Frame 1 (174 bytes on wire, 174 bytes captured) Arrival Time: Apr 30, 2006 15:38:39.312819000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 174 bytes Capture Length: 174 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82), Dst: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec) Destination: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0x9fd8d650 [correct] Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.149 (165.227.249.149) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 156 Identification: 0x005d (93) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb1c [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.149 (165.227.249.149) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 136 Checksum: 0x97d5 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x59AA3FF380F796CF Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 128 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 44 Vendor ID: Check Point Check Point Product: VPN-1 Version: NG with Application Intelligence R55 Check Point Vendor ID parameters 0000 00 50 c2 4b ae ec 00 0c 29 89 f2 82 08 00 45 00 .P.K....).....E. 0010 00 9c 00 5d 40 00 40 11 fb 1c a5 e3 f9 7a a5 e3 ...]@.@......z.. 0020 f9 95 01 f4 01 f4 00 88 97 d5 59 aa 3f f3 80 f7 ..........Y.?... 0030 96 cf 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 80 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 00 00 ............p... 0080 00 2c f4 ed 19 e0 c1 14 eb 51 6f aa ac 0e e3 7d .,.......Qo....} 0090 af 28 07 b4 38 1f 00 00 00 01 00 00 13 8d 42 c2 .(..8.........B. 00a0 57 30 00 00 00 00 18 00 00 00 9f d8 d6 50 W0...........P Frame 2 (130 bytes on wire, 130 bytes captured) Arrival Time: Apr 30, 2006 15:38:39.343687000 Time delta from previous packet: 0.030868000 seconds Time since reference or first frame: 0.030868000 seconds Frame Number: 2 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec), Dst: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec) Type: IP (0x0800) Frame check sequence: 0x4d814c37 [correct] Internet Protocol, Src: 165.227.249.149 (165.227.249.149), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba5 [correct] Good: True Bad : False Source: 165.227.249.149 (165.227.249.149) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0x9bcc [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x59AA3FF380F796CF Responder cookie: 0x708C78FEA190ED85 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 84 Security Association payload Next payload: NONE (0) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0c 29 89 f2 82 00 50 c2 4b ae ec 08 00 45 00 ..)....P.K....E. 0010 00 70 00 00 40 00 40 11 fb a5 a5 e3 f9 95 a5 e3 .p..@.@......... 0020 f9 7a 01 f4 01 f4 00 5c 9b cc 59 aa 3f f3 80 f7 .z.....\..Y.?... 0030 96 cf 70 8c 78 fe a1 90 ed 85 01 10 02 00 00 00 ..p.x........... 0040 00 00 00 00 00 54 00 00 00 38 00 00 00 01 00 00 .....T...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 4d 81 ............p.M. 0080 4c 37 L7 Frame 3 (230 bytes on wire, 230 bytes captured) Arrival Time: Apr 30, 2006 15:38:39.348280000 Time delta from previous packet: 0.004593000 seconds Time since reference or first frame: 0.035461000 seconds Frame Number: 3 Packet Length: 230 bytes Capture Length: 230 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82), Dst: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec) Destination: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0xdda9e45f [correct] Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.149 (165.227.249.149) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x005e (94) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfae3 [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.149 (165.227.249.149) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x5267 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x59AA3FF380F796CF Responder cookie: 0x708C78FEA190ED85 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 24 Nonce Data 0000 00 50 c2 4b ae ec 00 0c 29 89 f2 82 08 00 45 00 .P.K....).....E. 0010 00 d4 00 5e 40 00 40 11 fa e3 a5 e3 f9 7a a5 e3 ...^@.@......z.. 0020 f9 95 01 f4 01 f4 00 c0 52 67 59 aa 3f f3 80 f7 ........RgY.?... 0030 96 cf 70 8c 78 fe a1 90 ed 85 04 10 02 00 00 00 ..p.x........... 0040 00 00 00 00 00 b8 0a 00 00 84 25 e9 b9 c4 fa 81 ..........%..... 0050 2a cd 4f 02 fb 82 50 00 84 40 f5 5b d3 05 a5 1a *.O...P..@.[.... 0060 ab df 4f f2 b0 9e 25 f3 5d 84 7c c0 33 26 81 33 ..O...%.].|.3&.3 0070 e6 6b 35 bc 61 07 d5 34 c8 86 be 66 75 01 5b 3a .k5.a..4...fu.[: 0080 e5 d0 19 de ba fc 06 87 7a c6 95 69 0f e1 df 63 ........z..i...c 0090 2d 6d 03 5b 94 89 47 59 43 48 a8 e4 af 08 d3 8b -m.[..GYCH...... 00a0 45 cf f5 cb 2c b9 56 2c 11 33 c7 ca f7 e2 79 93 E...,.V,.3....y. 00b0 42 d1 85 c1 78 cf 70 67 f5 32 80 79 f3 ad ca e6 B...x.pg.2.y.... 00c0 94 fe 62 c8 1a 49 8f d0 17 0c 00 00 00 18 0e e1 ..b..I.......... 00d0 7b 33 c0 ac 61 5e 0f ef c3 8d c7 62 ee 7d 3f e5 {3..a^.....b.}?. 00e0 38 aa dd a9 e4 5f 8...._ Frame 4 (226 bytes on wire, 226 bytes captured) Arrival Time: Apr 30, 2006 15:38:39.544970000 Time delta from previous packet: 0.196690000 seconds Time since reference or first frame: 0.232151000 seconds Frame Number: 4 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec), Dst: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec) Type: IP (0x0800) Frame check sequence: 0xed5b1a61 [correct] Internet Protocol, Src: 165.227.249.149 (165.227.249.149), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb45 [correct] Good: True Bad : False Source: 165.227.249.149 (165.227.249.149) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xec99 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x59AA3FF380F796CF Responder cookie: 0x708C78FEA190ED85 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 89 f2 82 00 50 c2 4b ae ec 08 00 45 00 ..)....P.K....E. 0010 00 d0 00 00 40 00 40 11 fb 45 a5 e3 f9 95 a5 e3 ....@.@..E...... 0020 f9 7a 01 f4 01 f4 00 bc ec 99 59 aa 3f f3 80 f7 .z........Y.?... 0030 96 cf 70 8c 78 fe a1 90 ed 85 04 10 02 00 00 00 ..p.x........... 0040 00 00 00 00 00 b4 0a 00 00 84 ed d9 a8 fc c3 c0 ................ 0050 26 65 32 07 9e fe e2 a6 79 f9 d2 03 c9 4c 8f d6 &e2.....y....L.. 0060 e4 f4 49 e5 5c 39 14 c0 e1 35 80 9d c8 5e 0b 05 ..I.\9...5...^.. 0070 d8 1f ff e8 59 f9 72 11 d5 5f 7a 0e 05 71 c6 fd ....Y.r.._z..q.. 0080 09 3e a4 fd b2 b7 ef 5e a6 0c 21 4f 77 ca 4e df .>.....^..!Ow.N. 0090 79 b1 45 15 6d a0 17 e8 dd 92 74 69 ad 37 19 5b y.E.m.....ti.7.[ 00a0 8a e9 a8 e9 20 72 5b 2f 5f 4d 12 aa 69 bb fe 3f .... r[/_M..i..? 00b0 bb e8 1d 76 e9 0b 7b c2 7b b6 bd 6f 70 ad 15 a9 ...v..{.{..op... 00c0 fc 1f 53 33 cd 73 c0 04 8f 6a 00 00 00 14 98 ba ..S3.s...j...... 00d0 bb b1 b2 f9 8c 91 c4 8c e6 b9 9c 6b 1a cd ed 5b ...........k...[ 00e0 1a 61 .a Frame 5 (114 bytes on wire, 114 bytes captured) Arrival Time: Apr 30, 2006 15:38:39.549450000 Time delta from previous packet: 0.004480000 seconds Time since reference or first frame: 0.236631000 seconds Frame Number: 5 Packet Length: 114 bytes Capture Length: 114 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82), Dst: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec) Destination: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0x588c571e [correct] Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.149 (165.227.249.149) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x005f (95) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb56 [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.149 (165.227.249.149) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x8f4c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x59AA3FF380F796CF Responder cookie: 0x708C78FEA190ED85 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 50 c2 4b ae ec 00 0c 29 89 f2 82 08 00 45 00 .P.K....).....E. 0010 00 60 00 5f 40 00 40 11 fb 56 a5 e3 f9 7a a5 e3 .`._@.@..V...z.. 0020 f9 95 01 f4 01 f4 00 4c 8f 4c 59 aa 3f f3 80 f7 .......L.LY.?... 0030 96 cf 70 8c 78 fe a1 90 ed 85 05 10 02 01 00 00 ..p.x........... 0040 00 00 00 00 00 44 31 37 fb fa 57 80 1b 32 e1 23 .....D17..W..2.# 0050 f5 25 bc e6 d5 a6 67 6f b0 51 82 52 0e 2b 98 6f .%....go.Q.R.+.o 0060 ff dd d6 88 c3 12 d6 77 15 04 68 8b c5 03 58 8c .......w..h...X. 0070 57 1e W. Frame 6 (114 bytes on wire, 114 bytes captured) Arrival Time: Apr 30, 2006 15:38:39.784950000 Time delta from previous packet: 0.235500000 seconds Time since reference or first frame: 0.472131000 seconds Frame Number: 6 Packet Length: 114 bytes Capture Length: 114 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec), Dst: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec) Type: IP (0x0800) Frame check sequence: 0x02163126 [correct] Internet Protocol, Src: 165.227.249.149 (165.227.249.149), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb5 [correct] Good: True Bad : False Source: 165.227.249.149 (165.227.249.149) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0xd938 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x59AA3FF380F796CF Responder cookie: 0x708C78FEA190ED85 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 89 f2 82 00 50 c2 4b ae ec 08 00 45 00 ..)....P.K....E. 0010 00 60 00 00 40 00 40 11 fb b5 a5 e3 f9 95 a5 e3 .`..@.@......... 0020 f9 7a 01 f4 01 f4 00 4c d9 38 59 aa 3f f3 80 f7 .z.....L.8Y.?... 0030 96 cf 70 8c 78 fe a1 90 ed 85 05 10 02 01 00 00 ..p.x........... 0040 00 00 00 00 00 44 e2 36 70 0d 6f 2d 8c 14 92 fb .....D.6p.o-.... 0050 f9 25 88 76 7f f5 83 7b 74 b2 e4 86 fd c4 60 a2 .%.v...{t.....`. 0060 f3 0f a5 3f 6a 24 51 04 10 f3 68 7c c7 ea 02 16 ...?j$Q...h|.... 0070 31 26 1& Frame 7 (346 bytes on wire, 346 bytes captured) Arrival Time: Apr 30, 2006 15:38:39.789383000 Time delta from previous packet: 0.004433000 seconds Time since reference or first frame: 0.476564000 seconds Frame Number: 7 Packet Length: 346 bytes Capture Length: 346 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82), Dst: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec) Destination: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec) Source: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Type: IP (0x0800) Frame check sequence: 0xe172dc2e [correct] Internet Protocol, Src: 165.227.249.122 (165.227.249.122), Dst: 165.227.249.149 (165.227.249.149) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0060 (96) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa6d [correct] Good: True Bad : False Source: 165.227.249.122 (165.227.249.122) Destination: 165.227.249.149 (165.227.249.149) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x5e3a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x59AA3FF380F796CF Responder cookie: 0x708C78FEA190ED85 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x877048FA Length: 300 Encrypted payload (272 bytes) 0000 00 50 c2 4b ae ec 00 0c 29 89 f2 82 08 00 45 00 .P.K....).....E. 0010 01 48 00 60 40 00 40 11 fa 6d a5 e3 f9 7a a5 e3 .H.`@.@..m...z.. 0020 f9 95 01 f4 01 f4 01 34 5e 3a 59 aa 3f f3 80 f7 .......4^:Y.?... 0030 96 cf 70 8c 78 fe a1 90 ed 85 08 10 20 01 87 70 ..p.x....... ..p 0040 48 fa 00 00 01 2c 61 8f 0e ee 6e 5e c4 0c b6 cc H....,a...n^.... 0050 62 d7 78 ea f8 e6 c7 c7 f2 66 fe f5 9f 49 e7 7d b.x......f...I.} 0060 5d b0 f1 49 b0 27 bd 2c c7 33 57 12 a8 92 00 5e ]..I.'.,.3W....^ 0070 17 3b 19 5d d0 c4 f8 ed 11 5b ab 26 8f 7a 66 40 .;.].....[.&.zf@ 0080 9e 3f 02 1c dc 82 30 f5 a5 c0 bf 5d d6 8f 12 ce .?....0....].... 0090 dc 20 35 01 e2 56 af 2c 01 9f f5 fa e2 2a 2b 1d . 5..V.,.....*+. 00a0 48 66 99 23 8a f5 ed 10 0b 39 e4 24 40 f1 f1 68 Hf.#.....9.$@..h 00b0 0e 69 16 be 0d d2 1e 15 06 bc 36 4b 03 75 56 fa .i........6K.uV. 00c0 c5 f3 7a 15 db 90 7c 8f 11 9b 2f 8c e2 ea b6 87 ..z...|.../..... 00d0 d9 f2 1f aa 98 b0 b1 1d 47 07 be 56 85 e5 cc 72 ........G..V...r 00e0 f7 71 56 7f 7e ad 58 15 3b 39 90 03 f5 d9 27 bc .qV.~.X.;9....'. 00f0 ba 54 7e f9 c3 70 30 e2 3b 37 2e 3b a9 7c 74 a1 .T~..p0.;7.;.|t. 0100 77 2c 88 72 e3 9c 8f ff ae a2 02 8e 90 1d 26 cf w,.r..........&. 0110 f3 e3 96 f4 72 cf 43 1b 3c 3b 44 f7 b0 d6 1f 8a ....r.C.<;D..... 0120 7f 12 89 5f 01 39 4c d6 06 bf 30 e5 8c e0 03 f4 ..._.9L...0..... 0130 a5 65 8a 50 6c c4 a4 1f 2e 80 08 c0 17 75 e8 0f .e.Pl........u.. 0140 3c e0 f8 81 67 80 b9 7b d2 56 2e 0b bc d5 8a ab <...g..{.V...... 0150 5c 12 26 94 9d 52 e1 72 dc 2e \.&..R.r.. Frame 8 (130 bytes on wire, 130 bytes captured) Arrival Time: Apr 30, 2006 15:38:39.801552000 Time delta from previous packet: 0.012169000 seconds Time since reference or first frame: 0.488733000 seconds Frame Number: 8 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec), Dst: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec) Type: IP (0x0800) Frame check sequence: 0xdff9a2de [correct] Internet Protocol, Src: 165.227.249.149 (165.227.249.149), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba5 [correct] Good: True Bad : False Source: 165.227.249.149 (165.227.249.149) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0xfe23 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x59AA3FF380F796CF Responder cookie: 0x708C78FEA190ED85 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xDB4586F4 Length: 84 Encrypted payload (56 bytes) 0000 00 0c 29 89 f2 82 00 50 c2 4b ae ec 08 00 45 00 ..)....P.K....E. 0010 00 70 00 00 40 00 40 11 fb a5 a5 e3 f9 95 a5 e3 .p..@.@......... 0020 f9 7a 01 f4 01 f4 00 5c fe 23 59 aa 3f f3 80 f7 .z.....\.#Y.?... 0030 96 cf 70 8c 78 fe a1 90 ed 85 08 10 05 01 db 45 ..p.x..........E 0040 86 f4 00 00 00 54 19 b3 b7 7d 6a 6a 9e f9 cd f8 .....T...}jj.... 0050 f1 b3 ff 50 a4 79 44 c9 59 db f5 38 40 19 98 10 ...P.yD.Y..8@... 0060 80 28 c5 e0 50 2a 3a 52 73 f7 c0 d1 9c 01 5e 58 .(..P*:Rs.....^X 0070 6c 1d 59 59 d6 e5 8e c8 ad 28 0c 53 96 4f df f9 l.YY.....(.S.O.. 0080 a2 de .. Frame 9 (346 bytes on wire, 346 bytes captured) Arrival Time: Apr 30, 2006 15:38:40.107194000 Time delta from previous packet: 0.305642000 seconds Time since reference or first frame: 0.794375000 seconds Frame Number: 9 Packet Length: 346 bytes Capture Length: 346 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec), Dst: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec) Type: IP (0x0800) Frame check sequence: 0x6d1baa8c [correct] Internet Protocol, Src: 165.227.249.149 (165.227.249.149), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfacd [correct] Good: True Bad : False Source: 165.227.249.149 (165.227.249.149) Destination: 165.227.249.122 (165.227.249.122) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xeec2 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x59AA3FF380F796CF Responder cookie: 0x708C78FEA190ED85 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x877048FA Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 89 f2 82 00 50 c2 4b ae ec 08 00 45 00 ..)....P.K....E. 0010 01 48 00 00 40 00 40 11 fa cd a5 e3 f9 95 a5 e3 .H..@.@......... 0020 f9 7a 01 f4 01 f4 01 34 ee c2 59 aa 3f f3 80 f7 .z.....4..Y.?... 0030 96 cf 70 8c 78 fe a1 90 ed 85 08 10 20 01 87 70 ..p.x....... ..p 0040 48 fa 00 00 01 2c 43 22 0d 16 26 1d cd 7a 4e a1 H....,C"..&..zN. 0050 d1 28 df de 9a 3c 52 65 5d 5a ca 5b c9 cc ff b0 .(...;.W.p....l.D 00a0 d6 2c 1d 4b 19 5a c4 48 ac 45 02 e9 e6 46 16 b6 .,.K.Z.H.E...F.. 00b0 92 cd 13 9f 2b 34 67 38 3d 7f 39 e0 ee ca 09 16 ....+4g8=.9..... 00c0 82 4d b3 20 19 3c 84 d8 bc 41 d2 a4 98 64 9e 23 .M. .<...A...d.# 00d0 e8 91 a6 7e 02 d0 f2 c7 a5 4d e9 de 9a b4 38 fc ...~.....M....8. 00e0 9f 7f 22 42 81 d3 15 8d 8b 07 05 fd 25 2f 1d a4 .."B........%/.. 00f0 56 ca 74 56 57 6a 61 85 af ac 1a d0 c2 fd e9 15 V.tVWja......... 0100 39 9d b2 23 9c bc d6 e6 e5 57 95 23 89 05 04 1f 9..#.....W.#.... 0110 51 23 6d bd ff c5 21 ad aa f7 07 a5 74 0b 08 69 Q#m...!.....t..i 0120 db e2 0c 61 51 e4 3a 3e e8 c4 4d fe d8 84 cb f8 ...aQ.:>..M..... 0130 a8 f4 b4 3c 4c c8 a6 21 7f 3f d4 a4 3a ff db 17 ....T.O. 0070 6a b6 46 dc d0 29 61 cf cf 49 7e 66 1d af 5d 00 j.F..)a..I~f..]. 0080 a8 0e .. Frame 15 (130 bytes on wire, 130 bytes captured) Arrival Time: Apr 30, 2006 15:38:44.503568000 Time delta from previous packet: 0.000269000 seconds Time since reference or first frame: 5.190749000 seconds Frame Number: 15 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec), Dst: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Destination: 00:0c:29:89:f2:82 (00:0c:29:89:f2:82) Source: 00:50:c2:4b:ae:ec (00:50:c2:4b:ae:ec) Type: IP (0x0800) Frame check sequence: 0x4a506cc4 [correct] Internet Protocol, Src: 165.227.249.149 (165.227.249.149), Dst: 165.227.249.122 (165.227.249.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x3b85 [correct] Good: True Bad : False Source: 165.227.249.149 (165.227.249.149) Destination: 165.227.249.122 (165.227.249.122) Encapsulating Security Payload SPI: 0xafd7e931 Sequence: 1 Data (84 bytes) 0000 00 0c 29 89 f2 82 00 50 c2 4b ae ec 08 00 45 00 ..)....P.K....E. 0010 00 70 00 00 00 00 40 32 3b 85 a5 e3 f9 95 a5 e3 .p....@2;....... 0020 f9 7a af d7 e9 31 00 00 00 01 00 00 00 00 00 00 .z...1.......... 0030 00 00 3c 77 68 c2 1c 81 f4 72 3d ed 75 d3 99 49 ..