] Frame Number: 11 Frame Length: 358 bytes Capture Length: 358 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 344 Identification: 0x007d (125) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa4b [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 324 Checksum: 0xb526 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 4A241BF023A6DB41 Responder cookie: E52F14B2A2BE123D Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x9ebfcd22 Length: 316 Encrypted payload (288 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 51 89 a7 08 00 45 00 .$.1.=..)Q....E. 0010 01 58 00 7d 40 00 40 11 fa 4b a5 e3 f9 7a a5 e3 .X.}@.@..K...z.. 0020 f9 8a 01 f4 01 f4 01 44 b5 26 4a 24 1b f0 23 a6 .......D.&J$..#. 0030 db 41 e5 2f 14 b2 a2 be 12 3d 08 10 20 01 9e bf .A./.....=.. ... 0040 cd 22 00 00 01 3c 11 a1 1f ea dd ca a1 84 5e d6 ."...<........^. 0050 7c 27 7a db 61 5b a5 d6 54 ea ea ff bb 98 68 f2 |'z.a[..T.....h. 0060 9c 92 01 0a 82 58 fa 21 aa f9 4c ec de 04 48 69 .....X.!..L...Hi 0070 f5 c9 2e 76 1e 83 8d b1 24 b2 13 10 5a 57 2d 3a ...v....$...ZW-: 0080 29 48 6e 47 f9 8d d9 b9 65 7f 1b 84 04 16 89 77 )HnG....e......w 0090 39 1e 48 73 73 ec 62 b4 ad 33 ca 12 a7 40 57 dd 9.Hss.b..3...@W. 00a0 65 56 5b 02 39 09 04 73 84 e1 70 81 64 dd c5 8e eV[.9..s..p.d... 00b0 bf b1 a0 81 84 a2 41 b7 ab 4b f9 56 0f 97 2c d8 ......A..K.V..,. 00c0 e5 7a a7 9d 2b 52 68 bd 74 4c 09 fb 9b 01 85 59 .z..+Rh.tL.....Y 00d0 0f d1 a9 40 ea 0d 68 dd 45 0b 19 1b d8 c6 ea 9d ...@..h.E....... 00e0 a3 bc d2 62 6a c8 b3 76 9d 56 5e f8 1f 48 bd 24 ...bj..v.V^..H.$ 00f0 12 28 df c7 3c 9b ab 3a 5c a5 dd b3 6c a6 0d 24 .(..<..:\...l..$ 0100 30 88 b0 fd 80 f9 f3 f2 45 1e 6b b5 16 95 68 ef 0.......E.k...h. 0110 9e f0 7e ed f5 c0 19 84 f9 b0 b4 2e 99 9d 58 72 ..~...........Xr 0120 53 9a d4 9c 3f 1d 23 96 fa 2c 74 56 27 94 f4 b2 S...?.#..,tV'... 0130 95 58 a4 58 0f 7a 4c d9 83 82 fc c1 97 fc b7 9d .X.X.zL......... 0140 64 ba 74 42 19 54 71 ab 48 da 73 7e 2a f4 49 cd d.tB.Tq.H.s~*.I. 0150 7d 79 87 d2 d5 08 80 fd e5 47 0d 2f 01 24 ab c1 }y.......G./.$.. 0160 6a 90 db be 26 ce j...&. Frame 12 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:24:11.902290000 [Time delta from previous captured frame: 0.074401000 seconds] [Time delta from previous displayed frame: 0.074401000 seconds] [Time since reference or first frame: 1.280029000 seconds] Frame Number: 12 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba8 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x9830 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 4A241BF023A6DB41 Responder cookie: E52F14B2A2BE123D Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xb70d8239 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 51 89 a7 00 24 b2 31 e1 3d 08 00 45 00 ..)Q...$.1.=..E. 0010 00 78 00 00 40 00 40 11 fb a8 a5 e3 f9 8a a5 e3 .x..@.@......... 0020 f9 7a 01 f4 01 f4 00 64 98 30 4a 24 1b f0 23 a6 .z.....d.0J$..#. 0030 db 41 e5 2f 14 b2 a2 be 12 3d 08 10 05 01 b7 0d .A./.....=...... 0040 82 39 00 00 00 5c 03 ff 7f aa 8c ee 44 13 9a 13 .9...\......D... 0050 2b 11 53 41 5c f2 ca b7 fa 57 1f 37 d1 da c1 a8 +.SA\....W.7.... 0060 97 84 4c dc f5 5c 06 57 02 19 f4 8b 1a a0 c2 78 ..L..\.W.......x 0070 9c c0 4c d8 14 63 44 ed 22 11 af ef 7d 01 8e cb ..L..cD."...}... 0080 92 7f 76 0f aa cb ..v... Frame 13 (342 bytes on wire, 342 bytes captured) Arrival Time: May 27, 2009 16:24:12.838188000 [Time delta from previous captured frame: 0.935898000 seconds] [Time delta from previous displayed frame: 0.935898000 seconds] [Time since reference or first frame: 2.215927000 seconds] Frame Number: 13 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfad8 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x8c63 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 4A241BF023A6DB41 Responder cookie: E52F14B2A2BE123D Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x9ebfcd22 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 51 89 a7 00 24 b2 31 e1 3d 08 00 45 00 ..)Q...$.1.=..E. 0010 01 48 00 00 40 00 40 11 fa d8 a5 e3 f9 8a a5 e3 .H..@.@......... 0020 f9 7a 01 f4 01 f4 01 34 8c 63 4a 24 1b f0 23 a6 .z.....4.cJ$..#. 0030 db 41 e5 2f 14 b2 a2 be 12 3d 08 10 20 01 9e bf .A./.....=.. ... 0040 cd 22 00 00 01 2c 6f 49 8f 87 8c 7c dd 5b b0 3a ."...,oI...|.[.: 0050 5b 00 6c ec 8e c3 32 2d 62 2b a0 1f 97 44 f3 74 [.l...2-b+...D.t 0060 4f f6 ed 2a d0 95 f0 ce 78 7c 7f 82 89 ac fe 29 O..*....x|.....) 0070 44 a3 71 c3 8a df e5 b5 f9 a0 21 bb ed bd 7d e6 D.q.......!...}. 0080 93 cb 97 bc 1b 6d 6b 2f 7e da a3 d4 b1 dc f9 07 .....mk/~....... 0090 f4 0d c3 b2 0e 3f e9 af 4d 2f 28 7e 49 4b 9f 89 .....?..M/(~IK.. 00a0 8b e6 8a 8d 77 bc 54 64 b9 e3 2d 22 49 48 fe cc ....w.Td..-"IH.. 00b0 c9 29 c6 d6 bc 69 b0 55 73 fd 04 da 8c 8d e0 c4 .)...i.Us....... 00c0 2e 7f 7d 7f d0 b4 9c b8 e3 58 8e d2 e4 68 bc 26 ..}......X...h.& 00d0 1d 7a ec f3 1b 4e 76 9e 14 07 93 e4 13 97 66 aa .z...Nv.......f. 00e0 34 a9 e0 b7 2b 2d 57 05 96 45 63 81 bc 69 8b 31 4...+-W..Ec..i.1 00f0 78 c0 40 44 84 b3 1f 2a cf af 5e b2 40 77 4f ab x.@D...*..^.@wO. 0100 ec a9 77 65 3e fd 68 5a 54 f8 9e 49 8e cb f0 f5 ..we>.hZT..I.... 0110 43 e5 36 8b 4e f3 9d 3a a8 11 3c c8 d9 94 40 9a C.6.N..:..<...@. 0120 43 96 4d fd bf 03 53 f5 09 2d a9 f4 00 ad a8 b2 C.M...S..-...... 0130 04 b3 e4 56 37 3c 47 b3 9d 40 50 7b e0 1b 55 60 ...V7.E 0060 82 c0 fc 96 08 1f a2 33 f9 83 00 7b 26 68 6d f6 .......3...{&hm. 0070 f7 91 55 82 4d f3 2d 70 f7 b8 89 82 82 e0 1a 25 ..U.M.-p.......% 0080 c9 db ee 85 c9 70 .....p Frame 21 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:24:13.154806000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 2.532545000 seconds] Frame Number: 21 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x000d (13) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7c7a [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x057b82bd ESP Sequence: 1 0000 00 24 b2 31 e1 3d 00 0c 29 51 89 a7 08 00 45 00 .$.1.=..)Q....E. 0010 00 78 00 0d 00 00 ff 32 7c 7a a5 e3 f9 7a a5 e3 .x.....2|z...z.. 0020 f9 8a 05 7b 82 bd 00 00 00 01 38 20 b9 c3 35 41 ...{......8 ..5A 0030 79 70 f8 a6 6e 7f 6a 18 21 90 78 e7 61 68 66 63 yp..n.j.!.x.ahfc 0040 12 75 a5 9e 3d f0 64 cc 22 36 b7 bd d0 84 c5 65 .u..=.d."6.....e 0050 b6 b8 41 48 ad dd 40 bd 4c 6f ae a9 72 3e a1 45 ..AH..@.Lo..r>.E 0060 82 c0 fc 96 08 1f a2 33 f9 83 00 7b 26 68 6d f6 .......3...{&hm. 0070 f7 91 55 82 4d f3 2d 70 f7 b8 89 82 82 e0 1a 25 ..U.M.-p.......% 0080 c9 db ee 85 c9 70 .....p Frame 22 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:24:15.938850000 [Time delta from previous captured frame: 2.784044000 seconds] [Time delta from previous displayed frame: 2.784044000 seconds] [Time since reference or first frame: 5.316589000 seconds] Frame Number: 22 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x000e (14) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7c79 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x057b82bd ESP Sequence: 2 0000 00 24 b2 31 e1 3d 00 0c 29 51 89 a7 08 00 45 00 .$.1.=..)Q....E. 0010 00 78 00 0e 00 00 ff 32 7c 79 a5 e3 f9 7a a5 e3 .x.....2|y...z.. 0020 f9 8a 05 7b 82 bd 00 00 00 02 26 cc 5c 0a 5d 96 ...{......&.\.]. 0030 53 da ea 0e 6d 0e 58 d2 ac 2a 5d 64 ce 39 f1 d0 S...m.X..*]d.9.. 0040 80 e7 6b bd 54 12 51 c0 de b1 85 53 1d 05 7b 2a ..k.T.Q....S..{* 0050 83 1c ec 9b 5b e8 5f f7 dd 04 7f 61 24 a1 fe ba ....[._....a$... 0060 85 cc 9e 60 96 cf 89 ac 03 a9 3a 25 46 3d 90 ac ...`......:%F=.. 0070 84 e0 34 b8 aa c7 76 38 ae d4 38 9e a9 e2 9a 82 ..4...v8..8..... 0080 96 7f a7 73 f1 90 ...s.. Frame 23 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:24:15.938865000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 5.316604000 seconds] Frame Number: 23 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x000e (14) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7c79 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x057b82bd ESP Sequence: 2 0000 00 24 b2 31 e1 3d 00 0c 29 51 89 a7 08 00 45 00 .$.1.=..)Q....E. 0010 00 78 00 0e 00 00 ff 32 7c 79 a5 e3 f9 7a a5 e3 .x.....2|y...z.. 0020 f9 8a 05 7b 82 bd 00 00 00 02 26 cc 5c 0a 5d 96 ...{......&.\.]. 0030 53 da ea 0e 6d 0e 58 d2 ac 2a 5d 64 ce 39 f1 d0 S...m.X..*]d.9.. 0040 80 e7 6b bd 54 12 51 c0 de b1 85 53 1d 05 7b 2a ..k.T.Q....S..{* 0050 83 1c ec 9b 5b e8 5f f7 dd 04 7f 61 24 a1 fe ba ....[._....a$... 0060 85 cc 9e 60 96 cf 89 ac 03 a9 3a 25 46 3d 90 ac ...`......:%F=.. 0070 84 e0 34 b8 aa c7 76 38 ae d4 38 9e a9 e2 9a 82 ..4...v8..8..... 0080 96 7f a7 73 f1 90 ...s.. Frame 24 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:24:15.943726000 [Time delta from previous captured frame: 0.004861000 seconds] [Time delta from previous displayed frame: 0.004861000 seconds] [Time since reference or first frame: 5.321465000 seconds] Frame Number: 24 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0xdbe2 (56290) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x5fa5 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload ESP SPI: 0x32850d4a ESP Sequence: 1 0000 00 0c 29 51 89 a7 00 24 b2 31 e1 3d 08 00 45 00 ..)Q...$.1.=..E. 0010 00 78 db e2 00 00 40 32 5f a5 a5 e3 f9 8a a5 e3 .x....@2_....... 0020 f9 7a 32 85 0d 4a 00 00 00 01 d7 56 ab f9 8d 8a .z2..J.....V.... 0030 42 ee 83 f0 bb 39 46 69 26 9b 0d ae d8 87 0c 55 B....9Fi&......U 0040 69 f3 92 91 2e d6 bc 91 da c4 62 1e 65 e3 ee 8c i.........b.e... 0050 30 05 be 07 69 df 05 64 a3 74 40 d6 3b d3 f0 7a 0...i..d.t@.;..z 0060 38 0e b3 44 e1 96 cd ad b9 4a 6e 08 56 91 dc 1f 8..D.....Jn.V... 0070 01 5b 93 cd 0f d4 81 cc a2 4e ce fa 7c f7 53 02 .[.......N..|.S. 0080 e9 79 58 0a f2 5b .yX..[ Frame 25 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:24:16.941458000 [Time delta from previous captured frame: 0.997732000 seconds] [Time delta from previous displayed frame: 0.997732000 seconds] [Time since reference or first frame: 6.319197000 seconds] Frame Number: 25 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x000f (15) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7c78 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x057b82bd ESP Sequence: 3 0000 00 24 b2 31 e1 3d 00 0c 29 51 89 a7 08 00 45 00 .$.1.=..)Q....E. 0010 00 78 00 0f 00 00 ff 32 7c 78 a5 e3 f9 7a a5 e3 .x.....2|x...z.. 0020 f9 8a 05 7b 82 bd 00 00 00 03 2d 73 93 f0 af 08 ...{......-s.... 0030 e0 27 a2 e3 0b a5 54 ab c2 c1 3c 6b b6 7b e7 6d .'....T...^...._1...Gx.. 0060 bd ef 86 24 26 97 73 51 a5 58 c8 cb fc c1 00 96 ...$&.sQ.X...... 0070 36 91 c1 27 f1 84 82 fe 8a cf 8b d0 27 fb 42 0a 6..'........'.B. 0080 61 2b 13 fa 19 8a a+.... Frame 26 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:24:16.941473000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 6.319212000 seconds] Frame Number: 26 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x000f (15) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7c78 [correct] [Good: True] [Bad : False] Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x057b82bd ESP Sequence: 3 0000 00 24 b2 31 e1 3d 00 0c 29 51 89 a7 08 00 45 00 .$.1.=..)Q....E. 0010 00 78 00 0f 00 00 ff 32 7c 78 a5 e3 f9 7a a5 e3 .x.....2|x...z.. 0020 f9 8a 05 7b 82 bd 00 00 00 03 2d 73 93 f0 af 08 ...{......-s.... 0030 e0 27 a2 e3 0b a5 54 ab c2 c1 3c 6b b6 7b e7 6d .'....T...^...._1...Gx.. 0060 bd ef 86 24 26 97 73 51 a5 58 c8 cb fc c1 00 96 ...$&.sQ.X...... 0070 36 91 c1 27 f1 84 82 fe 8a cf 8b d0 27 fb 42 0a 6..'........'.B. 0080 61 2b 13 fa 19 8a a+.... Frame 27 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:24:16.945825000 [Time delta from previous captured frame: 0.004352000 seconds] [Time delta from previous displayed frame: 0.004352000 seconds] [Time since reference or first frame: 6.323564000 seconds] Frame Number: 27 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Destination: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) Address: 00:0c:29:51:89:a7 (00:0c:29:51:89:a7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0xd4b3 (54451) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x66d4 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload ESP SPI: 0x32850d4a ESP Sequence: 2 0000 00 0c 29 51 89 a7 00 24 b2 31 e1 3d 08 00 45 00 ..)Q...$.1.=..E. 0010 00 78 d4 b3 00 00 40 32 66 d4 a5 e3 f9 8a a5 e3 .x....@2f....... 0020 f9 7a 32 85 0d 4a 00 00 00 02 75 76 7e f4 22 81 .z2..J....uv~.". 0030 c4 9a 3b d4 19 9a 91 9c ad 3e 60 cf f1 f4 2d 15 ..;......>`...-. 0040 5e cf d9 31 d2 aa af a4 99 30 9a 8d 3b 26 ce 5f ^..1.....0..;&._ 0050 11 ee 7f d7 5f f8 15 6c bc f4 a6 a3 25 11 24 72 ...._..l....%.$r 0060 8f 4b 4b b3 61 dc c1 22 a0 c7 06 f1 5f 5a e6 35 .KK.a.."...._Z.5 0070 af b2 64 06 67 6c 4a 85 78 78 7b 7f 07 31 7a 40 ..d.glJ.xx{..1z@ 0080 c7 cd 98 e2 39 48 ....9H