Frame 1 (174 bytes on wire, 174 bytes captured) Arrival Time: Jan 21, 2006 16:00:08.471940000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 174 bytes Capture Length: 174 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Trailer: 2181C5B4 Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 156 Identification: 0x0037 (55) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb44 [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 136 Checksum: 0x4a59 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x53BE8C35C89E5956 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 128 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 44 Vendor ID: Check Point Check Point Product: VPN-1 Version: NG with Application Intelligence R55 Check Point Vendor ID parameters 0000 00 13 c4 80 d3 aa 00 0c 29 89 f2 82 08 00 45 00 ........).....E. 0010 00 9c 00 37 40 00 40 11 fb 44 a5 e3 f9 7a a5 e3 ...7@.@..D...z.. 0020 f9 93 01 f4 01 f4 00 88 4a 59 53 be 8c 35 c8 9e ........JYS..5.. 0030 59 56 00 00 00 00 00 00 00 00 01 10 02 00 00 00 YV.............. 0040 00 00 00 00 00 80 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 00 00 ............p... 0080 00 2c f4 ed 19 e0 c1 14 eb 51 6f aa ac 0e e3 7d .,.......Qo....} 0090 af 28 07 b4 38 1f 00 00 00 01 00 00 13 8d 42 c2 .(..8.........B. 00a0 54 2a 00 00 00 00 18 00 00 00 21 81 c5 b4 T*........!... Frame 2 (150 bytes on wire, 150 bytes captured) Arrival Time: Jan 21, 2006 16:00:08.472851000 Time delta from previous packet: 0.000911000 seconds Time since reference or first frame: 0.000911000 seconds Frame Number: 2 Packet Length: 150 bytes Capture Length: 150 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 9EC178F3 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x2d0d (11533) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x4f86 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0x6cff [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x53BE8C35C89E5956 Responder cookie: 0x631F0C61190E69A7 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 24 Vendor ID: Microsoft L2TP/IPSec VPN Client 0000 00 0c 29 89 f2 82 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 84 2d 0d 00 00 ff 11 4f 86 a5 e3 f9 93 a5 e3 ..-.....O....... 0020 f9 7a 01 f4 01 f4 00 70 6c ff 53 be 8c 35 c8 9e .z.....pl.S..5.. 0030 59 56 63 1f 0c 61 19 0e 69 a7 01 10 02 00 00 00 YVc..a..i....... 0040 00 00 00 00 00 68 0d 00 00 34 00 00 00 01 00 00 .....h...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 00 00 00 18 40 48 ........p.....@H 0080 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3 c0 00 ..n...%......... 0090 00 00 9e c1 78 f3 ....x. Frame 3 (230 bytes on wire, 230 bytes captured) Arrival Time: Jan 21, 2006 16:00:08.587809000 Time delta from previous packet: 0.114958000 seconds Time since reference or first frame: 0.115869000 seconds Frame Number: 3 Packet Length: 230 bytes Capture Length: 230 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Trailer: B02265BA Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x0038 (56) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb0b [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x2ec6 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x53BE8C35C89E5956 Responder cookie: 0x631F0C61190E69A7 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 24 Nonce Data 0000 00 13 c4 80 d3 aa 00 0c 29 89 f2 82 08 00 45 00 ........).....E. 0010 00 d4 00 38 40 00 40 11 fb 0b a5 e3 f9 7a a5 e3 ...8@.@......z.. 0020 f9 93 01 f4 01 f4 00 c0 2e c6 53 be 8c 35 c8 9e ..........S..5.. 0030 59 56 63 1f 0c 61 19 0e 69 a7 04 10 02 00 00 00 YVc..a..i....... 0040 00 00 00 00 00 b8 0a 00 00 84 96 56 cd ea 8e 73 ...........V...s 0050 c7 31 67 5e 7b bd 1a b4 50 b1 9d 5d f6 b2 39 31 .1g^{...P..]..91 0060 63 7e 1c 86 6f 06 03 51 9d cc f2 1b ab 0b 68 f7 c~..o..Q......h. 0070 d3 d6 a3 ef c5 6f 77 ab 41 49 3d 57 ef 5e e2 ed .....ow.AI=W.^.. 0080 43 86 5f f9 03 ee 29 8d a4 7a f8 6d 44 2b 48 ef C._...)..z.mD+H. 0090 90 d4 38 6f 7f e6 fe 50 fd 49 62 29 7b a9 f3 ab ..8o...P.Ib){... 00a0 df e0 d2 47 e5 b1 f9 3c ef f4 a3 c1 f4 28 14 f9 ...G...<.....(.. 00b0 3f 7c a6 c1 02 8e 13 d1 25 c4 ba f6 6b b2 e9 f4 ?|......%...k... 00c0 89 da 28 0a 93 40 c4 27 fd 9c 00 00 00 18 81 11 ..(..@.'........ 00d0 bd 7a ec 78 6a 75 a2 67 bd 11 d4 40 cb d9 07 1b .z.xju.g...@.... 00e0 00 62 b0 22 65 ba .b."e. Frame 4 (302 bytes on wire, 302 bytes captured) Arrival Time: Jan 21, 2006 16:00:08.589328000 Time delta from previous packet: 0.001519000 seconds Time since reference or first frame: 0.117388000 seconds Frame Number: 4 Packet Length: 302 bytes Capture Length: 302 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 6BD98A6B Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x2d0e (11534) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x4eed [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0x7655 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x53BE8C35C89E5956 Responder cookie: 0x631F0C61190E69A7 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x12F5F28C457168A9702D9FE274CC0100 Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x96D8AB7C190F69A7DBB978A7C1EFD57B Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x1F07F70EAA6514D3B0FA96542A500100 0000 00 0c 29 89 f2 82 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 01 1c 2d 0e 00 00 ff 11 4e ed a5 e3 f9 93 a5 e3 ..-.....N....... 0020 f9 7a 01 f4 01 f4 01 08 76 55 53 be 8c 35 c8 9e .z......vUS..5.. 0030 59 56 63 1f 0c 61 19 0e 69 a7 04 10 02 00 00 00 YVc..a..i....... 0040 00 00 00 00 01 00 0a 00 00 84 53 06 cc 85 5c 12 ..........S...\. 0050 46 fe a7 5e 78 3e 9c 51 ac a8 2f 16 1f 6e fd bf F..^x>.Q../..n.. 0060 67 3b 56 da 04 f0 73 0d 93 68 f5 ea a3 5c ff c7 g;V...s..h...\.. 0070 1f 1a a2 09 cd bc 64 5e 08 66 0a e7 72 59 be 4a ......d^.f..rY.J 0080 2d 8a 52 3e 2d a4 dd 35 df 68 1b c2 a8 61 f4 09 -.R>-..5.h...a.. 0090 cb 37 9d ad cd e4 4b b1 57 ff 4f 67 61 1d 9c c2 .7....K.W.Oga... 00a0 a3 cc f1 2d f0 14 c0 5b 15 f8 83 be 0c 34 d6 ec ...-...[.....4.. 00b0 62 4e 20 43 d3 b2 4b d3 5e f8 23 86 25 15 a1 66 bN C..K.^.#.%..f 00c0 49 5a 5c ca 23 74 f0 65 c6 fd 0d 00 00 18 60 f4 IZ\.#t.e......`. 00d0 ff 86 4d c4 94 97 46 f5 c5 7c c6 a0 ee 9e cd f4 ..M...F..|...... 00e0 b6 06 0d 00 00 14 12 f5 f2 8c 45 71 68 a9 70 2d ..........Eqh.p- 00f0 9f e2 74 cc 01 00 0d 00 00 0c 09 00 26 89 df d6 ..t.........&... 0100 b7 12 0d 00 00 14 96 d8 ab 7c 19 0f 69 a7 db b9 .........|..i... 0110 78 a7 c1 ef d5 7b 00 00 00 14 1f 07 f7 0e aa 65 x....{.........e 0120 14 d3 b0 fa 96 54 2a 50 01 00 6b d9 8a 6b .....T*P..k..k Frame 5 (114 bytes on wire, 114 bytes captured) Arrival Time: Jan 21, 2006 16:00:08.605893000 Time delta from previous packet: 0.016565000 seconds Time since reference or first frame: 0.133953000 seconds Frame Number: 5 Packet Length: 114 bytes Capture Length: 114 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Trailer: 8CA54202 Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0039 (57) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb7e [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0xbd0a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x53BE8C35C89E5956 Responder cookie: 0x631F0C61190E69A7 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 89 f2 82 08 00 45 00 ........).....E. 0010 00 60 00 39 40 00 40 11 fb 7e a5 e3 f9 7a a5 e3 .`.9@.@..~...z.. 0020 f9 93 01 f4 01 f4 00 4c bd 0a 53 be 8c 35 c8 9e .......L..S..5.. 0030 59 56 63 1f 0c 61 19 0e 69 a7 05 10 02 01 00 00 YVc..a..i....... 0040 00 00 00 00 00 44 7c 38 3a 69 50 78 4e 89 b5 59 .....D|8:iPxN..Y 0050 d4 4b fa 37 a0 af 79 44 99 16 b0 a8 31 a4 aa 6b .K.7..yD....1..k 0060 a0 ae ee 95 b8 cd 2c f7 f8 15 7e 41 ff 74 8c a5 ......,...~A.t.. 0070 42 02 B. Frame 6 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 21, 2006 16:00:08.606753000 Time delta from previous packet: 0.000860000 seconds Time since reference or first frame: 0.134813000 seconds Frame Number: 6 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 8D5A2B29 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x2d0f (11535) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x4f98 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0x2b8d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x53BE8C35C89E5956 Responder cookie: 0x631F0C61190E69A7 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 84 Encrypted payload (56 bytes) 0000 00 0c 29 89 f2 82 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 70 2d 0f 00 00 ff 11 4f 98 a5 e3 f9 93 a5 e3 .p-.....O....... 0020 f9 7a 01 f4 01 f4 00 5c 2b 8d 53 be 8c 35 c8 9e .z.....\+.S..5.. 0030 59 56 63 1f 0c 61 19 0e 69 a7 05 10 02 01 00 00 YVc..a..i....... 0040 00 00 00 00 00 54 a7 82 a3 ed 7d d5 96 37 12 57 .....T....}..7.W 0050 ce 91 72 9d a9 6d ab 79 d7 b0 c8 50 40 41 7c 56 ..r..m.y...P@A|V 0060 44 f1 19 a2 ed 3a a4 df d1 20 24 68 eb 0f 72 b5 D....:... $h..r. 0070 b4 06 b5 ad 07 74 74 43 98 1e 06 dd 68 7f 8d 5a .....ttC....h..Z 0080 2b 29 +) Frame 7 (346 bytes on wire, 346 bytes captured) Arrival Time: Jan 21, 2006 16:00:08.648559000 Time delta from previous packet: 0.041806000 seconds Time since reference or first frame: 0.176619000 seconds Frame Number: 7 Packet Length: 346 bytes Capture Length: 346 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Trailer: 220D7725 Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x003a (58) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa95 [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x675e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x53BE8C35C89E5956 Responder cookie: 0x631F0C61190E69A7 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x444A0ED8 Length: 300 Encrypted payload (272 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 89 f2 82 08 00 45 00 ........).....E. 0010 01 48 00 3a 40 00 40 11 fa 95 a5 e3 f9 7a a5 e3 .H.:@.@......z.. 0020 f9 93 01 f4 01 f4 01 34 67 5e 53 be 8c 35 c8 9e .......4g^S..5.. 0030 59 56 63 1f 0c 61 19 0e 69 a7 08 10 20 01 44 4a YVc..a..i... .DJ 0040 0e d8 00 00 01 2c 28 fd 8f 2b ad f2 db 58 4b 24 .....,(..+...XK$ 0050 20 b9 d7 c7 f7 d8 a0 4b 7c 40 60 7b 2d f8 b4 ce ......K|@`{-... 0060 28 22 2e 14 5c 89 54 4c 46 bc 10 b0 44 fa c8 a3 ("..\.TLF...D... 0070 e5 44 8c 09 a6 61 a1 33 f0 50 a7 9f 86 f2 c3 a1 .D...a.3.P...... 0080 4f 38 20 be d7 96 24 9f 34 37 8d 0d 84 7a 4f 51 O8 ...$.47...zOQ 0090 42 e7 04 9c 1c 51 d0 61 2f 58 11 98 9a 3f 7a a2 B....Q.a/X...?z. 00a0 11 05 6b ef 5e 1d 6c 76 28 07 e9 75 a5 4a 31 4a ..k.^.lv(..u.J1J 00b0 a5 1d 07 e5 28 64 ad da e9 67 e2 1c 21 9d 29 fc ....(d...g..!.). 00c0 23 5f a1 97 30 38 d1 cf 2b 75 50 9c 32 4d 98 61 #_..08..+uP.2M.a 00d0 28 26 0e 7a c2 29 5a 9a 88 64 e3 8c 2b e5 c4 82 (&.z.)Z..d..+... 00e0 ad b5 fb 27 17 bd 9c 30 33 a8 ef 3d 6c 99 1e f4 ...'...03..=l... 00f0 af 29 0f 35 5e 5b 18 2c a1 7c 12 e8 86 a9 35 6b .).5^[.,.|....5k 0100 00 80 fc 0f c6 da d3 5d 1a d5 eb 40 db c3 08 92 .......]...@.... 0110 53 d4 3e ec 33 d0 17 20 04 75 a3 d9 c1 00 08 96 S.>.3.. .u...... 0120 f8 81 65 8a d8 72 04 a1 d8 5f 48 2a 01 a7 63 dc ..e..r..._H*..c. 0130 ee 88 26 93 29 27 b3 8e b6 b4 47 7c fa 74 cb 89 ..&.)'....G|.t.. 0140 e0 52 91 97 f8 fa 26 00 75 ca 6c 21 e2 67 7d 6f .R....&.u.l!.g}o 0150 92 6c 1f 6a 6e d7 22 0d 77 25 .l.jn.".w% Frame 8 (338 bytes on wire, 338 bytes captured) Arrival Time: Jan 21, 2006 16:00:08.651256000 Time delta from previous packet: 0.002697000 seconds Time since reference or first frame: 0.179316000 seconds Frame Number: 8 Packet Length: 338 bytes Capture Length: 338 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 4F3E3A93 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x2d11 (11537) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x4ec6 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0xdde5 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x53BE8C35C89E5956 Responder cookie: 0x631F0C61190E69A7 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x444A0ED8 Length: 292 Encrypted payload (264 bytes) 0000 00 0c 29 89 f2 82 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 01 40 2d 11 00 00 ff 11 4e c6 a5 e3 f9 93 a5 e3 .@-.....N....... 0020 f9 7a 01 f4 01 f4 01 2c dd e5 53 be 8c 35 c8 9e .z.....,..S..5.. 0030 59 56 63 1f 0c 61 19 0e 69 a7 08 10 20 01 44 4a YVc..a..i... .DJ 0040 0e d8 00 00 01 24 1c d9 aa df 49 5a 88 8b 0c 14 .....$....IZ.... 0050 c6 b0 ea 1e e4 55 28 25 d5 03 8d 1c a5 54 ef 56 .....U(%.....T.V 0060 ab d7 16 75 4d 4b bb ac 1f 1d 8b 6e 2c 33 c4 a7 ...uMK.....n,3.. 0070 21 56 5d 23 0b c9 a6 fe 9e 72 1b a9 b0 69 eb 0b !V]#.....r...i.. 0080 37 47 c4 49 a5 f7 ca a4 01 23 48 4c 25 9e 2f a8 7G.I.....#HL%./. 0090 dd 97 78 fe 2c 1f 61 bb d7 97 55 7b b8 4a b4 88 ..x.,.a...U{.J.. 00a0 d3 be c2 02 07 cb 5c 20 ef 3e 61 ec 57 3e 96 bb ......\ .>a.W>.. 00b0 ab 9f 2c 3a 45 63 bc 89 40 93 e2 ee fc 72 b6 c0 ..,:Ec..@....r.. 00c0 39 93 7f 86 80 0b 22 40 8c 28 af 8c b3 83 a1 cf 9....."@.(...... 00d0 93 c0 4d 6c a1 15 5c bb c5 d3 d0 1f 58 f8 4b 70 ..Ml..\.....X.Kp 00e0 0f 50 6d be c6 db d9 fa a1 17 e4 e9 1c 16 4a 9d .Pm...........J. 00f0 ee 6b 0a 83 47 ad 01 3b a4 76 03 99 16 d5 2d be .k..G..;.v....-. 0100 14 48 5b a4 62 c0 57 47 d6 25 15 47 38 d4 67 ec .H[.b.WG.%.G8.g. 0110 7e 9d 1a e4 01 f0 f1 a6 19 70 8b db 4a ee 25 9e ~........p..J.%. 0120 5d e1 00 fb 0f 43 d4 d1 81 62 94 9b 29 24 9c 6f ]....C...b..)$.o 0130 42 2b 76 1c 66 b5 b0 ce fe 0b ff d2 9d 10 6f e5 B+v.f.........o. 0140 68 74 fb fb 15 88 d6 63 f6 fc de 19 fc 25 4f 3e ht.....c.....%O> 0150 3a 93 :. Frame 9 (106 bytes on wire, 106 bytes captured) Arrival Time: Jan 21, 2006 16:00:08.662991000 Time delta from previous packet: 0.011735000 seconds Time since reference or first frame: 0.191051000 seconds Frame Number: 9 Packet Length: 106 bytes Capture Length: 106 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Trailer: B8780349 Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x003b (59) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb84 [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x203c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x53BE8C35C89E5956 Responder cookie: 0x631F0C61190E69A7 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x444A0ED8 Length: 60 Encrypted payload (32 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 89 f2 82 08 00 45 00 ........).....E. 0010 00 58 00 3b 40 00 40 11 fb 84 a5 e3 f9 7a a5 e3 .X.;@.@......z.. 0020 f9 93 01 f4 01 f4 00 44 20 3c 53 be 8c 35 c8 9e .......D Frame 14 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 21, 2006 16:00:09.199579000 Time delta from previous packet: 0.200904000 seconds Time since reference or first frame: 0.727639000 seconds Frame Number: 14 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Trailer: D9F7121F Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x001e (30) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7c68 [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.147 (165.227.249.147) Encapsulating Security Payload SPI: 0x163993ba Sequence: 2 Data (84 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 89 f2 82 08 00 45 00 ........).....E. 0010 00 70 00 1e 00 00 ff 32 7c 68 a5 e3 f9 7a a5 e3 .p.....2|h...z.. 0020 f9 93 16 39 93 ba 00 00 00 02 24 91 64 d4 d0 2c ...9......$.d.., 0030 ae 97 27 e0 05 63 85 33 76 b4 b5 ac fc 0f 6e 1b ..'..c.3v.....n. 0040 22 4b 4a 9a 45 d7 b5 8f 4b a9 51 0f c4 c5 5c 0a "KJ.E...K.Q...\. 0050 3e f6 9b c5 9e 11 cd c6 be 5a 4c cd 08 95 dc a9 >........ZL..... 0060 27 e0 48 ea a2 40 48 02 47 dc 5d 99 01 42 c0 32 '.H..@H.G.]..B.2 0070 00 6b 74 e4 8a c1 f9 71 f5 06 a5 70 65 ba d9 f7 .kt....q...pe... 0080 12 1f .. Frame 15 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 21, 2006 16:00:09.199588000 Time delta from previous packet: 0.000009000 seconds Time since reference or first frame: 0.727648000 seconds Frame Number: 15 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 00C133BF Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x132d (4909) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x285a [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0x16b1052f Sequence: 2 Data (84 bytes) 0000 00 0c 29 89 f2 82 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 70 13 2d 00 00 40 32 28 5a a5 e3 f9 93 a5 e3 .p.-..@2(Z...... 0020 f9 7a 16 b1 05 2f 00 00 00 02 87 08 cd fa ca d1 .z.../.......... 0030 71 08 68 ff 59 79 0c 93 c7 9f 31 cb a5 c1 75 8b q.h.Yy....1...u. 0040 bb 75 90 b0 80 74 70 9f 07 ce 72 60 00 3f 84 ea .u...tp...r`.?.. 0050 4e 74 a8 f1 a8 1e 8d dd 8b 14 d3 98 b9 70 2d c6 Nt...........p-. 0060 67 86 9d 89 e4 cb 05 f1 92 0c f9 9f f4 5f c1 21 g............_.! 0070 79 71 4a 81 44 16 14 7b cc a7 17 54 a6 85 00 c1 yqJ.D..{...T.... 0080 33 bf 3. Frame 16 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 21, 2006 16:00:10.164462000 Time delta from previous packet: 0.964874000 seconds Time since reference or first frame: 1.692522000 seconds Frame Number: 16 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Trailer: FBFCD442 Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x001f (31) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7c67 [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.147 (165.227.249.147) Encapsulating Security Payload SPI: 0x163993ba Sequence: 3 Data (84 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 89 f2 82 08 00 45 00 ........).....E. 0010 00 70 00 1f 00 00 ff 32 7c 67 a5 e3 f9 7a a5 e3 .p.....2|g...z.. 0020 f9 93 16 39 93 ba 00 00 00 03 14 7d 24 50 db ff ...9.......}$P.. 0030 63 25 da d9 c3 9b 55 3f 2a 7f 3a 60 da 57 75 ce c%....U?*.:`.Wu. 0040 d6 b0 9d 67 67 c5 48 2c 27 0a 12 de 69 80 8a 80 ...gg.H,'...i... 0050 68 16 75 e5 f4 18 b3 f4 08 3a d2 5a 99 b9 b4 f4 h.u......:.Z.... 0060 25 ba 7c f2 28 fc 3b f2 c2 4a 08 47 c3 db 2c 19 %.|.(.;..J.G..,. 0070 43 a0 25 1b 13 fd f3 9b 4f ad f0 85 fe ed fb fc C.%.....O....... 0080 d4 42 .B Frame 17 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 21, 2006 16:00:10.164847000 Time delta from previous packet: 0.000385000 seconds Time since reference or first frame: 1.692907000 seconds Frame Number: 17 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 67EEEC4F Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x142d (5165) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x275a [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0x16b1052f Sequence: 3 Data (84 bytes) 0000 00 0c 29 89 f2 82 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 70 14 2d 00 00 40 32 27 5a a5 e3 f9 93 a5 e3 .p.-..@2'Z...... 0020 f9 7a 16 b1 05 2f 00 00 00 03 01 30 b4 00 7a 69 .z.../.....0..zi 0030 bd f0 c5 db cb f7 b7 bc a7 3d 62 b0 a1 ca f6 58 .........=b....X 0040 0e 86 d1 86 63 c0 2d 5d fa d2 36 88 c3 fd aa 51 ....c.-]..6....Q 0050 ee c7 13 02 fe 47 b2 0e 25 2b 02 f3 12 40 60 ae .....G..%+...@`. 0060 77 c8 87 40 95 3a 26 46 d2 57 80 32 dc a8 ad a7 w..@.:&F.W.2.... 0070 75 a7 fa 7e fe cc a6 c0 a5 bb ac 03 fd a7 67 ee u..~..........g. 0080 ec 4f .O Frame 18 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 21, 2006 16:00:11.195230000 Time delta from previous packet: 1.030383000 seconds Time since reference or first frame: 2.723290000 seconds Frame Number: 18 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Trailer: 9D2B44CF Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0020 (32) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7c66 [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.147 (165.227.249.147) Encapsulating Security Payload SPI: 0x163993ba Sequence: 4 Data (84 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 89 f2 82 08 00 45 00 ........).....E. 0010 00 70 00 20 00 00 ff 32 7c 66 a5 e3 f9 7a a5 e3 .p. ...2|f...z.. 0020 f9 93 16 39 93 ba 00 00 00 04 47 9a f8 79 9d f9 ...9......G..y.. 0030 6b 76 30 a4 d6 a3 6e 89 85 1b 3a 27 9c 58 b8 0f kv0...n...:'.X.. 0040 5c 1e e4 84 4b f7 ea d5 fd d8 cd a5 1f cd c7 3c \...K..........< 0050 5f 1b bb 67 36 7d 45 bb f5 94 fe 45 a0 17 0d 42 _..g6}E....E...B 0060 d7 d5 ff de 37 ce ba 70 19 fe e9 81 89 6f 36 52 ....7..p.....o6R 0070 ff 06 87 bf 74 fb 2f a6 b1 39 36 7f 6d 4e 9d 2b ....t./..96.mN.+ 0080 44 cf D. Frame 19 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 21, 2006 16:00:11.195562000 Time delta from previous packet: 0.000332000 seconds Time since reference or first frame: 2.723622000 seconds Frame Number: 19 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 84E56145 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x152d (5421) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x265a [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0x16b1052f Sequence: 4 Data (84 bytes) 0000 00 0c 29 89 f2 82 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 70 15 2d 00 00 40 32 26 5a a5 e3 f9 93 a5 e3 .p.-..@2&Z...... 0020 f9 7a 16 b1 05 2f 00 00 00 04 4d 52 e2 cc 29 04 .z.../....MR..). 0030 89 9b 20 34 97 2a b8 e1 a6 eb 6d b0 84 a2 f8 40 .. 4.*....m....@ 0040 5b 3b 31 f2 e6 ac 36 49 74 22 18 0c 32 f5 2c 72 [;1...6It"..2.,r 0050 32 b9 f6 91 76 c7 a2 a9 d1 d6 17 4b 20 89 6e 71 2...v......K .nq 0060 e5 e8 88 da ca c0 c1 0d f9 28 f8 98 97 d8 80 30 .........(.....0 0070 b4 e9 d2 f4 5f 96 83 b6 55 4e 3f 93 25 eb 84 e5 ...._...UN?.%... 0080 61 45 aE