Frame 1 (266 bytes on wire, 266 bytes captured) Arrival Time: Nov 9, 2005 09:14:29.411538000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 266 bytes Capture Length: 266 bytes Ethernet II, Src: 00:0c:29:f4:af:90, Dst: 00:0f:b5:ca:72:27 Destination: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Frame check sequence: 0xa27b47d3 (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 248 Identification: 0x0088 (136) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3abc (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.109 (165.227.249.109) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 228 Checksum: 0xc36b (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE1640379D3EECDE0 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 220 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 40 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 32 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x8F9CC94E01248ECDF147594C284B213B Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-01 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 0000 00 0f b5 ca 72 27 00 0c 29 f4 af 90 08 00 45 00 ....r'..).....E. 0010 00 f8 00 88 00 00 40 11 3a bc a5 e3 f9 7c a5 e3 ......@.:....|.. 0020 f9 6d 01 f4 01 f4 00 e4 c3 6b e1 64 03 79 d3 ee .m.......k.d.y.. 0030 cd e0 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 dc 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 00 01 00 01 00 00 00 20 00 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 80 0c 70 80 0d 00 00 14 8f 9c ........p....... 0080 c9 4e 01 24 8e cd f1 47 59 4c 28 4b 21 3b 0d 00 .N.$...GYL(K!;.. 0090 00 14 27 ba b5 dc 01 ea 07 60 ea 4e 31 90 ac 27 ..'......`.N1..' 00a0 c0 d0 0d 00 00 14 61 05 c4 22 e7 68 47 e4 3f 96 ......a..".hG.?. 00b0 84 80 12 92 ae cd 0d 00 00 14 44 85 15 2d 18 b6 ..........D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 0d 00 00 14 cd 60 .....F.y.......` 00d0 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48 0d 00 FC5.!.|...h..H.. 00e0 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 ......>.in.c...B 00f0 7b 1f 00 00 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 {.....}...S..o,. 0100 9d 92 15 52 9d 56 a2 7b 47 d3 ...R.V.{G. Frame 2 (186 bytes on wire, 186 bytes captured) Arrival Time: Nov 9, 2005 09:14:29.415094000 Time delta from previous packet: 0.003556000 seconds Time since reference or first frame: 0.003556000 seconds Frame Number: 2 Packet Length: 186 bytes Capture Length: 186 bytes Ethernet II, Src: 00:0f:b5:ca:72:27, Dst: 00:0c:29:f4:af:90 Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Type: IP (0x0800) Frame check sequence: 0x9e05d07d (correct) Internet Protocol, Src Addr: 165.227.249.109 (165.227.249.109), Dst Addr: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 168 Identification: 0x04b0 (1200) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x36e4 (correct) Source: 165.227.249.109 (165.227.249.109) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 148 Checksum: 0x1976 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE1640379D3EECDE0 Responder cookie: 0x415F04861A30885B Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 140 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 40 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 32 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-dpd-00.txt Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x648982785BEDBDD66A6DD356F0E160FD 0000 00 0c 29 f4 af 90 00 0f b5 ca 72 27 08 00 45 00 ..).......r'..E. 0010 00 a8 04 b0 00 00 40 11 36 e4 a5 e3 f9 6d a5 e3 ......@.6....m.. 0020 f9 7c 01 f4 01 f4 00 94 19 76 e1 64 03 79 d3 ee .|.......v.d.y.. 0030 cd e0 41 5f 04 86 1a 30 88 5b 01 10 02 00 00 00 ..A_...0.[...... 0040 00 00 00 00 00 8c 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 00 01 00 01 00 00 00 20 00 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 80 0c 70 80 0d 00 00 14 90 cb ........p....... 0080 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 ..>.in.c...B{... 0090 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00a0 01 00 00 00 00 14 64 89 82 78 5b ed bd d6 6a 6d ......d..x[...jm 00b0 d3 56 f0 e1 60 fd 9e 05 d0 7d .V..`....} Frame 3 (274 bytes on wire, 274 bytes captured) Arrival Time: Nov 9, 2005 09:14:29.425774000 Time delta from previous packet: 0.010680000 seconds Time since reference or first frame: 0.014236000 seconds Frame Number: 3 Packet Length: 274 bytes Capture Length: 274 bytes Ethernet II, Src: 00:0c:29:f4:af:90, Dst: 00:0f:b5:ca:72:27 Destination: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Frame check sequence: 0xf8b54c84 (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0089 (137) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3ab3 (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.109 (165.227.249.109) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x00fe (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE1640379D3EECDE0 Responder cookie: 0x415F04861A30885B Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Private USE (130) Length: 20 Nonce Data Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: NONE (0) Length: 24 Payload 0000 00 0f b5 ca 72 27 00 0c 29 f4 af 90 08 00 45 00 ....r'..).....E. 0010 01 00 00 89 00 00 40 11 3a b3 a5 e3 f9 7c a5 e3 ......@.:....|.. 0020 f9 6d 01 f4 01 f4 00 ec 00 fe e1 64 03 79 d3 ee .m.........d.y.. 0030 cd e0 41 5f 04 86 1a 30 88 5b 04 10 02 00 00 00 ..A_...0.[...... 0040 00 00 00 00 00 e4 0a 00 00 84 9d 2c 61 f7 ee da ...........,a... 0050 d5 42 ba 85 d6 6d 6b 60 3d 6d 44 90 45 fc 8b e7 .B...mk`=mD.E... 0060 40 0d 12 61 d0 9b 0c 59 c2 9c f4 5a 55 2d c6 31 @..a...Y...ZU-.1 0070 fc 90 68 79 31 2a fe de fd 16 2c 45 8e 69 86 f2 ..hy1*....,E.i.. 0080 3b c7 df 35 d8 02 94 f1 77 4c 73 15 7b 9b 49 dc ;..5....wLs.{.I. 0090 33 cb 48 0f 2d d0 3e 4a d2 9d 21 c7 9d 5a 95 7d 3.H.-.>J..!..Z.} 00a0 d5 cc e6 cf bd d1 27 ff 21 7c 6e 98 9e 36 96 3e ......'.!|n..6.> 00b0 d3 a7 11 c9 1d 00 e7 10 a5 22 25 5e 8e b9 98 2b ........."%^...+ 00c0 03 30 3e fe f7 0b de 50 1f 28 82 00 00 14 5c 4e .0>....P.(....\N 00d0 76 89 ea 32 ad 70 5d cd 21 41 db 79 31 68 82 00 v..2.p].!A.y1h.. 00e0 00 18 c1 fb 86 6c 4c b4 a6 0e b5 32 86 b0 db 70 .....lL....2...p 00f0 ba 15 a2 8d 91 55 00 00 00 18 21 b5 0c 74 d1 0b .....U....!..t.. 0100 a3 c9 0c 1c 61 f9 4b a5 fe ab 59 f7 a0 d5 f8 b5 ....a.K...Y..... 0110 4c 84 L. Frame 4 (266 bytes on wire, 266 bytes captured) Arrival Time: Nov 9, 2005 09:14:29.806281000 Time delta from previous packet: 0.380507000 seconds Time since reference or first frame: 0.394743000 seconds Frame Number: 4 Packet Length: 266 bytes Capture Length: 266 bytes Ethernet II, Src: 00:0f:b5:ca:72:27, Dst: 00:0c:29:f4:af:90 Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Type: IP (0x0800) Frame check sequence: 0x8d8e699f (correct) Internet Protocol, Src Addr: 165.227.249.109 (165.227.249.109), Dst Addr: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 248 Identification: 0x04b1 (1201) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3693 (correct) Source: 165.227.249.109 (165.227.249.109) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 228 Checksum: 0x501b (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE1640379D3EECDE0 Responder cookie: 0x415F04861A30885B Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 220 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Private USE (130) Length: 12 Nonce Data Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: NONE (0) Length: 24 Payload 0000 00 0c 29 f4 af 90 00 0f b5 ca 72 27 08 00 45 00 ..).......r'..E. 0010 00 f8 04 b1 00 00 40 11 36 93 a5 e3 f9 6d a5 e3 ......@.6....m.. 0020 f9 7c 01 f4 01 f4 00 e4 50 1b e1 64 03 79 d3 ee .|......P..d.y.. 0030 cd e0 41 5f 04 86 1a 30 88 5b 04 10 02 00 00 00 ..A_...0.[...... 0040 00 00 00 00 00 dc 0a 00 00 84 da 50 5e c5 a2 0d ...........P^... 0050 3a 04 e8 fb ff dc 97 bd 63 16 6d 90 b0 8a d7 a9 :.......c.m..... 0060 7e a8 f3 40 1d ea 99 43 d8 48 66 a7 39 68 0f e6 ~..@...C.Hf.9h.. 0070 3c df 1b 7b ef 02 79 1e 43 18 59 de 91 05 f1 20 <..{..y.C.Y.... 0080 70 f9 6c c8 b0 be 93 e5 9c 62 46 4b 58 4d bf c9 p.l......bFKXM.. 0090 0a 50 90 37 38 89 58 4f ee 78 0f 5c 5e 96 26 2a .P.78.XO.x.\^.&* 00a0 a7 ab e7 e2 85 09 11 40 f3 32 69 08 b0 85 40 da .......@.2i...@. 00b0 b2 07 da e3 7a 8e ab 32 c5 a7 38 7b 99 4f 97 ad ....z..2..8{.O.. 00c0 cb 02 b4 e1 e5 a3 25 27 00 19 82 00 00 0c 9e 7d ......%'.......} 00d0 0f e6 09 95 6d 50 82 00 00 18 21 b5 0c 74 d1 0b ....mP....!..t.. 00e0 a3 c9 0c 1c 61 f9 4b a5 fe ab 59 f7 a0 d5 00 00 ....a.K...Y..... 00f0 00 18 c1 fb 86 6c 4c b4 a6 0e b5 32 86 b0 db 70 .....lL....2...p 0100 ba 15 a2 8d 91 55 8d 8e 69 9f .....U..i. Frame 5 (122 bytes on wire, 122 bytes captured) Arrival Time: Nov 9, 2005 09:14:29.813231000 Time delta from previous packet: 0.006950000 seconds Time since reference or first frame: 0.401693000 seconds Frame Number: 5 Packet Length: 122 bytes Capture Length: 122 bytes Ethernet II, Src: 00:0c:29:f4:af:90, Dst: 00:0f:b5:ca:72:27 Destination: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Frame check sequence: 0x5cac415a (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x008a (138) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3b4a (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.109 (165.227.249.109) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x04b5 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE1640379D3EECDE0 Responder cookie: 0x415F04861A30885B Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0f b5 ca 72 27 00 0c 29 f4 af 90 08 00 45 00 ....r'..).....E. 0010 00 68 00 8a 00 00 40 11 3b 4a a5 e3 f9 7c a5 e3 .h....@.;J...|.. 0020 f9 6d 01 f4 01 f4 00 54 04 b5 e1 64 03 79 d3 ee .m.....T...d.y.. 0030 cd e0 41 5f 04 86 1a 30 88 5b 05 10 02 01 00 00 ..A_...0.[...... 0040 00 00 00 00 00 4c 44 06 4a 65 06 bc 2f 16 f7 a0 .....LD.Je../... 0050 9b 7b aa e4 ec 72 2c 22 52 25 66 ae 79 b9 37 ae .{...r,"R%f.y.7. 0060 34 0e ad 5d 7b fb 28 98 76 fd 28 f8 3f dc 26 75 4..]{.(.v.(.?.&u 0070 4b aa dd 06 07 75 5c ac 41 5a K....u\.AZ Frame 6 (138 bytes on wire, 138 bytes captured) Arrival Time: Nov 9, 2005 09:14:30.265477000 Time delta from previous packet: 0.452246000 seconds Time since reference or first frame: 0.853939000 seconds Frame Number: 6 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:0f:b5:ca:72:27, Dst: 00:0c:29:f4:af:90 Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Type: IP (0x0800) Frame check sequence: 0xc629888f (correct) Internet Protocol, Src Addr: 165.227.249.109 (165.227.249.109), Dst Addr: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x04b2 (1202) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3712 (correct) Source: 165.227.249.109 (165.227.249.109) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xc069 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE1640379D3EECDE0 Responder cookie: 0x415F04861A30885B Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 f4 af 90 00 0f b5 ca 72 27 08 00 45 00 ..).......r'..E. 0010 00 78 04 b2 00 00 40 11 37 12 a5 e3 f9 6d a5 e3 .x....@.7....m.. 0020 f9 7c 01 f4 01 f4 00 64 c0 69 e1 64 03 79 d3 ee .|.....d.i.d.y.. 0030 cd e0 41 5f 04 86 1a 30 88 5b 05 10 02 01 00 00 ..A_...0.[...... 0040 00 00 00 00 00 5c ee 74 71 02 2b d1 aa 92 9c 5d .....\.tq.+....] 0050 29 47 95 2b c5 87 a4 1d 40 3a ba 5a 2b 5f 8b 15 )G.+....@:.Z+_.. 0060 91 bf e7 95 6e 17 e2 ad e7 10 3d 6e 05 ec ac c7 ....n.....=n.... 0070 8c d3 b8 da c0 1a bf 39 31 a5 ad 76 e1 a6 7f db .......91..v.... 0080 0e 5e ff 8a 25 65 c6 29 88 8f .^..%e.).. Frame 7 (338 bytes on wire, 338 bytes captured) Arrival Time: Nov 9, 2005 09:14:30.275717000 Time delta from previous packet: 0.010240000 seconds Time since reference or first frame: 0.864179000 seconds Frame Number: 7 Packet Length: 338 bytes Capture Length: 338 bytes Ethernet II, Src: 00:0c:29:f4:af:90, Dst: 00:0f:b5:ca:72:27 Destination: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Frame check sequence: 0x812b58f7 (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x008b (139) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a71 (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.109 (165.227.249.109) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x7bc1 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE1640379D3EECDE0 Responder cookie: 0x415F04861A30885B Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x9A59D666 Length: 292 Encrypted payload (264 bytes) 0000 00 0f b5 ca 72 27 00 0c 29 f4 af 90 08 00 45 00 ....r'..).....E. 0010 01 40 00 8b 00 00 40 11 3a 71 a5 e3 f9 7c a5 e3 .@....@.:q...|.. 0020 f9 6d 01 f4 01 f4 01 2c 7b c1 e1 64 03 79 d3 ee .m.....,{..d.y.. 0030 cd e0 41 5f 04 86 1a 30 88 5b 08 10 20 01 9a 59 ..A_...0.[.. ..Y 0040 d6 66 00 00 01 24 67 60 df 7d be 27 07 17 99 8f .f...$g`.}.'.... 0050 6c f9 2e 3d a4 46 e9 f6 fd 31 c1 79 80 09 d3 07 l..=.F...1.y.... 0060 1b f8 a3 d7 db 6c f9 61 6c 9b 65 c7 6b 1b 79 c0 .....l.al.e.k.y. 0070 2c 96 88 77 c0 bc b7 66 b8 f1 33 a9 ea 14 0c 2b ,..w...f..3....+ 0080 8f cc bf b2 c7 fc e8 7a 99 b3 92 72 f7 0f 4f f2 .......z...r..O. 0090 b6 fc 4b 5a ed 66 86 12 bb b4 19 80 1e a2 d7 01 ..KZ.f.......... 00a0 9a f7 23 63 b2 79 5c b6 1d cd 3f a8 3d 52 d8 85 ..#c.y\...?.=R.. 00b0 aa 13 77 48 51 d1 24 b8 73 19 47 78 40 78 0a 7b ..wHQ.$.s.Gx@x.{ 00c0 da 05 1e b2 69 0b b5 42 61 29 9a 95 c8 82 3f 20 ....i..Ba)....? 00d0 70 03 b3 9a 46 53 75 cc 72 5a 90 01 73 77 86 ea p...FSu.rZ..sw.. 00e0 8e 23 77 62 25 04 7f a9 f6 5d c2 84 63 4a a0 5e .#wb%....]..cJ.^ 00f0 b1 3a 71 17 85 70 59 5a 8e 7a 2c 3c 03 84 e4 38 .:q..pYZ.z,<...8 0100 a0 5c 28 ec ab d3 e2 b2 78 75 5e 9b 5c bd b6 17 .\(.....xu^.\... 0110 6a 21 97 0d fc 54 cd c9 ee 7d d1 6c c7 10 11 9d j!...T...}.l.... 0120 49 87 56 8e ea ad 69 59 2a b9 c4 fa 16 49 09 d0 I.V...iY*....I.. 0130 eb 33 92 d8 85 56 97 ae 6b c0 74 be 63 c7 9c a5 .3...V..k.t.c... 0140 89 b8 6b 3c 30 bb 26 7c 3a a6 98 e4 20 e6 81 2b ..k<0.&|:... ..+ 0150 58 f7 X. Frame 8 (330 bytes on wire, 330 bytes captured) Arrival Time: Nov 9, 2005 09:14:30.668142000 Time delta from previous packet: 0.392425000 seconds Time since reference or first frame: 1.256604000 seconds Frame Number: 8 Packet Length: 330 bytes Capture Length: 330 bytes Ethernet II, Src: 00:0f:b5:ca:72:27, Dst: 00:0c:29:f4:af:90 Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Type: IP (0x0800) Frame check sequence: 0x7190afed (correct) Internet Protocol, Src Addr: 165.227.249.109 (165.227.249.109), Dst Addr: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x04b7 (1207) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x364d (correct) Source: 165.227.249.109 (165.227.249.109) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xd646 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE1640379D3EECDE0 Responder cookie: 0x415F04861A30885B Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x9A59D666 Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 f4 af 90 00 0f b5 ca 72 27 08 00 45 00 ..).......r'..E. 0010 01 38 04 b7 00 00 40 11 36 4d a5 e3 f9 6d a5 e3 .8....@.6M...m.. 0020 f9 7c 01 f4 01 f4 01 24 d6 46 e1 64 03 79 d3 ee .|.....$.F.d.y.. 0030 cd e0 41 5f 04 86 1a 30 88 5b 08 10 20 01 9a 59 ..A_...0.[.. ..Y 0040 d6 66 00 00 01 1c b6 98 cc 94 66 95 e3 19 58 07 .f........f...X. 0050 6d 88 33 60 bf c8 9a 8e 7d 6c a8 02 7b b3 3c a0 m.3`....}l..{.<. 0060 45 52 11 53 2b 2e 99 91 08 fb 1b 90 6f 91 13 f4 ER.S+.......o... 0070 72 b5 d8 c0 57 ea 20 b1 59 2f b9 35 0c 55 ba 2e r...W. .Y/.5.U.. 0080 21 00 70 ad b8 ef f4 8f df 6e 08 68 06 58 44 d6 !.p......n.h.XD. 0090 b1 cb 2f 56 14 f2 7b 7e 37 95 da 83 59 8b 71 81 ../V..{~7...Y.q. 00a0 92 31 a1 a1 b3 4d 4e ae 43 75 1d de 0e a3 16 a8 .1...MN.Cu...... 00b0 d3 80 c8 a8 e2 bb b0 53 a1 59 39 27 81 33 48 62 .......S.Y9'.3Hb 00c0 23 06 a3 2f 07 3b 0c 68 b2 ec 78 c6 55 03 35 bc #../.;.h..x.U.5. 00d0 76 02 4f 25 ea c8 31 ea ac a1 bb 32 cb 34 f2 f9 v.O%..1....2.4.. 00e0 ae 67 23 62 a5 6c 0a 4c 9b 36 af e8 d5 8e 1a 0d .g#b.l.L.6...... 00f0 cc 4d 62 79 41 07 cc 86 88 d7 c9 72 18 94 a2 c6 .MbyA......r.... 0100 0b 99 01 fd a7 27 70 41 35 dd e9 6c f8 6b ed 88 .....'pA5..l.k.. 0110 2b 60 0d 96 89 68 71 ca 0f e0 47 6a b1 e7 79 fe +`...hq...Gj..y. 0120 fc 16 09 bf 8f 1b 0d c5 da d8 f0 74 24 89 ac f0 ...........t$... 0130 90 07 1d 92 1d 7e 15 f8 df 4a 36 0c 25 13 54 9c .....~...J6.%.T. 0140 c8 14 eb a0 49 76 71 90 af ed ....Ivq... Frame 9 (98 bytes on wire, 98 bytes captured) Arrival Time: Nov 9, 2005 09:14:30.679562000 Time delta from previous packet: 0.011420000 seconds Time since reference or first frame: 1.268024000 seconds Frame Number: 9 Packet Length: 98 bytes Capture Length: 98 bytes Ethernet II, Src: 00:0c:29:f4:af:90, Dst: 00:0f:b5:ca:72:27 Destination: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Frame check sequence: 0x3f2ea8f1 (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 80 Identification: 0x008c (140) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3b60 (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.109 (165.227.249.109) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 60 Checksum: 0x2d89 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xE1640379D3EECDE0 Responder cookie: 0x415F04861A30885B Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x9A59D666 Length: 52 Encrypted payload (24 bytes) 0000 00 0f b5 ca 72 27 00 0c 29 f4 af 90 08 00 45 00 ....r'..).....E. 0010 00 50 00 8c 00 00 40 11 3b 60 a5 e3 f9 7c a5 e3 .P....@.;`...|.. 0020 f9 6d 01 f4 01 f4 00 3c 2d 89 e1 64 03 79 d3 ee .m.....<-..d.y.. 0030 cd e0 41 5f 04 86 1a 30 88 5b 08 10 20 01 9a 59 ..A_...0.[.. ..Y 0040 d6 66 00 00 00 34 61 d8 58 4d 97 dc 44 da 7d c0 .f...4a.XM..D.}. 0050 83 9f d4 8f 03 67 ea fb 9f ac b3 d5 d8 7d 3f 2e .....g.......}?. 0060 a8 f1 .. Frame 10 (154 bytes on wire, 154 bytes captured) Arrival Time: Nov 9, 2005 09:14:30.970806000 Time delta from previous packet: 0.291244000 seconds Time since reference or first frame: 1.559268000 seconds Frame Number: 10 Packet Length: 154 bytes Capture Length: 154 bytes Ethernet II, Src: 00:0c:29:f4:af:90, Dst: 00:0f:b5:ca:72:27 Destination: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Frame check sequence: 0x370bcc48 (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x002d (45) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b65 (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.109 (165.227.249.109) Encapsulating Security Payload SPI: 0x8f03d457 Sequence: 2 Data (108 bytes) 0000 00 0f b5 ca 72 27 00 0c 29 f4 af 90 08 00 45 00 ....r'..).....E. 0010 00 88 00 2d 00 00 f0 32 8b 65 a5 e3 f9 7c a5 e3 ...-...2.e...|.. 0020 f9 6d 8f 03 d4 57 00 00 00 02 0f 36 c2 a0 9b 2a .m...W.....6...* 0030 30 8b 4e 91 be 11 7c e4 f2 db d8 8b 10 0b a0 98 0.N...|......... 0040 3a 01 17 40 55 f0 4e 2b 8c 4c b1 11 bb cd c7 7c :..@U.N+.L.....| 0050 5a 9c cf d6 4f 20 3b 62 ab b0 a5 68 ed 47 bc 8e Z...O ;b...h.G.. 0060 71 ff da 71 f4 60 d7 7b 32 c5 14 18 aa cb 9e 12 q..q.`.{2....... 0070 e4 36 15 c0 ad 5c 73 73 7a d6 44 b8 3d 57 04 a6 .6...\ssz.D.=W.. 0080 8d 72 d3 70 53 a8 44 6c 54 10 05 2d 6e 04 3c 6e .r.pS.DlT..-n.. 0090 3a e6 7f 98 02 84 0e ef 89 bb :......... Frame 12 (154 bytes on wire, 154 bytes captured) Arrival Time: Nov 9, 2005 09:14:31.897230000 Time delta from previous packet: 0.784869000 seconds Time since reference or first frame: 2.485692000 seconds Frame Number: 12 Packet Length: 154 bytes Capture Length: 154 bytes Ethernet II, Src: 00:0c:29:f4:af:90, Dst: 00:0f:b5:ca:72:27 Destination: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Frame check sequence: 0x2db4d7af (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x002f (47) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b63 (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.109 (165.227.249.109) Encapsulating Security Payload SPI: 0x8f03d457 Sequence: 4 Data (108 bytes) 0000 00 0f b5 ca 72 27 00 0c 29 f4 af 90 08 00 45 00 ....r'..).....E. 0010 00 88 00 2f 00 00 f0 32 8b 63 a5 e3 f9 7c a5 e3 .../...2.c...|.. 0020 f9 6d 8f 03 d4 57 00 00 00 04 d5 e3 bc 40 75 ca .m...W.......@u. 0030 47 d0 42 67 14 c2 28 66 53 6c f4 e9 6c f2 f0 e3 G.Bg..(fSl..l... 0040 48 cf 80 50 f6 3e 8f 8b 65 ab e8 8d e7 1f e6 8a H..P.>..e....... 0050 62 b6 9f 19 59 2e 9a e2 ba c9 69 9a ba cb d1 fe b...Y.....i..... 0060 7e 8e 66 f5 bf c4 7d e1 76 7c 59 87 08 1c 5b d4 ~.f...}.v|Y...[. 0070 22 d0 9e 99 2b c5 38 3c 8f a3 0f dc 6d a9 8c dc "...+.8<....m... 0080 15 b1 44 ef b6 7e 5b 6e 9e ab 81 11 39 01 ab af ..D..~[n....9... 0090 c1 f4 ac b0 38 ea 2d b4 d7 af ....8.-... Frame 13 (154 bytes on wire, 154 bytes captured) Arrival Time: Nov 9, 2005 09:14:31.902619000 Time delta from previous packet: 0.005389000 seconds Time since reference or first frame: 2.491081000 seconds Frame Number: 13 Packet Length: 154 bytes Capture Length: 154 bytes Ethernet II, Src: 00:0f:b5:ca:72:27, Dst: 00:0c:29:f4:af:90 Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Type: IP (0x0800) Frame check sequence: 0xcf985f5b (correct) Internet Protocol, Src Addr: 165.227.249.109 (165.227.249.109), Dst Addr: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x688b (26763) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 29 Protocol: ESP (0x32) Header checksum: 0xf607 (correct) Source: 165.227.249.109 (165.227.249.109) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0x5468db13 Sequence: 1 Data (108 bytes) 0000 00 0c 29 f4 af 90 00 0f b5 ca 72 27 08 00 45 00 ..).......r'..E. 0010 00 88 68 8b 00 00 1d 32 f6 07 a5 e3 f9 6d a5 e3 ..h....2.....m.. 0020 f9 7c 54 68 db 13 00 00 00 01 0a 73 2d 6d 50 76 .|Th.......s-mPv 0030 24 35 ee 0e 33 52 f7 a6 9b c0 30 b3 f5 10 32 a0 $5..3R....0...2. 0040 5f e1 47 87 c9 65 ba 11 ad ea 44 1e f9 f7 28 db _.G..e....D...(. 0050 fa b7 28 af c8 71 f8 28 7f 3e 2f eb 8c b4 3d ea ..(..q.(.>/...=. 0060 64 a7 76 5f 62 ed b9 93 b6 a9 95 40 72 ac a7 53 d.v_b......@r..S 0070 bb 49 2d 43 0a 8f 89 b9 86 00 c2 40 38 21 11 3f .I-C.......@8!.? 0080 d6 01 95 79 07 31 19 be 47 dc 4c 06 5c ef 70 5e ...y.1..G.L.\.p^ 0090 7f 13 4f 10 fb b3 cf 98 5f 5b ..O....._[